⌘ + K

SUSE-SU-2026:23481-1

Dashboard / Vulnerabilities / SUSE-SU-2026:23481-1

SUSE-SU-2026:23481-1

Published: 8 Sept 2026Last Modified: 14 Sept 2026

Upstream:

Aliases:

Summary: Security update for the Linux Kernel

Details: The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731). - CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225). - CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629). - CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788). - CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073). - CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004). - CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061). - CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133). - CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619). - CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541). - CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335). - CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587). - CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446). - CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584). - CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788). - CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068). - CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121). - CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897). - CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023). - CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501). - CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238). - CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612). - CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874). - CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860). - CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013). - CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987). - CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004). - CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979). - CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972). - CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113). - CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234). - CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242). - CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). - CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126). - CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114). - CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388). - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655). - CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695). - CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412). - CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783). - CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530). - CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965). - CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969). - CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985). - CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167). - CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635). - CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665). - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306). - CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590). - CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686). - CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381). - CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301). - CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256). - CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774). - CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731) - CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238). - CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579). - CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713). - CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815). - CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090). - CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108). - CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251). - CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111). - CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365). - CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830). - CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230). - CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260). - CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297). - CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182). - CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179). - CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175). - CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429). - CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486). - CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497). - CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569). - CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571). - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385). - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390). - CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423). - CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641). - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877). - CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008). - CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019). - CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662). - CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484). - CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673). - CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028). - CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963). - CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027). - CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868). - CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038). - CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030). - CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734). - CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774). - CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804). - CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831). - CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834). - CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105). - CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882). - CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891). - CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762). - CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766). - CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060). - CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484). - CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983). - CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490). - CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488). - CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516). - CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748). - CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741). - CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262). - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742). - CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745). - CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749). - CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743). - CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346). - CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063). - CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956). - CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957). - CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200). - CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150). - CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210). - CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213). - CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() (bsc#1272799). - CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798). - CVE-2026-64222: octeontx2-pf: avoid double free of pool->stack on AQ init failure (bsc#1272788). - CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786). - CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905). - CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276). - CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058). - CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325). - CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525). - CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975). - CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944). - CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968). - CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028). - CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598). - CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936). - CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958). - CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305). - CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422). - CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868). - CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603). - CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860). - CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291). - CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426). - CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541). - CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539). - CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543). - CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545). - CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061). - CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077). - CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780). - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274). - CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880). - CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277). - CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982). - CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523). - CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273). - CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075). - CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547). - CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289). - CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335). - CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303). - CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311). - CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318). - CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337). - CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813). - CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323). - CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336). - CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340). - CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930). - CVE-2026-64563: rhashtable: clear stale iter->p on table restart (bsc#1273995). - CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006). - CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014). - CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030). - CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031). - CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041). - CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040). - CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497). - CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297). - CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298). - CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580). - CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581). - CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713). - CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876). - CVE-2026-68117: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (bsc#1274881). - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888). - CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169). - CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237). - CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517). - CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553). - CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474). - CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941). - CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578). - CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582). - CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583). - CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584). - CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294). - CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301). - CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303). - CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304). - CVE-2026-68156: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (bsc#1275305). - CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307). - CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470). - CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472). - CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892). - CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930). - CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161). - CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934). - CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704). - CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817). - CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150). - CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970). - CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973). - CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975). - CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976). - CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091). - CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040). - CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088). - CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083). - CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663). - CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665). - CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662). - CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659). - CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656). - CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649). - CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651). - CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646). - CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645). - CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642). - CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644). - CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640). - CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639). - CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629). - CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831). - CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814). - CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898). - CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908). - CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709). - CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696). - CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690). - CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698). - CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706). - CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700). - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274705). - CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800). - CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801). - CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834). - CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500). - CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208). - CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506). - CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961). - CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034). - CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528). - CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155). - CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535). - CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540). - CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523). - CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551). - CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665). - CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669). - CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827). - CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204). - CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678). - CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886). - CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905). - CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923). - CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160). - CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159). - CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925). - CVE-2026-72341: net/mlx5e: Fix publication race for priv->channel_stats[] (bsc#1277660). - CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775). - CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776). - CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869). - CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064). - CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069). - CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057). - CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059). - CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047). - CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037). - CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941). - CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937). - CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943). - CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551). - CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546). - CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542). - CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507). - CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452). - CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446). - CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864). - CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202). - CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr->pd (bsc#1277095). - CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285). - CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408). - CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077). - CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073). - CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335). - CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355). - CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346). - CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350). - CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864). - CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867). - CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946). - CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950). - CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954). - CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797). - CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798). - CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805). - CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687). - CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695). - CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688). - CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696). - CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574). - CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566). - CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569). - CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561). - CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782). - CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784). - CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066). - CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054). - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391). - CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927). - CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625). - CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931). - CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569). - CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561). - CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688). - CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022). - CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275). - CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516). The following non security issues were fixed: - accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes). - accessibility: speakup: unregister tty ldisc on later init failures (git-fixes). - ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes). - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes). - ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes). - ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes). - ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes). - ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes). - ACPI: video: Release PCI device reference after lookup (git-fixes). - add my missing Reviewed-by: tag. - ALSA: 6fire: bound the MIDI event length from the device (git-fixes). - ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes). - ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes). - ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes). - ALSA: dummy: Check card index validity at probe (stable-fixes). - ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes). - ALSA: hda: Fix connection list comparison in proc output (git-fixes). - ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes). - ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes). - ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes). - ALSA: seq: midi: Serialize input teardown with event_input (git-fixes). - ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes). - ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes). - ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes). - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes). - ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes). - ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes). - apparmor: advertise the tcp fast open fix is applied (git-fixes). - ASoC: adau1761: sort the register default table (git-fixes). - ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes). - ASoC: apple: mca: increase SERDES reset delay (git-fixes). - ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes). - ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes). - ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes). - ASoC: cs35l41: sort the register default table (git-fixes). - ASoC: cs35l45: sort the register default table (git-fixes). - ASoC: cs4265: sort the register default table (git-fixes). - ASoC: cx2072x: sort the register default table (git-fixes). - ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes). - ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes). - ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes). - ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes). - ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes). - ASoC: fsl_easrc: sort the register default table (git-fixes). - AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes). - ASoC: max9860: sort the register default table (git-fixes). - ASoC: meson: Keep link pointers valid on realloc failure (git-fixes). - ASoC: ml26124: sort the register default table (git-fixes). - ASoC: pcm512x: sort the register default table (git-fixes). - ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes). - ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes). - ASoC: rt274: sort the register default table (git-fixes). - ASoC: rt286: sort the register default table (git-fixes). - ASoC: rt298: sort the register default table (git-fixes). - ASoC: rt700-sdw: always drain jack work on remove (git-fixes). - ASoC: rt700: drop duplicate reg_default entry (git-fixes). - ASoC: rt700: sort the register default table (git-fixes). - ASoC: rt711-sdca: sort the register default tables (git-fixes). - ASoC: rt711: sort the register default table (git-fixes). - ASoC: rt712-sdca-dmic: sort the register default table (git-fixes). - ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes). - ASoC: rt715-sdca: sort the register default tables (git-fixes). - ASoC: rt715: sort the register default table (git-fixes). - ASoC: rt1316-sdw: sort the register default table (git-fixes). - ASoC: rt1318-sdw: sort the register default table (git-fixes). - ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes). - ASoC: sgtl5000: sort the register default table (git-fixes). - ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes). - ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes). - ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes). - ASoC: SOF: validate topology volume range before allocation (git-fixes). - ASoC: sti-sas: sort the register default table (git-fixes). - ASoC: tas2552: sort the register default table (git-fixes). - ASoC: tas2764: sort the register default table (git-fixes). - ASoC: tas2780: sort the register default table (git-fixes). - ASoC: tegra210_i2s: sort the register default table (git-fixes). - ASoC: tegra210_mixer: sort the register default table (git-fixes). - ASoC: tegra: Fix the MIXER enable default value (git-fixes). - ASoC: tegra: Sort MBDRC register defaults (git-fixes). - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes). - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes). - batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes). - batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes). - batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes). - batman-adv: fix stale receive device on merged fragments (git-fixes). - Bluetooth: btintel: Fix diagnostics event detection (git-fixes). - Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes). - Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes). - Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes). - Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes). - Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes). - Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes). - Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes). - Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes). - Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes). - Bluetooth: hci_event: fix LE list UAF on reset (git-fixes). - Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes). - Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes). - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes). - Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes). - Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes). - Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes). - Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes). - Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes). - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes). - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes). - Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes). - bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes). - bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes). - bus: ti-sysc: Fix /chosen node reference leak (git-fixes). - cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes). - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes). - crypto: aspeed - Propagate platform_get_irq() errors (git-fixes). - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes). - crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes). - crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes). - crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes). - crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes). - crypto: doc - Remove extra parenthesis (git-fixes). - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes). - crypto: keembay - Initialize completion before requesting IRQ (git-fixes). - crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes). - crypto: mxs-dcp - fix source scatterlist length access (git-fixes). - crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes). - crypto: qat - clear AES key schedule from stack (git-fixes). - crypto: qce - fix CCM AAD buffer underallocation (git-fixes). - crypto: qce - fix error path in devm_qce_register_algs (git-fixes). - crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes). - crypto: sa2ul - stop probe if context pool creation fails (git-fixes). - crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes). - device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes). - dmaengine: dw-edma: Clear stale requests on termination (git-fixes). - dmaengine: dw-edma: Complete descriptors before pausing (git-fixes). - dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes). - dmaengine: dw-edma: Serialize abort state updates (git-fixes). - dmaengine: dw-edma: Serialize channel state checks (git-fixes). - dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes). - dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes). - dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes). - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes). - dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes). - driver core: soc: Unregister bus on early device registration failure (git-fixes). - drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes). - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes). - drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes). - drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes). - drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes). - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes). - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes). - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes). - drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes). - drm/amdgpu: check ASPM on the dGPU host link (git-fixes). - drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes). - drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes). - drm/amdgpu: fix autosuspend cleanup during removal (git-fixes). - drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes). - drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes). - drm/amdgpu: Fix UVD min buffer sizes (stable-fixes). - drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes). - drm/amdgpu: Implement insert_end for VCE 3 (git-fixes). - drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes). - drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes). - drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes). - drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes). - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes). - drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes). - drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes). - drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes). - drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes). - drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes). - drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes). - drm/connector: Fix epoch_counter docs to reflect reality (git-fixes). - drm/hibmc: Fix list of formats on the primary plane (git-fixes). - drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes). - drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes). - drm/lima: call drm_mm_init() with a valid allocation range (git-fixes). - drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes). - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes). - drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes). - drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes). - drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes). - drm/radeon: fix autosuspend cleanup during teardown (git-fixes). - drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes). - drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes). - drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes). - drm/sun4i: crtc: Propagate layer initialization error (git-fixes). - drm/sun4i: Drop node references while building component list (git-fixes). - drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes). - drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes). - drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes). - drm/sun4i: tcon: Drop remote endpoint reference (git-fixes). - drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes). - drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes). - drm/sun4i: vi scaler: Fix coefficient selection (git-fixes). - drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes). - drm/tve200: add OF module alias for autoloading (git-fixes). - drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes). - drm: lcdif: Wait for vblank before disabling DMA (git-fixes). - drm: Remove unused header in drm_dumb_buffers.c (git-fixes). - ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes). - fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes). - fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes). - fbdev: kyro: Validate overlay viewport coordinates (git-fixes). - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes). - fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes). - fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes). - fbdev: uvesafb: unregister connector callback on init failure (git-fixes). - firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes). - firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes). - firmware: arm_scmi: Fix requested device removal race (git-fixes). - firmware: arm_scmi: Free transport channel on IDR failure (git-fixes). - firmware: arm_scmi: Protect device request lookup with RCU (git-fixes). - firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes). - firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes). - firmware: arm_scmi: Use channel ID for transport teardown (git-fixes). - firmware_loader: do not queue completed sysfs fallback requests (git-fixes). - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes). - fpga: dfl: fme: add error handling (git-fixes). - fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes). - gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes). - gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes). - HID: core: fix number/pointer type confusion on long items (git-fixes). - HID: core: fix OOB read of field->usage in hid_set_field() (git-fixes). - HID: hyperv: validate initial device info bounds (git-fixes). - HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes). - HID: lg4ff: validate report length before fixed offsets (git-fixes). - HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes). - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes). - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes). - HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes). - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes). - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes). - HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes). - HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes). - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes). - HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes). - HID: roccat: bound device-supplied profile index (git-fixes). - HID: roccat: free buffered reports when destroying device (git-fixes). - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes). - HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes). - HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes). - HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes). - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes). - hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes). - hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes). - hwmon: (max6621) fix temperature clamp range (git-fixes). - hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes). - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes). - hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes). - hwrng: omap - Fix probe error path cleanup (git-fixes). - hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes). - i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes). - i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes). - i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes). - i2c: mux: Fix channel node leak on adapter add failure (git-fixes). - i2c: ocores: Disable clock on failed resume (git-fixes). - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes). - i3c: master: Fix device_register() error path (git-fixes). - i3c: master: Fix info leak and UAF in device unregister path (git-fixes). - i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes). - ibmvnic: Only record tx completed bytes once per handler (bsc#1274620). - iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes). - iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes). - iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes). - iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes). - iio: dac: m62332: Fix regulator reference count imbalance (git-fixes). - iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes). - iio: light: cm32181: return zero after writing calibscale (git-fixes). - iio: light: gp2ap002: Disable regulators on resume failure (git-fixes). - iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes). - iio: light: isl29028: return zero in write_raw() on success (git-fixes). - iio: light: tsl2583: return zero in write_raw() on success (git-fixes). - iio: light: tsl2772: fix ALS calibscale readback (git-fixes). - iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes). - iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes). - iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes). - iio: srf04: fix pm_runtime handling on probe error path (git-fixes). - iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes). - Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes). - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes). - Input: evdev - fix information leak in evdev_pass_values() (stable-fixes). - Input: evdev - sanitize event type index when fetching event masks (stable-fixes). - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes). - Input: focaltech - use signed coordinates to prevent underflow (git-fixes). - Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes). - Input: iforce - validate input packet lengths (stable-fixes). - Input: iqs5xx - validate firmware record destination span (git-fixes). - Input: mms114 - fix Y-resolution configuration (git-fixes). - Input: psxpad-spi - set driver data before use (git-fixes). - Input: sur40 - fix input device registration ordering (stable-fixes). - Input: sur40 - fix V4L error path cleanup (stable-fixes). - Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes). - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes). - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes). - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes). - Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes). - Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes). - interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes). - ipmi: ipmb: validate write message length (git-fixes). - ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes). - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes). - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes). - leds: pca9532: Fix inverted GPIO output polarity (git-fixes). - leds: pca9532: Fix phantom device registration on missing hardware (git-fixes). - lib/string: fix memchr_inv() for large ranges (git-fixes). - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes). - mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes). - mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes). - maple_tree: fix argument name in header (git-fixes). - md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261). - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes). - media: cec-pin: Fix event FIFO ordering (git-fixes). - media: cec: disable delayed work before freeing an interrupted transmit (git-fixes). - media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes). - media: cec: Serialize exclusive follower delivery (git-fixes). - media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes). - media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes). - media: cobalt: Avoid freeing ALSA private data twice (git-fixes). - media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes). - media: cx23885: cancel NetUP CI work before teardown (git-fixes). - media: em28xx: defer audio-only extension registration (git-fixes). - media: em28xx: fix use-after-free of dev_next->devlist on disconnect (git-fixes). - media: go7007: defer the ALSA v4l2 put until card release (git-fixes). - media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes). - media: i2c: ov7740: fix use-after-destroy in remove (git-fixes). - media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes). - media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes). - media: mc-entity: Add missing kerneldoc (git-fixes). - media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes). - media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes). - media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes). - media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes). - media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes). - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes). - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes). - media: s2255: bound JPEG frame size before copying into the buffer (git-fixes). - media: s2255: check firmware size before reading trailing marker (git-fixes). - media: saa7164: fix cleanup on resource allocation failure (git-fixes). - media: tda18250: fix possible integer overflow (git-fixes). - media: usbtv: keep device alive while ALSA card exists (git-fixes). - media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes). - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes). - media: venus: fix payload size calculation in parse_raw_formats() (git-fixes). - media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes). - media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes). - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes). - media: vimc: fix pixel format lookup in enum_framesizes (git-fixes). - media: zoran: Avoid freeing a registered video_device twice (git-fixes). - mei: pull kvfree out of spinlock (git-fixes). - mfd: iqs62x: Reject zero-length firmware records (git-fixes). - mfd: rave-sp: validate received frame payload lengths (git-fixes). - misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes). - misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes). - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes). - misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes). - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (git-fixes). - misc: rtsx: add missing write register handling (git-fixes). - misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes). - mkspec-dtb: Move DTS prefix into package list. - mkspec-dtb: Move provides-obsoletes to package list. - mkspec-dtb: Put per-architecture package lists into a hash. - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes). - mmc: sdhci: unmap the bounce buffer before device release (git-fixes). - mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes). - mtd: afs: validate v2 image info bounds (git-fixes). - mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes). - mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes). - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes). - mtd: rawnand: validate ONFI extended parameter page sections (git-fixes). - net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes). - net: mana: Add handler for sriov configure (bsc#1272756). - net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes). - net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes). - net: mana: Fall back to scattered pages for GDMA queues (git-fixes). - net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792). - net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792). - net: mana: Route ring-buffer access through offset-based helpers (git-fixes). - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550). - net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes). - net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes). - net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes). - net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes). - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes). - net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes). - nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes). - nfc: digital: Do not dump a NULL response in command completion (git-fixes). - nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes). - nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes). - nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes). - nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes). - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes). - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (git-fixes). - nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes). - nfc: microread: validate target discovery payload lengths (git-fixes). - nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes). - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes). - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes). - nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes). - nfc: nci: free destination parameters when closing a connection (git-fixes). - nfc: pn533: hold a reference to the request skb during send_frame (git-fixes). - nfc: pn533: purge fragmented skbs during cleanup (git-fixes). - nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes). - nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes). - PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes). - PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes). - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes). - PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes). - PCI: meson: Fix GPIO state while requesting PERST# (git-fixes). - phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes). - phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes). - phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes). - phy: sunplus: fix error handling in sp_uphy_init() (git-fixes). - pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes). - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes). - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes). - pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes). - pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes). - platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes). - platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes). - platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes). - platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes). - platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes). - platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes). - platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes). - platform/surface: acpi-notify: Check ACPI companion before use (git-fixes). - platform/x86: dell-privacy: Fix race condition (git-fixes). - platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes). - platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes). - platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes). - platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes). - platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes). - platform/x86: ISST: Validate level in perf mask ioctls (git-fixes). - platform/x86: ISST: Validate logical CPU id and clos id (git-fixes). - platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes). - PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes). - power: supply: bd99954: Drop bad register fields (git-fixes). - power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes). - power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes). - power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes). - power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes). - power: supply: bq24257: fix use-after-free on remove (git-fixes). - power: supply: bq25890: Fix power_supply reference leak (git-fixes). - power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes). - power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes). - power: supply: isp1704_charger: cancel work on remove (git-fixes). - power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes). - power: supply: max17040: drop incorrect I2C functionality check (git-fixes). - power: supply: max17040: synchronize work cancellation on suspend (git-fixes). - power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes). - power: supply: rt9455: quiesce delayed work before teardown (git-fixes). - power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes). - power: supply: twl4030_charger: cancel workers via devm (git-fixes). - power: supply: ucs1002: fix use-after-free on remove (git-fixes). - powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes). - powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash (bsc#1271256). - powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752 ltc#221290). - powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283). - ppdev: prevent overflow when setting port timeout (git-fixes). - qede: fix out-of-bounds check for cqe->len_list (git-fixes). - rapidio: clear mport->net when rio_add_net() fails (git-fixes). - rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes). - RDMA/irdma: Remove redundant legacy_mode checks (git-fixes). - RDMA/mana_ib: drain QP references after partial table insertion (git-fixes). - RDMA/mana_ib: unify QP lookup table (git-fixes). - RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes). - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes). - regulator: core: use system_freezable_wq for init complete work (git-fixes). - regulator: devres: add API for reference voltage supplies (stable-fixes). - regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes). - regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes). - regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes). - remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (git-fixes). - remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes). - remoteproc: scp: Fix device reference leak on failed lookup (git-fixes). - Revert "drm/amdgpu: fix aperture mapping leak" (git-fixes). - Revert "media: v4l2-dev: fix error handling in __video_register_device()" (git-fixes). - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" (stable-fixes). - rpmsg: core: Fix incorrect return value documentation (git-fixes). - rpmsg: glink: smem: order FIFO read after availability check (git-fixes). - rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes). - rtc: pcf8563: fix clock provider leak on unbind (git-fixes). - rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes). - rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes). - rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes). - rtc: zynqmp: Return optional clock lookup errors (git-fixes). - scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes). - sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes). - serial: 8250_dma: Clear stale RX state on shutdown (git-fixes). - serial: amba-pl011: unprepare console clock on unregister (git-fixes). - serial: core: clear freed pointers on uart_register_driver() failure (git-fixes). - serial: qcom-geni: fix TX DMA buffer flush (git-fixes). - serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes). - smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902). - smb: client: reject overlapping data areas in SMB2 responses (git-fixes). - smb: client: require net admin for CIFS SWN netlink (bsc#1273966). - smb: client: resolve SWN tcon from live registrations (bsc#1273872). - soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes). - soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes). - soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes). - software node: Fix software_node_get_reference_args() with index -1 (git-fixes). - soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes). - speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes). - spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes). - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes). - spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes). - staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes). - staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes). - staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes). - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes). - staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes). - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes). - staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes). - staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes). - staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes). - staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes). - thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes). - thermal/drivers/qoriq: Disable clock on resume failure (git-fixes). - thermal: intel: int3400: clean up ODVP on probe failures (git-fixes). - thunderbolt: Bound the DROM dual link port number before indexing sw->ports (git-fixes). - thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes). - tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes). - tpm: st33zp24: Return zero on status read failure (git-fixes). - tpm: st33zp24: Validate locality read result (git-fixes). - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes). - tty: clear cdev pointer after cdev_add() failure (git-fixes). - tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes). - tty: skip cdev_del() when no cdev is registered (git-fixes). - uio: Fix stale info pointer in failed registration path (git-fixes). - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes). - usb: atm: usbatm: fix invalid ci_range initialization (git-fixes). - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes). - usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes). - usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes). - usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes). - usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes). - usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes). - usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes). - usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes). - usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes). - usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes). - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes). - usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes). - usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes). - usb: gadget: uac: validate rate list length before storing (git-fixes). - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes). - usb: mtu3: allow system suspend during active gadget connection (git-fixes). - usb: musb: omap2430: clean up probe error handling (stable-fixes). - USB: phy: fsl-usb: fix missing static keywords (git-fixes). - usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes). - USB: serial: digi_acceleport: fix port registration order (git-fixes). - USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes). - USB: serial: option: add TDTECH MT5710-CN (stable-fixes). - USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes). - USB: serial: spcp8x5: drop broken carrier detect support (git-fixes). - USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes). - usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes). - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes). - usb: xhci: Handle USB3 port events when there is one roothub (git-fixes). - vt: add permission check for KDSKBMETA ioctl (stable-fixes). - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes). - w1: ds28e17: reject an oversize length on an I2C block read (git-fixes). - w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes). - wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes). - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes). - wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes). - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes). - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes). - wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes). - wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes). - wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes). - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes). - wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes). - wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes). - wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes). - wifi: iwlwifi: mei: pass correct argument to function (git-fixes). - wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes). - wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes). - wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes). - wifi: mac80211: skip unused probe response countdown offsets (git-fixes). - wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes). - wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes). - wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes). - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes). - wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes). - wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes). - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes). - wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes). - wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes). - wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes). - wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes). - wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes). - wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes). - wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes). - wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes). - wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes). - wifi: mt76: mt7921: validate CLC firmware records (git-fixes). - wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes). - wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes). - wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes). - wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes). - wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes). - wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes). - wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes). - wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes). - wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes). - wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes). - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes). - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes). - wifi: rtw89: fix HE extended capability length check (git-fixes). - wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes). - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes). - xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes). - xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).

Affected packages

Package

Name: kernel-default

Purl: pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Micro%206.0

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -6.4.0-52.1

Affected versions

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High