Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 6 articles for you...
89
security advisoryfedoraDoSFedora 43 bind-dyndb-ldap Important DoS Resource Leak Fix 2026-b626e83a45
Update to 9.18.49 (rhbz#2480121) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-b626e83a45 2026-05-26 01:20:50.020972+00:00 -------------------------------------------------------------------------------- Name : bind-dyndb-ldap Product : Fedora 43 Version : 11.11 Release : 13.fc43 URL : https://releases.pagure.org/bind-dyndb-ldap Summary : LDAP back-end plug-in for BIND Description : This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server. -------------------------------------------------------------------------------- Update Information: Update to 9.18.49 (rhbz#2480121) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) Avoid unbounded recursion loop. (CVE-2026-5950) Fix outgoing zone transfers' quota issue. Feature Changes: Fix CPU spikes and slow queries when cache approaches memory limit. Bug Fixes: Fix named crash when processing SIG records in dynamic updates. Fix rndc modzone behavior for a zone in named.conf. Fix zone verification of NSEC3 signed zones. Prevent a crash when using both dns64 and filter-aaaa. Fixed an assertion failure when processing catalog zones. Prevent malicious DNSSEC zones from exhausting validator CPU. Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits. Prevent crafted queries from degrading RRL performance. Fix a bug in allow-query/allow-transfer catalog zone custom properties. Fix a memory leak issue in catalog zones. Fix suppressed missing-glue check in named-checkzone. Reject record sets too large to serve inDNS. Source: https://downloads.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html#notes-for- bind-9-18-49 -------------------------------------------------------------------------------- ChangeLog: * Wed May 20 2026 Petr Men\u0161k - 11.11-13 - Rebuilt for BIND 9.18.49 (rhbz#2480121) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2480121 - bind-9.18.49 is available https://bugzilla.redhat.com/show_bug.cgi?id=2480121 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-b626e83a45' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- . Fedora 43 bind-dyndb-ldap update 2026-b626e83a45 with critical security fixes for multiple issues.. bind-dyndb-ldap updates, Fedora vulnerabilities, LDAP security fixes. . Severity: Important. LinuxSecurity.com Team
May 26, 2026
•Important
Fedora
89
security advisoryfedoraGSS-APIFedora 43 BIND 9.18.49 Important Security Fixes for DNS Issues
Update to 9.18.49 (rhbz#2480121) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-b626e83a45 2026-05-26 01:20:50.020972+00:00 -------------------------------------------------------------------------------- Name : bind Product : Fedora 43 Version : 9.18.49 Release : 1.fc43 URL : https://www.isc.org/downloads/bind/ Summary : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Description : BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. -------------------------------------------------------------------------------- Update Information: Update to 9.18.49 (rhbz#2480121) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) Avoid unbounded recursion loop. (CVE-2026-5950) Fix outgoing zone transfers' quota issue. Feature Changes: Fix CPU spikes and slow queries when cache approaches memory limit. Bug Fixes: Fix named crash when processing SIG records in dynamic updates. Fix rndc modzone behavior for a zone in named.conf. Fix zone verification of NSEC3 signed zones. Prevent a crash when using both dns64 and filter-aaaa. Fixed an assertion failure when processing catalog zones. Prevent malicious DNSSEC zones from exhausting validator CPU. Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits. Prevent crafted queries from degrading RRL performance. Fix a bug in allow-query/allow-transfer catalog zone customproperties. Fix a memory leak issue in catalog zones. Fix suppressed missing-glue check in named-checkzone. Reject record sets too large to serve in DNS. Source: https://downloads.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html#notes-for- bind-9-18-49 -------------------------------------------------------------------------------- ChangeLog: * Wed May 20 2026 Petr Men\u0161k - 32:9.18.49-1 - Update to 9.18.49 (rhbz#2480121) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2480121 - bind-9.18.49 is available https://bugzilla.redhat.com/show_bug.cgi?id=2480121 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-b626e83a45' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- . Discover important security fixes in Fedora 43 BIND 9.18.49, addressing critical resource leaks and recursion issues.. Fedora BIND Update, DNS Security Fixes, CVE-2026-3039, Server Resource Management. . Severity: Important. LinuxSecurity.com Team
May 26, 2026
•Important
Fedora
217
security advisorybuffer overflowimportantOracle Linux 9 Kernel Important Update ELSA-2026-50145 Changes
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:. Oracle Linux Security Advisory ELSA-2026-50145 http://linux.oracle.com/errata/ELSA-2026-50145.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: aarch64: bpftool-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-container-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-container-debug-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-core-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-debug-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-debug-core-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-debug-devel-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-debug-modules-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-debug-modules-extra-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-devel-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-doc-5.15.0-318.199.3.2.el9uek.noarch.rpm kernel-uek-modules-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-modules-extra-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek64k-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek64k-core-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek64k-devel-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek64k-modules-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek64k-modules-extra-5.15.0-318.199.3.2.el9uek.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates/kernel-uek-5.15.0-318.199.3.2.el9uek.src.rpm RelatedCVEs: CVE-2024-26655 CVE-2024-36903 CVE-2024-36927 CVE-2024-40928 CVE-2024-46830 CVE-2024-49968 CVE-2025-21979 CVE-2025-22022 CVE-2025-22111 CVE-2025-22119 CVE-2025-22121 CVE-2025-37860 CVE-2025-38007 CVE-2025-38022 CVE-2025-38057 CVE-2025-38129 CVE-2025-38232 CVE-2025-38556 CVE-2025-38591 CVE-2025-40110 CVE-2025-40149 CVE-2025-40164 CVE-2025-40256 CVE-2025-68211 CVE-2025-68254 CVE-2025-68255 CVE-2025-68261 CVE-2025-68264 CVE-2025-68282 CVE-2025-68337 CVE-2025-68346 CVE-2025-68349 CVE-2025-68354 CVE-2025-68362 CVE-2025-68364 CVE-2025-68366 CVE-2025-68367 CVE-2025-68372 CVE-2025-68724 CVE-2025-68725 CVE-2025-68732 CVE-2025-68740 CVE-2025-68746 CVE-2025-68757 CVE-2025-68759 CVE-2025-68764 CVE-2025-68771 CVE-2025-68776 CVE-2025-68780 CVE-2025-68782 CVE-2025-68783 CVE-2025-68785 CVE-2025-68788 CVE-2025-68795 CVE-2025-68803 CVE-2025-68813 CVE-2025-68815 CVE-2025-68816 CVE-2025-68818 CVE-2025-68819 CVE-2025-68820 CVE-2025-71066 CVE-2025-71068 CVE-2025-71075 CVE-2025-71077 CVE-2025-71082 CVE-2025-71083 CVE-2025-71084 CVE-2025-71085 CVE-2025-71087 CVE-2025-71091 CVE-2025-71093 CVE-2025-71094 CVE-2025-71096 CVE-2025-71097 CVE-2025-71098 CVE-2025-71104 CVE-2025-71108 CVE-2025-71111 CVE-2025-71113 CVE-2025-71114 CVE-2025-71116 CVE-2025-71118 CVE-2025-71120 CVE-2025-71125 CVE-2025-71127 CVE-2025-71131 CVE-2025-71132 CVE-2025-71133 CVE-2025-71146 CVE-2025-71147 CVE-2025-71154 CVE-2025-71182 CVE-2025-71190 CVE-2025-71194 CVE-2025-71197 CVE-2026-22976 CVE-2026-22977 CVE-2026-22978 CVE-2026-22980 CVE-2026-22984 CVE-2026-22988 CVE-2026-22990 CVE-2026-22991 CVE-2026-22992 CVE-2026-22997 CVE-2026-22998 CVE-2026-22999 CVE-2026-23001 CVE-2026-23003 CVE-2026-23011 CVE-2026-23020 CVE-2026-23021 CVE-2026-23038 CVE-2026-23047 CVE-2026-23049 CVE-2026-23058 CVE-2026-23060 CVE-2026-23061 CVE-2026-23071 CVE-2026-23073 CVE-2026-23074 CVE-2026-23076 CVE-2026-23084 CVE-2026-23085 CVE-2026-23087 CVE-2026-23089 CVE-2026-23091 CVE-2026-23097 CVE-2026-23099 CVE-2026-23101 CVE-2026-23103 CVE-2026-23105 CVE-2026-23108 CVE-2026-23111 CVE-2026-23119 CVE-2026-23120 CVE-2026-23121 CVE-2026-23124 CVE-2026-23125 CVE-2026-23133 CVE-2026-23139 CVE-2026-23145 CVE-2026-23146 CVE-2026-23164 CVE-2026-23202 CVE-2026-23209 Description of changes: [5.15.0-318.199.3.2] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39057366] - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 39057366] {CVE-2026-23209} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 39057346] {CVE-2026-23111} - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 39055945] [5.15.0-318.199.3.1] - nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch) [Orabug: 39026355] - nvme: cancel pending I/O if nvme controller is in terminal state (Nilay Shroff) [Orabug: 39026355] - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch) [Orabug: 39026355] - nvme: ensure disabling pairs with unquiesce (Keith Busch) [Orabug: 39026355] [5.15.0-318.199.3] - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen) - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970594] {CVE-2026-23202} - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao) - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao) - x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper) - KVM: x86: Don't snapshot "max" TSC if host TSC is constant (Sean Christopherson) [Orabug: 38966500] - KVM: x86: Accept KVM_[GS]ET_TSC_KHZ as a VM ioctl. (David Woodhouse) [Orabug: 38966500] - sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree) [Orabug: 37855346] {CVE-2025-37860} - Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38937481] - Revert "net/rds: expand kref coverage to rds_notifier-> n_conn" (Sharath Srinivasan) [Orabug:38937481] [5.15.0-318.199.2] - drivers/soc/pensando/penfw: Add support for pcie serdes fw download. (Hiren Mehta) [Orabug: 38953591] - arm64: pensando: Add support for kpcimgr dynamic event queue (Rob Gardner) [Orabug: 38928823] - procfs: move dropping pde and pid from -> evict_inode() to -> free_inode() (Al Viro) [Orabug: 38945002] - ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38188749] - jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38188749] - Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923519] - Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923519] - Revert "IB/core: Fix off-by-one attr index in setup_hw_port_stats" (Sharath Srinivasan) [Orabug: 38923519] - drivers/soc/pensando/bsm: Fix various issues with secure-mode. (Hiren Mehta) [Orabug: 38944299] - net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928274] - net/rds: rds_send_xmit should INIT_LIST_HEAD(&to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928272] - net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928270] - net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923496] [5.15.0-318.199.1] - LTS version: v5.15.199 (Vijayendra Suman) - wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 39004275] {CVE-2025-22119} - wifi: cfg80211: fully move wiphy work to unbound workqueue (Johannes Berg) - wifi: cfg80211: cancel wiphy_work before freeing wiphy (Miri Korenblit) [Orabug: 39004414] {CVE-2025-21979} - wifi: cfg80211: fix wiphy delayed work queueing (Johannes Berg) - wifi: cfg80211: use system_unbound_wq for wiphy work (Johannes Berg) - team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) - pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski) - mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts) -writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal) - drm/imx/tve: fix probe device leak (Johan Hovold) - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski) - net/sched: act_ife: convert comma to semicolon (Chen Ni) - btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() (Jp Kobryn) - drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li) - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) - genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 39004242] {CVE-2025-38007} - HID: uclogic: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu) - wifi: mac80211: move TDLS work to wiphy work (Johannes Berg) - wifi: mac80211: use wiphy work for sdata-> work (Johannes Berg) - wifi: cfg80211: add a work abstraction with special semantics (Johannes Berg) - Bluetooth: Fix hci_suspend_sync crash (Ying Hsu) - net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) - usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649206] {CVE-2025-40164} - NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158712] {CVE-2025-38232} - ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (Luis Henriques) - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094997] {CVE-2025-38057} - fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik) - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon) - drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED (Gaosheng Cui) - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes) [Orabug: 38773375] {CVE-2025-68211} - mm/pagewalk: add walk_page_range_vma() (David Hildenbrand) - ksmbd: smbd: fixdma_unmap_sg() nents (Thomas Fourier) - mei: trace: treat reg parameter as string (Alexander Usyskin) - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) - nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff) - nvme-pci: do not directly handle subsys reset fallout (Keith Busch) - nvme-fc: rename free_ctrl callback to match name pattern (Daniel Wagner) - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) - dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold) - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold) - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930799] {CVE-2025-71197} - w1: w1_therm: use swap() to make code cleaner (Yang Guang) - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento) - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931015] {CVE-2026-23087} - iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold) - of: platform: Use default match table for /firmware (Rob Herring) - comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott) - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649138] {CVE-2025-40149} - net: Add locking to protect skb-> dev access in ip_output (Sharath Chandra Vurukala) - mptcp: only reset subflow errors when propagated (Matthieu Baerts) - scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier) - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li) - ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam) - dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi) - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev) - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi) - net: bridge: fix static keycheck (Martin Kaiser) - nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima) - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Gal Pressman) - net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) - ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg) - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima) - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970353] {CVE-2026-23164} - ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera) - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan) - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan) - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970605] {CVE-2026-23146} - bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335081] {CVE-2025-38591} - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798882] {CVE-2025-68725} - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931067] {CVE-2026-23097} - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931121] {CVE-2026-23108} - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930883] {CVE-2026-23061} - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930860] {CVE-2026-23058} - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931002] {CVE-2026-23085} - perf/x86/intel: Do not enable BTS for guests (Fernand Sieber) - netrom: fix double-free in nr_route_frame() (Jeongjun Park) - uacce: ensure safe queue release with state management (Chenghai Huang) - uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen) - uacce: fixcdev handling in the cleanup path (Wenkai Lin) - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931041] {CVE-2026-23091} - slimbus: core: fix device reference leak on report present (Johan Hovold) - slimbus: core: fix runtime PM imbalance on report present (Johan Hovold) - octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier) - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930941] {CVE-2026-23073} - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter) - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970255] {CVE-2026-23133} - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz) - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931030] {CVE-2026-23089} - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930967] {CVE-2026-23076} - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich) - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao) - iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin) - of: fix reference count leak in of_alias_scan() (Weigang He) - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931092] {CVE-2026-23101} - x86: make page fault handling disable interrupts properly (Cedric Xing) - net/sched: act_ife: avoid possible NULL deref (Eric Dumazet) - octeontx2-af: Fix error handling (Ratheesh Kannoth) - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970200] {CVE-2026-23119} - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930993] {CVE-2026-23084} - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf) - drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf) - usbnet: limitmax_mtu based on device's hard_mtu (Laurent Vivier) - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970223] {CVE-2026-23124} - mISDN: annotate data-race around dev-> work (Eric Dumazet) [Orabug: 38970211] {CVE-2026-23121} - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao) - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao) - ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan) - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930931] {CVE-2026-23071} - iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin) - staging:iio:adc:ad7280a: Register define cleanup. (Jonathan Cameron) - x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper) - scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li) - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng) - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi) - Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo) - w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li) - comedi: dmm32at: serialize use of paged registers (Ian Abbott) - crypto: authencesn - reject too-short AAD (assoclen head (Eric Dumazet) [Orabug: 39004363] {CVE-2026-22988} - net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914761] {CVE-2026-23021} - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872325] {CVE-2026-22976} - HID: quirks: work around VID/PID conflict for appledisplay (René Rebe) - bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose) - net/mlx5e: Don't print error message due to invalid module (Gal Pressman) - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu) - net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877947] {CVE-2026-22977} - inet: ping: Fix icmp outcounting (Yuan Gao) - net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu) - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht) - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari) - netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970278] {CVE-2026-23139} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan) - netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera) - ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray) - arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen) - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang) - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong) - NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust) - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) - alpha: don't reference obsolete termio struct for TC* constants (Sam James) - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior) - csky: fix csky_cmpxchg_fixup not working (Yang Li) - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin) [Orabug: 37844521] {CVE-2025-22121} - ext4: introduce ITAIL helper (Ye Bin) - libceph: make calc_target() set t-> paused, not just clear it (Ilya Dryomov) [Orabug: 38930821] {CVE-2026-23047} - libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887697] {CVE-2026-22992} - libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887691] {CVE-2026-22991} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887685] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887673] {CVE-2026-22984} - wifi: avoid kernel-infoleak fromstruct iw_point (Eric Dumazet) [Orabug: 38887650] {CVE-2026-22978} - drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin) - lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers) - mei: me: add nova lake point S DID (Alexander Usyskin) - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914755] {CVE-2026-23020} - atm: Fix dma_free_coherent() size (Thomas Fourier) - usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold) - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (Su Hui) [Orabug: 39004163] {CVE-2024-40928} - firmware: arm_scmi: Fix unused notifier-block in unregister (Amitai Gottlieb) - ext4: fix error message when rejecting the default hash (Gabriel Krisman Bertazi) - ext4: factor out ext4_hash_info_init() (Jason Yan) - ext4: filesystems without casefold feature cannot be mounted with siphash (Lizhi Xu) [Orabug: 37206152] {CVE-2024-49968} - pwm: stm32: Always program polarity (Sean Nyekjaer) - x86: remove __range_not_ok() (Arnd Bergmann) - selftests: net: test_vxlan_under_vrf: fix HV connectivity test (Andrea Righi) - ipv4: Fix uninit-value access in __ip_make_skb() (Shigeru Yoshida) [Orabug: 36683410] {CVE-2024-36927} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Shigeru Yoshida) [Orabug: 36683284] {CVE-2024-36903} - KVM: arm64: sys_regs: disable -Wuninitialized-const-pointer warning (Justin Stitt) - HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334903] {CVE-2025-38556} - KVM: x86: Acquire kvm-> srcu when handling KVM_SET_VCPU_EVENTS (Sean Christopherson) [Orabug: 37116451] {CVE-2024-46830} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152994] {CVE-2025-38129} - drm/i915/selftests: fix subtraction overflow bug (Andrzej Hajda) - mmc: core: use sysfs_emit() instead of sprintf() (Sergey Shtylyov) - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug:37844500] {CVE-2025-22111} - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann) - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852361] {CVE-2025-71127} - ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold) - lockd: fix vfs_test_lock() calls (Neil Brown) - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand) - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand) - mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand) - mm/balloon_compaction: make balloon page compaction callbacks static (Miaohe Lin) - ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold) - ASoC: stm32: sai: Use the devm_clk_get_optional() helper (Christophe Jaillet) - ASoC: stm: Use dev_err_probe() helper (Kuninori Morimoto) - r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe) - iommu/qcom: fix device leak on of_xlate() (Johan Hovold) - powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom) - PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan) - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand) - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin) - media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski) - NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847872] {CVE-2025-68803} - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne) - media: vpif_capture: fix section mismatch (Johan Hovold) - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li) - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852341] {CVE-2025-71120} - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson) - crypto: af_alg - zero initializememory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852312] {CVE-2025-71113} - svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847976] {CVE-2025-71068} - ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre) - usb: ohci-nxp: fix device leak on probe failure (Johan Hovold) - usb: ohci-nxp: Use helper function devm_clk_get_enabled() (Zhang Zekun) - mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts) - usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami) - f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu) - f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu) - f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu) - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu) - xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li) - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang) - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever) - ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo) - ALSA: wavefront: Use standard print API (Takashi Iwai) - ALSA: wavefront: Clear substream pointers on close (Junrui Luo) - wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann) - btrfs: don't rewrite ret from inode_permission (Josef Bacik) - tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848017] {CVE-2025-71077} - jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin) - xhci: dbgtty: fix device unregister (Łukasz Bartosik) - xhci: dbgtty: use IDR to support several dbc instances. (Mathias Nyman) - usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773636] {CVE-2025-68282} - usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michał Pecio) [Orabug: 37844150] {CVE-2025-22022} - usb: xhci: move link chain bit quirk checks into one helper function. (NiklasNeronin) - drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin) [Orabug: 38643537] {CVE-2025-40110} - virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner) - kbuild: Use CRC32 and a 1MiB dictionary for XZ compressed modules (Martin Nybo Andersen) - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park) - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park) - mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park) - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park) - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park) - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park) - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park) - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park) - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094814] {CVE-2025-38022} - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park) - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park) - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul) - drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848052] {CVE-2025-71083} - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen) - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey) - net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore) - nfsd: Drop the client reference in client_states_open() (Haoxiang Li) - fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li) - e1000: fix OOB ine1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848099] {CVE-2025-71093} - RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848058] {CVE-2025-71084} - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848117] {CVE-2025-71096} - idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox) - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou) - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou) - media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou) - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov) - media: cec: Fix debugfs leak on bus_register() failure (Xu Wang) - fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe) - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum) - fbdev: gbefb: fix to use physical address instead of dma address (René Rebe) - dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki) - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov) - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle) - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle) - media: rc: st_rc: Fix reset control resource leak (Xu Wang) - mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski) - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold) - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz) - leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz) - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner) - HID: logitech-dj: Remove duplicate error logging (Hans de Goede) - iommu/tegra: fix device leak on probe_device() (Johan Hovold) - iommu/sun50i: fix device leak on of_xlate() (JohanHovold) - iommu/omap: fix device leaks on probe_device() (Johan Hovold) - iommu/mediatek: fix device leak on of_xlate() (Johan Hovold) - iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold) - iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold) - iommu/exynos: fix device leak on of_xlate() (Johan Hovold) - iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold) - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla) - ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla) - ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla) - ASoC: stm32: sai: fix device leak on probe (Johan Hovold) - selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou) - RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier) - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang) - RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap) - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari) - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari) - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu) - RDMA/efa: Remove possible negative shift (Michael Margolin) - RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852379] {CVE-2025-71133} - net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse) - ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848125] {CVE-2025-71097} - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848061] {CVE-2025-71085} - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur) - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya) - net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848107] {CVE-2025-71094} - net: dsa: b53: skip multicast entries forfdb_dump() (Jonas Gorski) - firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier) - genalloc.h: fix htmldocs warning (Andrew Morton) - smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852376] {CVE-2025-71132} - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887620] {CVE-2025-71154} - team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848088] {CVE-2025-71091} - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo) - platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier) - ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848131] {CVE-2025-71098} - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen) - net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou) - net: mdio: aspeed: move reg accessing part into separate functions (Potin Lai) - Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848044] {CVE-2025-71082} - crypto: seqiv - Do not use req-> iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852370] {CVE-2025-71131} - iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848073] {CVE-2025-71087} - i40e: Refactor argument of i40e_detect_recover_hung() (Ivan Vecera) - i40e: Refactor argument of several client notification functions (Ivan Vecera) - i40e: fix scheduling in set_rx_mode (Przemyslaw Korba) - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852300] {CVE-2025-71111} - hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han) - i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke) - rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla) - soc: amlogic: canvas: fix device leak on lookup (Johan Hovold) - soc: qcom: ocmem: fix device leak on lookup (JohanHovold) - amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold) - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher) - io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) - svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers) - nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko) - fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847800] {CVE-2025-68788} - tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852355] {CVE-2025-71125} - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson) - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson) - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed) - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852273] {CVE-2025-71104} - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang) - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson) - libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852325] {CVE-2025-71116} - parisc: Do not reprogram affinitiy on ASP chip (Helge Deller) - scs: fix a wrong parameter in __scs_magic (Zhichi Lin) - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih) - ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847688] {CVE-2025-68771} - media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park) - tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield) - f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu) - f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey) - scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin)[Orabug: 38847770] {CVE-2025-68782} - NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo) - scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848009] {CVE-2025-71075} - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847931] {CVE-2025-68818} - cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin) - intel_th: Fix error handling in intel_th_output_open (Ma Ke) - char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen) - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li) - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin) - usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold) - USB: lpc32xx_udc: Fix error handling in probe (Ma Ke) - phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold) - media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King) - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847937] {CVE-2025-68819} - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng) - media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart) - jbd2: use a weaker annotation in journal handling (Byungchul Park) - ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun) - ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848276] {CVE-2025-68820} - ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt) - floppy: fix for PAGE_SIZE != 4KB (René Rebe) - block: rate-limit capacity change info log (Li Chen) - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers) - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg) - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887597] {CVE-2025-71147} - vhost/vsock: improve RCU read sections aroundvhost_vsock_get() (Stefano Garzarella) - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao) - nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner) - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin) - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng) - usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie) - usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852285] {CVE-2025-71108} - usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu) - exfat: fix remount failure in different process environments (Yuezhang Mo) - via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852318] {CVE-2025-71114} - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby) - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby) - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby) - powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins) - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 (Josua Mayer) - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer) - firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan) - ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo) - ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo) - ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847775] {CVE-2025-68783} - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang) - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang) - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847724] {CVE-2025-68776} - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas) - spi: fsl-cpm: Check length parity before switching to 16 bit mode(Christophe Leroy) - ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang) - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg) - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao) - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng) - net: hns3: add VLAN id validation before using (Jian Shen) - net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen) - net: hns3: Align type of some variables with their print type (Hao Chen) - net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen) - net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory) - net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847914] {CVE-2025-68816} - ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847826] {CVE-2025-68795} - net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers (Daniil Tatianin) - net/ethtool/ioctl: remove if n_stats checks from ethtool_get_phy_stats (Daniil Tatianin) - ethtool: use phydev variable (Tom Rix) - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter) - net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847910] {CVE-2025-68815} - caif: fix integer underflow in cffrml_receive() (Junrui Luo) - ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847900] {CVE-2025-68813} - netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38974757] {CVE-2025-71146} - broadcom: b44: prevent uninitialized value usage (Alexey Simakov) - net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847784] {CVE-2025-68785} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel) - mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel) -ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov) - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847965] {CVE-2025-71066} - netrom: Fix memory leak in nr_sendmsg() (Wang Liang) - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li) - btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo) - hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko) - hfsplus: Verify inode mode when loading from disk (Tetsuo Handa) - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi) - hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko) - fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov) - livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu) - cpufreq: s5pv210: fix refcount leak (Shuhao Fu) - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus) - ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852333] {CVE-2025-71118} - x86/ptrace: Always inline trivial accessors (Peter Zijlstra) - sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847753] {CVE-2025-68780} - btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey) - bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek) - spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A) - coresight: etm4x: Correct polling IDLE bit (Leo Yan) - netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around (Nicklas Bo Jensen) - NFS: Fix missing unlock in nfs_unlink() (Sun Ke) - ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang) - ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo) [Orabug: 38798767] {CVE-2025-68346} - usb: phy: Initialize struct usb_phy list_head (Diogo Ivo) - usb: gadget: tegra-xudc: Always reinitialize datatoggle when clear halt (Haotien Hsu) - ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov) - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab) - efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab) - efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab) - dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang) - dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov) - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan) - ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa) - dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp) - blk-mq: Abort suspend when wakeup events are pending (Cong Zhang) - ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang) - ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang) - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang) - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov) - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf) - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818237] {CVE-2025-68764} - fs_context: drop the unused lsm_flags member (Ondrej Mosnacek) - Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust) - Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust) - Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust) - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798775] {CVE-2025-68349} - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust) - NFS: Fix the verifier for case sensitive filesystem in nfs_atomic_open() (Trond Myklebust) - NFSv4: Add some support for case insensitive filesystems (Trond Myklebust) - fs/nls: Fix utf16 to utf8 conversion (ArminWolf) - NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust) - NFS: don't unhash dentry during unlink/rename (Neil Brown) - NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink() (Trond Myklebust) - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal) - pinctrl: single: Fix incorrect type for error return variable (Xu Wang) - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (Matthijs Kooijman) - perf tools: Fix split kallsyms DSO counting (Namhyung Kim) - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc) - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko) - net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev) - netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera) - netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera) - netfilter: nf_conncount: reduce unnecessary GC (William Tu) - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso) - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798787] {CVE-2025-68354} - ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski) - virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin) - virtio_vdpa: fix misleading return in void function (Alok Tiwari) - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun) - ext4: remove unused return value of __mb_check_buddy (Kemeng Shi) - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe) - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter) - ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang) - ASoC: fsl_xcvr: Add support for i.MX93 platform (Chancel Liu) - ASoC: fsl_xcvr: Add Counter registers (Shengjiu Wang) - RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo) -RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo) - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold) - backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap) - backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli) - backlight: led_bl: Take led_access lock when required (Mans Rullgard) - wifi: ieee80211: correct FILS status codes (Ria Thomas) - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin) - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie) - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan) - crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang) - selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski) - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski) - usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang) - usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang) - usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang) - usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum) - ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798922] {CVE-2025-68740} - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798815] {CVE-2025-68362} - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang) - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang) - pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König) - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu) - fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis) - fs/ntfs3: out1 also needs to put mi (Edward Adam Davis) - fs/ntfs3: Make ni_ins_new_attr return error (Konstantin Komarov) - fs/ntfs3: Add new argument is_mft to ntfs_mark_rec_free (Konstantin Komarov) - fs/ntfs3: Removeunused mi_mark_free (Konstantin Komarov) - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani) - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818222] {CVE-2025-68759} - NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov) - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang) - watchdog: wdat_wdt: Stop watchdog when uninstalling module (Liu Xinpeng) - selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov) - ps3disk: use memcpy_{from,to}_bvec index (René Rebe) - PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli) - leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang) - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang) - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang) - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798824] {CVE-2025-68364} - lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko) - clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang) - coresight: etm4x: Add context synchronization before enabling trace (Leo Yan) - coresight: etm4x: Extract the trace unit controlling (Leo Yan) - coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang) - coresight: etm4x: Use Trace Filtering controls dynamically (Suzuki K Poulose) - coresight: etm4x: Save restore TRFCR_EL1 (Suzuki K Poulose) - nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798833] {CVE-2025-68366} - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal) - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798838] {CVE-2025-68367} - powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy) - RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke) - dt-bindings: PCI: amlogic: Fix the register name ofthe DBI region (Manivannan Sadhasivam) - dt-bindings: PCI: convert amlogic,meson-pcie.txt to dt-schema (Neil Armstrong) - scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang) - nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798851] {CVE-2025-68372} - nbd: partition nbd_read_stat() into nbd_read_reply() and nbd_handle_reply() (Yu Kuai) - nbd: clean up return value checking of sock_xmit() (Yu Kuai) - regulator: core: disable supply if enabling main regulator fails (Gabor Juhos) - perf/x86/intel: Correct large PEBS flag check (Dapeng Mi) - ext4: correct the checking of quota files before moving extents (Zhang Yi) - ext4: minor defrag code improvements (Eric Whitney) - mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang) - spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798944] {CVE-2025-68746} - spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A) - scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche) - power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska) - power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov) - i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu) - i3c: fix refcount inconsistency in i3c_master_register (Frank Li) - pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang) - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu) - x86: kmsan: don't instrument stack walking functions (Alexander Potapenko) - kmsan: introduce __no_sanitize_memory and __no_kmsan_checks (Alexander Potapenko) - compiler-gcc.h: Define __SANITIZE_ADDRESS__ under hwaddress sanitizer (Kees Cook) - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima) - phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur) - firmware: imx: scu-irq: fix OF node leak in (Peng Fan) - s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens) - s390/smp: Fixfallback CPU detection (Heiko Carstens) - crypto: hisilicon/qm - restore original qos values (Nieweiqiang) - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798875] {CVE-2025-68724} - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang) - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey) - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra) - iio: imu: st_lsm6dsx: discard samples during filters settling time (Lorenzo Bianconi) - iio: imu: st_lsm6dsx: introduce st_lsm6dsx_device_set_enable routine (Lorenzo Bianconi) - inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang) - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang) - ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela) - ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault) - irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold) - USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae) - drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818212] {CVE-2025-68757} - drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther) - gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798899] {CVE-2025-68732} - smack: fix bug: unprivileged task can create labels (Konstantin Andreev) - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K) [Orabug: 38773544] {CVE-2025-68254} - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K) [Orabug: 38773554] {CVE-2025-68255} - comedi: check device's attached status in compat ioctls (Nikita Zhandarovich) - comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich) - comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott) - HID: elecom: Add support for ELECOM M-XT3URBK (018F) (NaokiUeki) - platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia) - platform/x86: acer-wmi: Ignore backlight event (Armin Wolf) - pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari) - bfs: Reconstruct file type when loading from disk (Tetsuo Handa) - spi: imx: keep dma request disabled before dma transfer setup (Robin Gong) - spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado) - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold) - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold) - serial: add support of CPCI cards (Magne Bruno) - USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold) - USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda) - USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda) - USB: serial: option: add Foxconn T99W760 (Slark Xiao) - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich) - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773587] {CVE-2025-68261} - locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin) - ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773603] {CVE-2025-68264} - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792633] {CVE-2025-68337} - Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya) - leds: spi-byte: Use devm_led_classdev_register_ext() (Stefan Kalscheuer) - leds: Replace all non-returning strlcpy with strscpy (Azeem Shaikh) - drm/i915/selftests: Fix inconsistent IS_ERR and PTR_ERR (Kai Song) - dpaa2-mac: bail if the dpmacs fwnode is not found (Robert-Ionut Alexa) - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca) - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) [Orabug: 39004269]{CVE-2025-40256} - Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca) [5.15.0-317.197.5] - KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38801641] - Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38801641] - uek-rpm: pensando: Move crashkernel to cnic-image-builder (Henry Willard) [Orabug: 38851137] - ext4: drop dio overwrite only flag and associated warning (Brian Foster) [Orabug: 38381010] - ext4: fix racy may inline data check in dio write (Brian Foster) [Orabug: 38381010] - ext4: allow concurrent unaligned dio overwrites (Brian Foster) [Orabug: 38381010] - ext4: dio take shared inode lock when overwriting preallocated blocks (Zhang Yi) [Orabug: 38381010] - net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38172423] - uek-rpm: hnic: add unique hnic signing certs (Tom Saeger) [Orabug: 38894488] - drivers/soc/pensando/sbus: Secure mode support. (Hiren Mehta) [Orabug: 38894106] - drivers/soc/pensando/pen_secure: Report register address on access errors (Maciej S. Szmigiero) [Orabug: 38894106] - drivers/edac/elba_edac: Secure mode support (Hiren Mehta) [Orabug: 38894106] - drivers/soc/pensando/bsm: Add secure-mode support. (Hiren Mehta) [Orabug: 38894106] - drivers/soc/pensando/rstcause: Add secure mode support. (Hiren Mehta) [Orabug: 38894106] - drivers/soc/pensando/penfw: New SMC support for secure-mode. (Hiren Mehta) [Orabug: 38894106] - drivers/soc/pensando/sbus: Secure mode support (Hiren Mehta) [Orabug: 38894106] - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334981,38932988] {CVE-2025-38571} - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334968,38932991] {CVE-2025-38566} - xfrm: delete x-> tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730492,38933003] {CVE-2025-40215} [5.15.0-317.197.4] - gpio: mlxbf3: use platform_get_irq_optional() (David Thompson) [Orabug: 38755419] -platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari) [Orabug: 38755419] - pinctrl: mlxbf3: Fix return value check for devm_platform_ioremap_resource (Chen Ni) [Orabug: 38755419] - net/mlx5e: Query FW for buffer ownership (Alexei Lazar) [Orabug: 38755419] - net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi) [Orabug: 38755419] - net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38755419] - net/mlx5e: Support FEC settings for 100G/lane modes (Cosmin Ratiu) [Orabug: 38755419] - net/mlx5e: Extract checking of FEC support for a link mode (Cosmin Ratiu) [Orabug: 38755419] - tcp: Set pingpong threshold via sysctl (Haiyang Zhang) [Orabug: 38853979] - arm64: hnic: config: Add NBD driver (Patrick Colp) [Orabug: 38858773] - arm64: pensando: Fix spec file for HNIC (Rob Gardner) [Orabug: 38858773] - Enable additional drivers needed to support MIPS64 SmartNic (Vijay Kumar) [Orabug: 38846771] - MIPS: Fix build error for mips ARCH_ATOMIC (Vijay Kumar) [Orabug: 38846771] - Added atomic addition,subtraction functions. (Anagha K J) [Orabug: 38846771] - Allocate the required IV size referenced by the cypher handle in init_state (Anagha K J) [Orabug: 38846771] - Setting up numa system and memory initializations (Anagha K J) [Orabug: 38846771] - Implemented clocksource provider driven by node-0 FPA_CLK_COUNT (Anagha K J) [Orabug: 38846771] - Processor cache information made available to userspace (Anagha K J) [Orabug: 38846771] - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer) [Orabug: 38851582] - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon) - ext4: clear i_state_flags when alloc inode (Haibo Chen) - ext4: align max orphan file size with e2fsprogs limit (Baokun Li) - PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki) - net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang) - net/sched: sch_cake: Fix incorrect qlen reductionin cake_drop (Xiang Mei) [Orabug: 38783137] {CVE-2025-68325} - block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong) - fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847946] {CVE-2025-68821} - i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero) - fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov) - ntfs3: init run lock for extend inode (Edward Adam Davis) [5.15.0-317.197.3] - kpcimgr: Enable loading firmware via kernel infrastructure (Joseph Dobosenski) [Orabug: 38546110] - Move hnic crashkernel to cnic-image-builder (Henry Willard) [Orabug: 38546110] - Bump supported capmem range count from 64 to 256 (Jan Setje-Eilers) [Orabug: 38546110] - irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38546110] - pensando: Allow sparse allowed ranges in cap_mem (Maciej S. Szmigiero) [Orabug: 38546110] - soc/pensando/cap-pcie: Handle zero-ed out MS_CFG_WDT_IDX/WDT_IDX (Joao Martins) [Orabug: 38546110] - pensando: Enable penfw driver for smartnic (Jan Setje-Eilers) [Orabug: 38546110] - irqchip/gic-v3-its: remove WARN_ON gic_reserve_range (Tom Saeger) [Orabug: 38546110] - hnic: Disable CONFIG_OVERLAY_FS_INDEX (Patrick Colp) [Orabug: 38546110] - pensando: missing diffs from AMD (Jan Setje-Eilers) [Orabug: 38546110] - hnic: config: Build FUSE into the kernel (not as a module) (Patrick Colp) [Orabug: 38546110] - hnic: config: Add DM_VERITY support (Patrick Colp) [Orabug: 38546110] - hnic config: Add LOCKDOWN_LSM support (Patrick Colp) [Orabug: 38546110] - Subject: uek-rpm: Build hostnic kernel for Pensando (Dave Kleikamp) [Orabug: 38546110] - pensando: kpcimgr: support pcie port bifurcation (Darshan Prajapati) [Orabug: 38546110] - Add changes for penfw and sbus.c for secureboot (Rahshekh) [Orabug: 38546110] - arm64: GIC ITS MSI encapsulator address configured from device tree (Brad Larson) [Orabug: 38546110] - perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug:38546110] - reset: salinasr: Add AMD Pensando Salina SoC reset (Brad Larson) [Orabug: 38546110] - spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38546110] - EDAC/elba: Support AMD Pensando Giglio SoC (Brad Larson) [Orabug: 38546110] - arm64: defconfig: Add AMD Pensando Salina SoC defconfig (Brad Larson) [Orabug: 38546110] - soc/pensando: Support AMD Pensando Salina SoC (Brad Larson) [Orabug: 38546110] - arm64: dts: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38546110] - mmc: sdhci-cadence: Support AMD Salina SoC (Brad Larson) [Orabug: 38546110] - PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597010] {CVE-2025-40034} - mm/hugetlb: disable huge_pmd_unshare TLB sync by default on Exadata (Joe Jin) [Orabug: 38829889] - vhost: Account for worker thread under owner's nproc (Mike Christie) [Orabug: 38770748] - vhost: revert CAP_SYS restrictions on worker ioctls (Mike Christie) [Orabug: 38770748] - RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753654] - mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38420735,38773370] {CVE-2025-68209} - uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38744825] [5.15.0-317.197.2] - x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756952] - net/sched: adjust device watchdog timer to detect stopped queue at right time (Praveen Kumar Kannoju) [Orabug: 38341919] - KVM: arm64: Add minimal handling for the ARMv8.7 PMU (Marc Zyngier) [Orabug: 38784458] - scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175026] {CVE-2025-38239} - Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38790823] - mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38619860] - mm: list_lru: fix UAF for memory cgroup (Muchun Song) [Orabug: 38619860] - net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728740] - net/rds: expand kref coverageto rds_notifier-> n_conn (Sharath Srinivasan) [Orabug: 38728740] - net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728740] - net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728743] - net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38512377] - devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38512377] - devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38512377] - devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38512377] - devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38512377] - devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38512377] - net/mlx5: remove fw reporter dump option for non PF (Moshe Shemesh) [Orabug: 38512377] - net/mlx5: remove fw_fatal reporter dump option for non PF (Moshe Shemesh) [Orabug: 38512377] - devlink: Hold devlink lock on health reporter dump get (Moshe Shemesh) [Orabug: 38512377] - Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38512377] - NVIDIA: SAUCE: iommu/arm-smmu-v3: Allow default substream bypass with a pasid support (Nicolin Chen) [Orabug: 38463999] - RDMA/mlx5: Fix a WARN during dereg_mr for DM type (Yishai Hadas) [Orabug: 37766291,38463999] {CVE-2025-21888} - uek-rpm: replace CONFIG_IOMMU_SVA_LIB with CONFIG_IOMMU_SVA (Junxiao Bi) [Orabug: 38463999] - iommu/sva: Rename CONFIG_IOMMU_SVA_LIB to CONFIG_IOMMU_SVA (Fenghua Yu) [Orabug: 38463999] [5.15.0-317.197.1] - LTS version: v5.15.197 (Vijayendra Suman) - libbpf: Fix invalid return address register in s390 (Daniel T. Lee) - libbpf, riscv: Use a0 for RC register (Yixun Lan) - libbpf: Fix riscv register names (Ilya Leoshkevich) - selftests/bpf: Don't rely on preserving volatile in PT_REGS macros in loop3 (Andrii Nakryiko) - scsi: pm80xx: Set phy->enable_completion only when we (Igor Pylypiv) [Orabug: 37159744] {CVE-2024-47666} - Bluetooth: Add more enc key size check (Alex Lu) - usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea) [Orabug: 38792571] {CVE-2025-68327} - usb: renesas_usbhs: Convert to platform remove callback returning void (Uwe Kleine-König) - smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773704] {CVE-2025-68295} - mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773435] {CVE-2025-68227} - mptcp: avoid unneeded subflow-level drops (Paolo Abeni) - selftests: mptcp: join: rm: set backup flag (Matthieu Baerts) - staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann) - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773649] {CVE-2025-68284} - libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773655] {CVE-2025-68285} - drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773664] {CVE-2025-68286} - drm: sti: fix device leaks at component probe (Johan Hovold) - USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang) - USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov) - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman) - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar) [Orabug: 38773671] {CVE-2025-68287} - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792593] {CVE-2025-68331} - usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762730] {CVE-2025-40345} - usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773677] {CVE-2018-1000204,CVE-2025-68288} - usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai) [Orabug: 38773687] {CVE-2025-68289} - usb: cdns3: Fix double resource releasein cdns3_pci_probe (Miaoqian Lin) - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin) - firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli) - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin) - thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski) - drivers/usb/dwc3: fix PCI parent check (Jamie Iles) - dm-verity: fix unreliable memory allocation (Mikulas Patocka) - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde) - can: sja1000: fix max irq loop handling (Thomas Mühlbacher) - atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han) - iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792587] {CVE-2025-68330} - iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet) - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra) - Revert "perf/x86: Always store regs-> ip in perf_callchain_kernel()" (Jiri Olsa) [Orabug: 38893604] - spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou) - mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang) - net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773729] {CVE-2025-68301} - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean) - net: dsa: sja1105: simplify static configuration reload (Russell King) - net: dsa: sja1105: Convert to mdiobus_c45_read (Andrew Lunn) - net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev) - net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino) - net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng) - platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter) - Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz) - can: kvaser_usb: leaf: Fix potential infinite loop in commandparsers (Seungjin Bae) [Orabug: 38773760] {CVE-2025-68308} - Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797] - Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797] - mptcp: do not fallback when OoO is present (Paolo Abeni) - mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730656] {CVE-2025-40257} - mptcp: fix premature close in case of fallback (Paolo Abeni) - mptcp: fix ack generation for fallback msk (Paolo Abeni) - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski) - Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae) - Input: remove third argument of usb_maxpacket() (Vincent Mailhol) - usb: deprecate the third argument of usb_maxpacket() (Vincent Mailhol) - mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen) - selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts) - pmdomain: samsung: plug potential memleak during probe (André Draszik) - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla) - pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin) - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao) [Orabug: 38773509] {CVE-2025-68245} - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin) - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor) - btrfs: fix crash on racing fsync and size-extending write into prealloc (Omar Sandoval) [Orabug: 36774582] {CVE-2024-37354} - btrfs: add helper to truncate inode items when logging inode (Filipe Manana) - Makefile.compiler: replace cc-ifversion with compiler-specific macros (Nick Desaulniers) - tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun) - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon) - ALSA: usb-audio: fixuac2 clock source at terminal parser (René Rebe) - mm/secretmem: fix use-after-free race in fault handler (Lance Yang) [Orabug: 38737039] {CVE-2025-40272} - mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres) - kconfig/nconf: Initialize the default locale at startup (Jakub Horký) - kconfig/mconf: Initialize the default locale at startup (Jakub Horký) - net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit) - selftests: net: use BASH for bareudp testing (Po-Hsu Lin) - scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773426] - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730611,38786193,38788594] {CVE-2025-40248} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730629] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Alejandro Colomar) - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang) - s390/ctcm: Fix double-kfree (Aleksei Nikiforov) - net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730648] {CVE-2025-40254} - net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin) - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan) - drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke) - mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730659,38932997] {CVE-2025-40258} - MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki) - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773440] {CVE-2025-68229} - scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730663] {CVE-2025-40259} - nvme: nvme-fc: Ensure -> ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730673] {CVE-2025-40261} - Input: imx_sc_key - fix memory corruption onunload (Dan Carpenter) - Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730680] {CVE-2025-40263} - be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730689] {CVE-2025-40264} - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang) - mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara) - net/sched: act_connmark: handle errno on tcf_idr_check_alloc (Pedro Tammela) - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [Orabug: 38798907] {CVE-2025-68734} - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara) - EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara) - spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede) - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai) - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai) [Orabug: 38737023] {CVE-2025-40269} - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38737033,38786194,38788587] {CVE-2025-40271} - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [Orabug: 38773495] {CVE-2025-68241} - strparser: Fix signed/unsigned mismatch bug (Nate Karstens) - gcov: add support for GCC 15 (Peter Oberparleiter) - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia) [Orabug: 38737042] {CVE-2025-40273} - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa) - mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter) - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers) - mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592026] {CVE-2025-40040} - bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet) [Orabug: 38773327] {CVE-2025-68200} - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [Orabug: 38737051] {CVE-2025-40275} - NFSv4: Fix an incorrectparameter when calling nfs4_call_sync() (Trond Myklebust) - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [Orabug: 38737060] {CVE-2025-40277} - ASoC: cs4271: Fix regulator leak on probe failure (Xu Wang) - regulator: fixed: fix GPIO descriptor leak on register failure (Xu Wang) - acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue) - Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen) - hsr: Fix supervision frame sending on HSRv0 (Felix Maurer) - net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet) - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman) - net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman) - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N) - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N) [Orabug: 38737072] {CVE-2025-40279} - net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet) - net/sched: act_connmark: transition to percpu stats and rcu (Pedro Tammela) - net: sched: act_connmark: get rid of tcf_connmark_walker and tcf_connmark_search (Zhengchao Shao) - net: sched: act: move global static variable net_id to tc_action_ops (Zhengchao Shao) - wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg) - net: mdio: fix resource leak in mdiobus_register_device() (Csaba Buday) - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38737082,38786195,38788585] {CVE-2025-40280} - net/smc: fix mismatch between CLC header and proposal (D. Wythe) - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet) [Orabug: 38737090] {CVE-2025-40281} - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen) - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen) - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen) -Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [Orabug: 38737103] {CVE-2025-40283} - net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang) - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad) - NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew) - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb) - NFS4: Fix state renewals missing after boot (Joshua Watt) - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov) - compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra) - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik) [Orabug: 38773506] {CVE-2025-68244} - selftests: netdevsim: set test timeout to 10 minutes (Jakub Kicinski) - extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski) - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor) - rtc: rx8025: fix incorrect register reference (Yuta Hayama) - tracing: Fix memory leaks in create_field_var() (Zilin Guan) - bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh Ap) - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [Orabug: 38773282] {CVE-2025-68192} - sctp: Hold sock lock while iterating over address list (Stefan Wiehler) - sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [Orabug: 38747446] {CVE-2025-40331} - sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler) - net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski) - net: dsa: b53: fix enabling ip multicast (Jonas Gorski) - net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski) - net: vlan: sync VLAN features with lower device (Hangbin Liu) - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang) - netdevsim: add Makefile forselftests (David Wei) - selftests/net: use destination options instead of hop-by-hop (Anubhav Singh) - selftests/net: fix GRO coalesce test and add ext header coalesce tests (Richard Gobert) - selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh) - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski) - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer) - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang) - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang) - ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko) - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti) - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [Orabug: 38737181] {CVE-2025-40304} - ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus) - 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry) - cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling) - 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry) - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer) - clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner) - ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre) - rtc: pcf2127: clear minute/second interrupt (Josua Mayer) - um: Fix help message for ssl-non-raw (Tiwei Bie) - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue) - btrfs: mark dirty extent range for out of bound prealloc extents (Austinchang) - RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang) - RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni) - RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni) - RDMA/irdma: Fix SD index calculation (Jacob Moroni) - ACPICA: Update dsmethod.c to get rid of unused variable warning (SaketDumbre) - orangefs: fix xattr related buffer overflow... (Mike Marshall) - page_pool: Clamp pool size to max 16K pages (Dragos Tatulea) - exfat: limit log print for IO error (Chi Zhiling) - ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen) - Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [Orabug: 38737212] {CVE-2025-40308} - Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [Orabug: 38737223] {CVE-2025-40309} - net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun) - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (Chuguangqing) - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari) - nfs4_setup_readdir(): insufficient locking for -> d_parent-> d_inode dereferencing (Al Viro) [Orabug: 38773244] {CVE-2025-68185} - NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos) - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia) - remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold) - sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma) - PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang) - r8169: set EEE speed down ratio to 1 (Chunhao Lin) - net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das) - wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain) - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab) - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko) - jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane) - jfs: Verify inode mode when loading from disk (Tetsuo Handa) - ipv6: np-> rxpmtu race annotation (Eric Dumazet) - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati) - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman) - allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro) - scsi: lpfc: Define size of debugfs entry for xrirebalancing (Justin Tee) - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee) - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee) - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng) - page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski) [Orabug: 38773835] {CVE-2025-68321} - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin) - net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao) - udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari) [Orabug: 38773275] {CVE-2025-68191} - selftests: Replace sleep with slowwait (David Ahern) - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer) - selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern) - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li Rongqing) - netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal) - selftests: traceroute: Use require_command() (Ido Schimmel) - media: redrat3: use int type to store negative error codes (Rong Qianfeng) - net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund) - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch) - phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy) - ntfs3: pretend $Extend records as regular files (Tetsuo Handa) - net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas) - drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco) - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng) - usb: gadget: f_hid: Fix zero length packet transfer (William Wu) - iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra) - net: call cond_resched() less often in __release_sock() (Eric Dumazet) - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000ms (Juraj Šarinay) - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing) - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski) - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski) - dmaengine: dw-edma: Set status for callback_result (Devendra K Verma) - dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev) - dmaengine: sh: setup_xref error handling (Thomas Andreatta) - ptp: Limit time setting of PTP clocks (Miroslav Lichvar) - scsi: pm8001: Use int instead of u32 to store error codes (Rong Qianfeng) - mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski) - mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski) - mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski) - media: fix uninitialized symbol warnings (Chelsy Ratnawat) - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin) - extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski) - scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez) - scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil) - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai) - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim) - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima) - net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch) - char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu) - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (Raub Camaioni) - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi) - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov) - media: imon: make send_packet() more robust (Tetsuo Handa) [Orabug: 38773297] {CVE-2025-68194} - net: ipv6: fix field-spanningmemcpy warning in AH output (Charalampos Mitrodimas) [Orabug: 38773140] {CVE-2025-40363} - bridge: Redirect to backup port when port is administratively down (Ido Schimmel) - powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle) - thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner) - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang) - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov) - drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary) - drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen) - media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart) - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey Mcrae) - selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu) - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu) - PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives) - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab) - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S) - drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar) - drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar) - mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne) - mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann) - mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein) - mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein) - tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown) - tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown) - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar) - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar) - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (Armin Wolf) - uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa) -clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano) - cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki) - tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar) - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel) - nvme-fc: use lock accessing port_state and rport state (Daniel Wagner) [Orabug: 38747531] {CVE-2025-40342} - nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner) [Orabug: 38747538] {CVE-2025-40343} - tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi) - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede) - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg) - power: supply: sbs-charger: Support multiple devices (Fabien Proriol) - hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen) - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede) - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang Song) - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel) - arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook) - cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier) - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière) - ACPI: video: force native for Lenovo 82K8 (Mario Limonciello) - memstick: Add timeout to prevent indefinite waiting (Jiayi Li) - mmc: host: renesas_sdhi: Fix the actual clock (Biju Das) - pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang) - bpf: Don't use %pK through printk (Thomas Weißschuh) - soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh) - spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh) - soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel) - soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen) - block: makeREQ_OP_ZONE_OPEN a write operation (Damien Le Moal) - drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann) [Orabug: 38773123] {CVE-2025-40360} - drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner) - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu) - Revert "docs/process/howto: Replace C89 with C11" (Matthieu Baerts) - arch: back to -std=gnu89 in < v5.18 (Matthieu Baerts) - x86/boot: Compile boot code with -std=gnu11 too (Alexey Dobriyan) - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman) - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman) - xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman) - xhci: dbc: Allow users to modify DbC poll interval via sysfs (Uday M Bhat) - xhci: dbc: poll at different rate depending on data transfer activity (Mathias Nyman) - xhci: dbc: Provide sysfs option to configure dbc descriptors (Mathias Nyman) - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger) - net: phy: dp83867: Disable EEE support as not implemented (Emanuele Ghidoli) - can: gs_usb: increase max interface to U8_MAX (Celeste Liu) - net: ravb: Enforce descriptor type ordering (Lad Prabhakar) - ravb: Exclude gPTP feature support for RZ/G2L (Biju Das) - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang) - serial: 8250_dw: handle reset control deassert error (Artem Shimko) - serial: 8250_dw: Use devm_add_action_or_reset() (Andy Shevchenko) - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal) - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith) - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith) - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang) - net: hns3: return error code when function fails (Jijie Shao) - drm/etnaviv: fix flushsequence logic (Tomeu Vizoso) - usbnet: Prevents free active kevent (Lizhi Xu) [Orabug: 38773783] {CVE-2025-68312} - libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko) - libbpf: Normalize PT_REGS_xxx() macro definitions (Andrii Nakryiko) - riscv, libbpf: Add RISC-V (RV64) support to bpf_tracing.h (Björn Töpel) - bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek) - bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal) [Orabug: 38737284] {CVE-2025-40319} - ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen) - drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen) - wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain) - ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla) - mptcp: restore window probe (Paolo Abeni) - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin) - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs) - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [Orabug: 38737291] {CVE-2025-40321} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [Orabug: 38737300] {CVE-2025-40322} - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [Orabug: 38687004] {CVE-2025-40211} - fbdev: atyfb: Check if pll_ops-> init_pll failed (Daniel Palmer) - net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin) - NFSD: Fix crash in nfsd4_read_release() (Chuck Lever) [Orabug: 38737315] {CVE-2025-40324} - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana) - btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana) - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum) - x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan) - net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [Orabug: 38597084]{CVE-2025-40083} _______________________________________________ El-errata mailing list
Mar 12, 2026
•Important
Oracle
197
security advisorycriticaldebianDebian 11: Advisories for Erlang Resource Leak & Critical Path Issues
Multiple vulnerabilities were fixed in Erlang an concurrent, real-time, distributed functional language. CVE-2025-4748 . ------------------------------------------------------------------------- Debian LTS Advisory DLA-4376-1
Nov 24, 2025
•Critical
Debian LTS
100
security advisorysecurity updatebug fixopenSUSE 15.5: 2023-4732 critical: Kernel Resource Leak and Bug Fixes
* bsc#1207948 * bsc#1210447 * bsc#1212649 * bsc#1214286 * bsc#1214700 . # Security update for the Linux Kernel Announcement ID: SUSE-SU-2023:4732-1 Rating: important References: * bsc#1207948 * bsc#1210447 * bsc#1212649 * bsc#1214286 * bsc#1214700 * bsc#1214840 * bsc#1214976 * bsc#1215095 * bsc#1215123 * bsc#1215124 * bsc#1215292 * bsc#1215420 * bsc#1215458 * bsc#1215710 * bsc#1215802 * bsc#1215931 * bsc#1216058 * bsc#1216105 * bsc#1216259 * bsc#1216527 * bsc#1216584 * bsc#1216621 * bsc#1216687 * bsc#1216693 * bsc#1216759 * bsc#1216761 * bsc#1216788 * bsc#1216844 * bsc#1216861 * bsc#1216909 * bsc#1216959 * bsc#1216965 * bsc#1216976 * bsc#1217036 * bsc#1217068 * bsc#1217086 * bsc#1217095 * bsc#1217124 * bsc#1217140 * bsc#1217147 * bsc#1217195 * bsc#1217196 * bsc#1217200 * bsc#1217205 * bsc#1217332 * bsc#1217366 * bsc#1217511 * bsc#1217515 * bsc#1217598 * bsc#1217599 * bsc#1217609 * bsc#1217687 * bsc#1217731 * bsc#1217780 * jsc#PED-3184 * jsc#PED-5021 * jsc#PED-7237 Cross-References: * CVE-2023-2006 * CVE-2023-25775 * CVE-2023-3777 * CVE-2023-39197 * CVE-2023-39198 * CVE-2023-4244 * CVE-2023-45863 * CVE-2023-45871 * CVE-2023-46813 * CVE-2023-46862 * CVE-2023-5158 * CVE-2023-5633 * CVE-2023-5717 * CVE-2023-6039 * CVE-2023-6176 CVSS scores: * CVE-2023-2006 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-2006 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-25775 ( SUSE ): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2023-25775 ( NVD ): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2023-3777 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3777 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-39197 ( SUSE ): 4.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N * CVE-2023-39198 ( SUSE ): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H * CVE-2023-39198 ( NVD ): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4244 ( SUSE): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4244 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-45863 ( SUSE ): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2023-45863 ( NVD ): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2023-45871 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-45871 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-46813 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-46813 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-46862 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-46862 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-5158 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H * CVE-2023-5158 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H * CVE-2023-5633 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5633 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5717 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5717 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6039 ( SUSE ): 6.3 CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6039 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-6176 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6176 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro 6.0 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Real Time Module 15-SP5 An update that solves 15 vulnerabilities, contains three features and has 39 security fixes can now be installed. ## Description: The SUSE Linux Enterprise 15SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: * CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447). * CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959). * CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095) * CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976). * CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965). * CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420). * CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058). * CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259). * CVE-2023-46813: Fixed SEV-ES local priv escalation (bsc#1212649). * CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693). * CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710). * CVE-2023-5633: Fixed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface (bsc#1216527). * CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584). * CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068). * CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332). The following non-security bugs were fixed: * acpi: fpdt: properly handle invalid fpdt subtables (git-fixes). * acpi: resource: do irq override on tongfang gmxxgxx (git-fixes). * acpi: resource: skip irqoverride on asus expertbook b1402cva (git-fixes). * acpi: sysfs: fix create_pnp_modalias() and create_of_modalias() (git-fixes). * alsa: hda/realtek - add dell alc295 to pin fall back table (git-fixes). * alsa: hda/realtek - alc287 realtek i2s speaker platform support (git-fixes). * alsa: hda/realtek - enable internal speaker of asus k6500zc (git-fixes). * alsa: hda/realtek: add quirk for asus ux7602zm (git-fixes). * alsa: hda/realtek: add quirks for asus 2024 zenbooks (git-fixes). * alsa: hda/realtek: add quirks for hp laptops (git-fixes). * alsa: hda/realtek: add support dual speaker for dell (git-fixes). * alsa: hda/realtek: enable mute led on hp 255 g10 (git-fixes). * alsa: hda/realtek: enable mute led on hp 255 g8 (git-fixes). * alsa: hda: asus um5302la: added quirks for cs35l41/10431a83 on i2c bus (git- fixes). * alsa: hda: cs35l41: fix unbalanced pm_runtime_get() (git-fixes). * alsa: hda: cs35l41: undo runtime pm changes at driver exit time (git-fixes). * alsa: hda: disable power-save on kontron singlepc (bsc#1217140). * alsa: hda: fix possible null-ptr-deref when assigning a stream (git-fixes). * alsa: hda: intel-dsp-config: fix jsl chromebook quirk detection (git-fixes). * alsa: info: fix potential deadlock at disconnection (git-fixes). * alsa: usb-audio: add quirk flag to enable native dsd for mcintosh devices (git-fixes). * arm/xen: fix xen_vcpu_info allocation alignment (git-fixes). * arm64: add cortex-a520 cpu part definition (git-fixes) * arm64: allow kprobes on el0 handlers (git-fixes) * arm64: armv8_deprecated move emulation functions (git-fixes) * arm64: armv8_deprecated: fix unused-function error (git-fixes) * arm64: armv8_deprecated: fold ops into insn_emulation (git-fixes) * arm64: armv8_deprecated: move aarch32 helper earlier (git-fixes) * arm64: armv8_deprecated: rework deprected instruction handling (git-fixes) * arm64: consistently pass esr_elx to die() (git-fixes) * arm64: die(): pass 'err' as long (git-fixes) * arm64: factor insn read out ofcall_undef_hook() (git-fixes) * arm64: factor out el1 ssbs emulation hook (git-fixes) * arm64: report el1 undefs better (git-fixes) * arm64: rework bti exception handling (git-fixes) * arm64: rework el0 mrs emulation (git-fixes) * arm64: rework fpac exception handling (git-fixes) * arm64: split el0/el1 undef handlers (git-fixes) * arm: 9321/1: memset: cast the constant byte to unsigned char (git-fixes). * asoc: ams-delta.c: use component after check (git-fixes). * asoc: codecs: wsa-macro: fix uninitialized stack variables with name prefix (git-fixes). * asoc: cs35l41: undo runtime pm changes at driver exit time (git-fixes). * asoc: cs35l41: verify pm runtime resume errors in irq handler (git-fixes). * asoc: fsl: fix pm disable depth imbalance in fsl_easrc_probe (git-fixes). * asoc: fsl: mpc5200_dma.c: fix warning of function parameter or member not described (git-fixes). * asoc: hdmi-codec: register hpd callback on component probe (git-fixes). * asoc: intel: skylake: fix mem leak when parsing uuids fails (git-fixes). * asoc: rt5650: fix the wrong result of key button (git-fixes). * asoc: simple-card: fixup asoc_simple_probe() error handling (git-fixes). * asoc: sof: core: ensure sof_ops_free() is still called when probe never ran (git-fixes). * asoc: ti: omap-mcbsp: fix runtime pm underflow warnings (git-fixes). * ata: pata_isapnp: add missing error check for devm_ioport_map() (git-fixes). * atl1c: work around the dma rx overflow issue (git-fixes). * atm: iphase: do pci error checks on own line (git-fixes). * blk-mq: do not clear driver tags own mapping (bsc#1217366). * blk-mq: fix null pointer dereference in blk_mq_clear_rq_mapping() (bsc#1217366). * bluetooth: add device 0bda:887b to device tables (git-fixes). * bluetooth: add device 13d3:3571 to device tables (git-fixes). * bluetooth: btusb: add 0bda:b85b for fn-link rtl8852be (git-fixes). * bluetooth: btusb: add date-> evt_skb is null check (git-fixes). * bluetooth: btusb: add realtek rtl8852be support id 0x0cb8:0xc559 (git- fixes). * bluetooth: btusb: add rtw8852be device 13d3:3570 to device tables (git- fixes). * btrfs: always log symlinks in full mode (bsc#1214840). * can: dev: can_put_echo_skb(): do not crash kernel if can_priv::echo_skb is accessed out of bounds (git-fixes). * can: dev: can_restart(): do not crash kernel if carrier is ok (git-fixes). * can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on() (git-fixes). * can: isotp: add local echo tx processing for consecutive frames (git-fixes). * can: isotp: fix race between isotp_sendsmg() and isotp_release() (git- fixes). * can: isotp: fix tx state handling for echo tx processing (git-fixes). * can: isotp: handle wait_event_interruptible() return values (git-fixes). * can: isotp: isotp_bind(): return -einval on incorrect can id formatting (git-fixes). * can: isotp: isotp_sendmsg(): fix tx state detection and wait behavior (git- fixes). * can: isotp: remove re-binding of bound socket (git-fixes). * can: isotp: sanitize can id checks in isotp_bind() (git-fixes). * can: isotp: set max pdu size to 64 kbyte (git-fixes). * can: isotp: split tx timer into transmission and timeout (git-fixes). * can: sja1000: fix comment (git-fixes). * clk: imx: imx8mq: correct error handling path (git-fixes). * clk: imx: imx8qxp: fix elcdif_pll clock (git-fixes). * clk: imx: select mxc_clk for clk_imx8qxp (git-fixes). * clk: keystone: pll: fix a couple null vs is_err() checks (git-fixes). * clk: mediatek: clk-mt2701: add check for mtk_alloc_clk_data (git-fixes). * clk: mediatek: clk-mt6765: add check for mtk_alloc_clk_data (git-fixes). * clk: mediatek: clk-mt6779: add check for mtk_alloc_clk_data (git-fixes). * clk: mediatek: clk-mt6797: add check for mtk_alloc_clk_data (git-fixes). * clk: mediatek: clk-mt7629-eth: add check for mtk_alloc_clk_data (git-fixes). * clk: mediatek: clk-mt7629: add check for mtk_alloc_clk_data (git-fixes). * clk: npcm7xx: fix incorrect kfree (git-fixes). * clk: qcom: clk-rcg2: fix clock rateoverflow for high parent frequencies (git-fixes). * clk: qcom: config ipq_apss_6018 should depend on qcom_smem (git-fixes). * clk: qcom: gcc-sm8150: fix gcc_sdcc2_apps_clk_src (git-fixes). * clk: qcom: ipq6018: drop the clk_set_rate_parent flag from pll clocks (git- fixes). * clk: qcom: mmcc-msm8998: do not check halt bit on some branch clks (git- fixes). * clk: qcom: mmcc-msm8998: fix the smmu gdsc (git-fixes). * clk: sanitize possible_parent_show to handle return value of of_clk_get_parent_name (git-fixes). * clk: scmi: free scmi_clk allocated when the clocks with invalid info are skipped (git-fixes). * clk: ti: add ti_dt_clk_name() helper to use clock-output-names (git-fixes). * clk: ti: change ti_clk_register_omap_hw api (git-fixes). * clk: ti: fix double free in of_ti_divider_clk_setup() (git-fixes). * clk: ti: update component clocks to use ti_dt_clk_name() (git-fixes). * clk: ti: update pll and clockdomain clocks to use ti_dt_clk_name() (git- fixes). * clocksource/drivers/timer-atmel-tcb: fix initialization on sam9 hardware (git-fixes). * clocksource/drivers/timer-imx-gpt: fix potential memory leak (git-fixes). * crypto: caam/jr - fix chacha20 + poly1305 self test failure (git-fixes). * crypto: caam/qi2 - fix chacha20 + poly1305 self test failure (git-fixes). * crypto: hisilicon/hpre - fix a erroneous check after snprintf() (git-fixes). * disable loongson drivers loongson is a mips architecture, it does not make sense to build loongson drivers on other architectures. * dmaengine: pxa_dma: remove an erroneous bug_on() in pxad_free_desc() (git- fixes). * dmaengine: ste_dma40: fix pm disable depth imbalance in d40_probe (git- fixes). * dmaengine: stm32-mdma: correct desc prep when channel running (git-fixes). * dmaengine: ti: edma: handle irq_of_parse_and_map() errors (git-fixes). * docs: net: move the probe and open/close sections of driver.rst up (bsc#1215458). * docs: net: reformat driver.rst from a list to sections (bsc#1215458). * docs: net: use c syntax highlight indriver.rst (bsc#1215458). * documentation: networking: correct possessive "its" (bsc#1215458). * drivers: hv: vmbus: remove unused extern declaration vmbus_ontimer() (git- fixes). * drm/amd/display: avoid null dereference of timing generator (git-fixes). * drm/amd/display: change the dmcub mailbox memory location from fb to inbox (git-fixes). * drm/amd/display: refactor dm_get_plane_scale helper (git-fixes). * drm/amd/display: remove useless check in should_enable_fbc() (git-fixes). * drm/amd/display: use full update for clip size increase of large plane source (git-fixes). * drm/amd/pm: handle non-terminated overdrive commands (git-fixes). * drm/amd: disable aspm for vi w/ all intel systems (git-fixes). * drm/amd: fix ubsan array-index-out-of-bounds for polaris and tonga (git- fixes). * drm/amd: fix ubsan array-index-out-of-bounds for smu7 (git-fixes). * drm/amd: move helper for dynamic speed switch check out of smu13 (git- fixes). * drm/amd: update `update_pcie_parameters` functions to use uint8_t arguments (git-fixes). * drm/amdgpu/vkms: fix a possible null pointer dereference (git-fixes). * drm/amdgpu: add drv_vram_usage_va for virt data exchange (bsc#1215802). * drm/amdgpu: add vram reservation based on vram_usagebyfirmware_v2_2 (git- fixes). * drm/amdgpu: do not use atrm for external devices (git-fixes). * drm/amdgpu: fix a null pointer access when the smc_rreg pointer is null (git-fixes). * drm/amdgpu: fix error handling in amdgpu_bo_list_get() (git-fixes). * drm/amdgpu: fix potential null pointer derefernce (git-fixes). * drm/amdgpu: fix software pci_unplug on some chips (git-fixes). * drm/amdgpu: not to save bo in the case of ras err_event_athub (git-fixes). * drm/amdgpu: remove unnecessary domain argument (git-fixes). * drm/amdgpu: reserve fences for vm update (git-fixes). * drm/amdgpu: skip vram reserve on firmware_v2_2 for bare-metal (bsc#1215802). * drm/amdkfd: fix a race condition of vram buffer unref in svm code (git- fixes). * drm/amdkfd: fix shiftout-of-bounds issue (git-fixes). * drm/amdkfd: fix some race conditions in vram buffer alloc/free of svm code (git-fixes). * drm/bridge: fix kernel-doc typo in desc of output_bus_cfg in drm_bridge_state (git-fixes). * drm/bridge: lt8912b: add missing drm_bridge_attach call (git-fixes). * drm/bridge: lt8912b: fix bridge_detach (git-fixes). * drm/bridge: lt8912b: fix crash on bridge detach (git-fixes). * drm/bridge: lt8912b: manually disable hpd only if it was enabled (git- fixes). * drm/bridge: lt8912b: register and attach our dsi device at probe (git- fixes). * drm/bridge: lt8912b: switch to devm mipi-dsi helpers (git-fixes). * drm/bridge: lt9611uxc: fix the race in the error path (git-fixes). * drm/bridge: lt9611uxc: register and attach our dsi device at probe (git- fixes). * drm/bridge: lt9611uxc: switch to devm mipi-dsi helpers (git-fixes). * drm/bridge: tc358768: clean up clock period code (git-fixes). * drm/bridge: tc358768: disable non-continuous clock mode (git-fixes). * drm/bridge: tc358768: fix bit updates (git-fixes). * drm/bridge: tc358768: fix tc358768_ns_to_cnt() (git-fixes). * drm/bridge: tc358768: fix use of uninitialized variable (git-fixes). * drm/bridge: tc358768: print logical values, not raw register values (git- fixes). * drm/bridge: tc358768: remove unused variable (git-fixes). * drm/bridge: tc358768: rename dsibclk to hsbyteclk (git-fixes). * drm/bridge: tc358768: use dev for dbg prints, not priv-> dev (git-fixes). * drm/bridge: tc358768: use struct videomode (git-fixes). * drm/dp_mst: fix null deref in get_mst_branch_device_by_guid_helper() (git- fixes). * drm/gma500: fix call trace when psb_gem_mm_init() fails (git-fixes). * drm/gud: use size_add() in call to struct_size() (git-fixes). * drm/i915/pmu: check if pmu is closed before stopping event (git-fixes). * drm/i915: fix potential spectre vulnerability (git-fixes). * drm/i915: flush wc ggtt only on required platforms (git-fixes). * drm/komeda: drop all currently held locks if deadlock happens(git-fixes). * drm/mediatek: fix iommu fault by swapping fbs after updating plane state (git-fixes). * drm/mediatek: fix iommu fault during crtc enabling (git-fixes). * drm/mipi-dsi: create devm device attachment (git-fixes). * drm/mipi-dsi: create devm device registration (git-fixes). * drm/msm/dp: skip validity check for dp cts edid checksum (git-fixes). * drm/msm/dsi: free tx buffer in unbind (git-fixes). * drm/msm/dsi: use msm_gem_kernel_put to free tx buffer (git-fixes). * drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference (git- fixes). * drm/panel: fix a possible null pointer dereference (git-fixes). * drm/panel: simple: fix innolux g101ice-l01 bus flags (git-fixes). * drm/panel: simple: fix innolux g101ice-l01 timings (git-fixes). * drm/panel: st7703: pick different reset sequence (git-fixes). * drm/qxl: prevent memory leak (git-fixes). * drm/radeon: fix a possible null pointer dereference (git-fixes). * drm/radeon: possible buffer overflow (git-fixes). * drm/rockchip: cdn-dp: fix some error handling paths in cdn_dp_probe() (git- fixes). * drm/rockchip: fix type promotion bug in rockchip_gem_iommu_map() (git- fixes). * drm/rockchip: vop: fix call to crtc reset helper (git-fixes). * drm/rockchip: vop: fix color for rgb888/bgr888 format on vop full (git- fixes). * drm/rockchip: vop: fix reset of state in duplicate state crtc funcs (git- fixes). * drm/syncobj: fix drm_syncobj_wait_flags_wait_available (git-fixes). * drm/ttm: reorder sys manager cleanup step (git-fixes). * drm/vc4: fix typo (git-fixes). * drm/vmwgfx: remove the duplicate bo_free function (bsc#1216527) * drm/vmwgfx: rename vmw_buffer_object to vmw_bo (bsc#1216527) * drm: bridge: it66121: fix invalid connector dereference (git-fixes). * drm: mediatek: mtk_dsi: fix no_eot_packet settings/handling (git-fixes). * drm: vmwgfx_surface.c: copy user-array safely (git-fixes). * dt-bindings: usb: hcd: add missing phy name to example (git-fixes). * dt-bindings: usb: qcom,dwc3: fix example wakeupinterrupt types (git-fixes). * ensure ia32_emulation is always enabled for kernel-obs-build if ia32_emulation is disabled by default, ensure it is enabled back for obs kernel to allow building 32bit binaries (jsc#ped-3184) [ms: always pass the parameter, no need to grep through the config which may not be very reliable] * fbdev: atyfb: only use ioremap_uc() on i386 and ia64 (git-fixes). * fbdev: fsl-diu-fb: mark wr_reg_wa() static (git-fixes). * fbdev: imsttfb: fix a resource leak in probe (git-fixes). * fbdev: imsttfb: fix double free in probe() (git-fixes). * fbdev: imsttfb: fix error path of imsttfb_probe() (git-fixes). * fbdev: imsttfb: release framebuffer and dealloc cmap on error path (git- fixes). * fbdev: omapfb: drop unused remove function (git-fixes). * fbdev: uvesafb: call cn_del_callback() at the end of uvesafb_exit() (git- fixes). * firewire: core: fix possible memory leak in create_units() (git-fixes). * firmware/imx-dsp: fix use_after_free in imx_dsp_setup_channels() (git- fixes). * fix termination state for idr_for_each_entry_ul() (git-fixes). * fix x86/mm: print the encryption features in hyperv is disabled * gpio: mockup: fix kerneldoc (git-fixes). * gpio: mockup: remove unused field (git-fixes). * gpu: host1x: correct allocated size for contexts (git-fixes). * hid: add quirk for dell pro wireless keyboard and mouse km5221w (git-fixes). * hid: cp2112: fix duplicate workqueue initialization (git-fixes). * hid: hyperv: avoid struct memcpy overrun warning (git-fixes). * hid: hyperv: remove unused struct synthhid_msg (git-fixes). * hid: hyperv: replace one-element array with flexible-array member (git- fixes). * hid: lenovo: detect quirk-free fw on cptkbd and stop applying workaround (git-fixes). * hid: logitech-hidpp: do not restart io, instead defer hid_connect() only (git-fixes). * hid: logitech-hidpp: move get_wireless_feature_index() check to hidpp_connect_event() (git-fixes). * hid: logitech-hidpp: remove hidpp_quirk_no_hidinput quirk (git-fixes). * hid:logitech-hidpp: revert "do not restart communication if not necessary" (git-fixes). * hv: simplify sysctl registration (git-fixes). * hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (git-fixes). * hv_netvsc: fix race of netvsc and vf register_netdevice (git-fixes). * hv_netvsc: fix race of register_netdevice_notifier and vf register (git- fixes). * hv_netvsc: mark vf as slave before exposing it to user-mode (git-fixes). * hwmon: (coretemp) fix potentially truncated sysfs attribute name (git- fixes). * i2c: aspeed: fix i2c bus hang in slave read (git-fixes). * i2c: core: run atomic i2c xfer when!preemptible (git-fixes). * i2c: designware: disable tx_empty irq while waiting for block length byte (git-fixes). * i2c: dev: copy userspace array safely (git-fixes). * i2c: i801: fix potential race in i801_block_transaction_byte_by_byte (git- fixes). * i2c: iproc: handle invalid slave state (git-fixes). * i2c: muxes: i2c-demux-pinctrl: use of_get_i2c_adapter_by_node() (git-fixes). * i2c: muxes: i2c-mux-gpmux: use of_get_i2c_adapter_by_node() (git-fixes). * i2c: muxes: i2c-mux-pinctrl: use of_get_i2c_adapter_by_node() (git-fixes). * i2c: stm32f7: fix pec handling in case of smbus transfers (git-fixes). * i2c: sun6i-p2wi: prevent potential division by zero (git-fixes). * i3c: fix potential refcount leak in i3c_master_register_new_i3c_devs (git- fixes). * i3c: master: cdns: fix reading status register (git-fixes). * i3c: master: mipi-i3c-hci: fix a kernel panic for accessing dat_data (git- fixes). * i3c: master: svc: fix check wrong status register in irq handler (git- fixes). * i3c: master: svc: fix ibi may not return mandatory data byte (git-fixes). * i3c: master: svc: fix race condition in ibi work thread (git-fixes). * i3c: master: svc: fix sda keep low when polling ibiwon timeout happen (git- fixes). * i3c: master: svc: fix wrong data return when ibi happen during start frame (git-fixes). * i3c: mipi-i3c-hci: fix out of bounds access inhci_dma_irq_handler (git- fixes). * i915/perf: fix null deref bugs with drm_dbg() calls (git-fixes). * idpf: add controlq init and reset checks (bsc#1215458). * idpf: add core init and interrupt request (bsc#1215458). * idpf: add create vport and netdev configuration (bsc#1215458). * idpf: add ethtool callbacks (bsc#1215458). * idpf: add module register and probe functionality (bsc#1215458). * idpf: add ptypes and mac filter support (bsc#1215458). * idpf: add rx splitq napi poll support (bsc#1215458). * idpf: add singleq start_xmit and napi poll (bsc#1215458). * idpf: add splitq start_xmit (bsc#1215458). * idpf: add sriov support and other ndo_ops (bsc#1215458). * idpf: add tx splitq napi poll support (bsc#1215458). * idpf: cancel mailbox work in error path (bsc#1215458). * idpf: configure resources for rx queues (bsc#1215458). * idpf: configure resources for tx queues (bsc#1215458). * idpf: fix potential use-after-free in idpf_tso() (bsc#1215458). * idpf: initialize interrupts and enable vport (bsc#1215458). * idpf: set scheduling mode for completion queue (bsc#1215458). * iio: adc: xilinx-xadc: correct temperature offset/scale for ultrascale (git- fixes). * iio: adc: xilinx-xadc: do not clobber preset voltage/temperature thresholds (git-fixes). * iio: exynos-adc: request second interupt only when touchscreen mode is used (git-fixes). * input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (git-fixes). * input: synaptics-rmi4 - handle reset delay when using smbus trsnsport (git- fixes). * input: xpad - add vid for turtle beach controllers (git-fixes). * irqchip/stm32-exti: add missing dt irq flag translation (git-fixes). * kabi/severities: ignore kabi in rxrpc (bsc#1210447) the rxrpc module is built since sle15-sp3 but it is not shipped as part of any sle product, only in leap (in kernel-*-optional). * kernel-binary: suse-module-tools is also required when installed requires(pre) adds dependency for the specific sciptlet. however, suse- module-tools alsoships modprobe.d files which may be needed at posttrans time or any time the kernel is on the system for generating ramdisk. add plain requires as well. * kernel-source: move provides after sources * kernel/fork: beware of __put_task_struct() calling context (bsc#1216761). * leds: pwm: do not disable the pwm when the led should be off (git-fixes). * leds: trigger: ledtrig-cpu:: fix 'output may be truncated' issue for 'cpu' (git-fixes). * leds: turris-omnia: do not use smbus calls (git-fixes). * lsm: fix default return value for inode_getsecctx (git-fixes). * lsm: fix default return value for vm_enough_memory (git-fixes). * media: bttv: fix use after free error due to btv-> timeout timer (git-fixes). * media: ccs: correctly initialise try compose rectangle (git-fixes). * media: ccs: fix driver quirk struct documentation (git-fixes). * media: cedrus: fix clock/reset sequence (git-fixes). * media: cobalt: use field_get() to extract link width (git-fixes). * media: gspca: cpia1: shift-out-of-bounds in set_flicker (git-fixes). * media: i2c: max9286: fix some redundant of_node_put() calls (git-fixes). * media: imon: fix access to invalid resource for the second interface (git- fixes). * media: lirc: drop trailing space from scancode transmit (git-fixes). * media: qcom: camss: fix missing vfe_lite clocks check (git-fixes). * media: qcom: camss: fix pm_domain_on sequence in probe (git-fixes). * media: qcom: camss: fix vfe-17x vfe_disable_output() (git-fixes). * media: qcom: camss: fix vfe_get() error jump (git-fixes). * media: sharp: fix sharp encoding (git-fixes). * media: siano: drop unnecessary error check for debugfs_create_dir/file() (git-fixes). * media: venus: hfi: add checks to handle capabilities from firmware (git- fixes). * media: venus: hfi: add checks to perform sanity on queue pointers (git- fixes). * media: venus: hfi: fix the check to handle session buffer requirement (git- fixes). * media: venus: hfi_parser: add check to keep the number of codecs within range(git-fixes). * media: vidtv: mux: add check and kfree for kstrdup (git-fixes). * media: vidtv: psi: add check for kstrdup (git-fixes). * media: vivid: avoid integer overflow (git-fixes). * mfd: arizona-spi: set pdata.hpdet_channel for acpi enumerated devs (git- fixes). * mfd: core: ensure disabled devices are skipped without aborting (git-fixes). * mfd: dln2: fix double put in dln2_probe (git-fixes). * misc: fastrpc: clean buffers on remote invocation failures (git-fixes). * misc: pci_endpoint_test: add device id for r-car s4-8 pcie controller (git- fixes). * mm/hmm: fault non-owner device private entries (bsc#1216844, jsc#ped-7237, git-fixes). * mmc: block: be sure to wait while busy in cqe error recovery (git-fixes). * mmc: block: do not lose cache flush during cqe error recovery (git-fixes). * mmc: block: retry commands in cqe error recovery (git-fixes). * mmc: cqhci: fix task clearing in cqe error recovery (git-fixes). * mmc: cqhci: increase recovery halt timeout (git-fixes). * mmc: cqhci: warn of halt or task clear failure (git-fixes). * mmc: meson-gx: remove setting of cmd_cfg_error (git-fixes). * mmc: sdhci-pci-gli: a workaround to allow gl9750 to enter aspm l1.2 (git- fixes). * mmc: sdhci-pci-gli: gl9750: mask the replay timer timeout of aer (git- fixes). * mmc: sdhci_am654: fix start loop index for tap value parsing (git-fixes). * mmc: vub300: fix an error code (git-fixes). * modpost: fix tee module_device_table built on big-endian host (git-fixes). * mt76: dma: use kzalloc instead of devm_kzalloc for txwi (git-fixes). * mtd: cfi_cmdset_0001: byte swap otp info (git-fixes). * mtd: rawnand: arasan: include ecc syndrome along with in-band data while checking for ecc failure (git-fixes). * net-memcg: fix scope of sockmem pressure indicators (bsc#1216759). * net: add macro netif_subqueue_completed_wake (bsc#1215458). * net: avoid address overwrite in kernel_connect (bsc#1216861). * net: fix use-after-free in tw_timer_handler (bsc#1217195). * net: ieee802154: adf7242: fixsome potential buffer overflow in adf7242_stats_show() (git-fixes). * net: mana: fix return type of mana_start_xmit() (git-fixes). * net: piggy back on the memory barrier in bql when waking queues (bsc#1215458). * net: provide macros for commonly copied lockless queue stop/wake code (bsc#1215458). * net: usb: ax88179_178a: fix failed operations during ax88179_reset (git- fixes). * net: usb: smsc95xx: fix uninit-value access in smsc95xx_read_reg (git- fixes). * nfs: fix access to page-> mapping (bsc#1216788). * nvme: update firmware version after commit (bsc#1215292). * pci/aspm: fix l1 substate handling in aspm_attr_store_common() (git-fixes). * pci/sysfs: protect driver's d3cold preference from user space (git-fixes). * pci: disable ats for specific intel ipu e2000 devices (bsc#1215458). * pci: extract ats disabling to a helper function (bsc#1215458). * pci: exynos: do not discard.remove() callback (git-fixes). * pci: keystone: do not discard.probe() callback (git-fixes). * pci: keystone: do not discard.remove() callback (git-fixes). * pci: prevent xhci driver from claiming amd vangogh usb3 drd device (git- fixes). * pci: tegra194: use field_get()/field_prep() with link width fields (git- fixes). * pci: use field_get() in sapphire rx 5600 xt pulse quirk (git-fixes). * pci: use field_get() to extract link width (git-fixes). * pci: vmd: correct pci header type register's multi-function check (git- fixes). * pcmcia: cs: fix possible hung task and memory leak pccardd() (git-fixes). * pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() (git-fixes). * pcmcia: ds: fix refcount leak in pcmcia_device_add() (git-fixes). * pinctrl: avoid reload of p state in list iteration (git-fixes). * platform/x86/intel-uncore-freq: return error on write frequency (bsc#1217147). * platform/x86/intel-uncore-freq: split common and enumeration part (bsc#1217147). * platform/x86/intel-uncore-freq: support for cluster level controls (bsc#1217147). * platform/x86/intel-uncore-freq:tpmi: provide cluster level control (bsc#1217147). * platform/x86/intel-uncore-freq: uncore frequency control via tpmi (bsc#1217147). * platform/x86/intel/tpmi: add tpmi external interface for tpmi feature drivers (bsc#1217147). * platform/x86/intel/tpmi: fix double free reported by smatch (bsc#1217147). * platform/x86/intel/tpmi: process cpu package mapping (bsc#1217147). * platform/x86/intel/uncore-freq: display uncore current frequency (bsc#1217147). * platform/x86/intel/uncore-freq: move to uncore-frequency folder (bsc#1217147). * platform/x86/intel/uncore-freq: use sysfs api to create attributes (bsc#1217147). * platform/x86/intel/vsec: add tpmi id (bsc#1217147). * platform/x86/intel/vsec: enhance and export intel_vsec_add_aux() (bsc#1217147). * platform/x86/intel/vsec: support private data (bsc#1217147). * platform/x86/intel/vsec: use mutex for ida_alloc() and ida_free() (bsc#1217147). * platform/x86/intel: intel tpmi enumeration driver (bsc#1217147). * platform/x86/intel: tpmi: fix double free in tpmi_create_device() (bsc#1217147). * platform/x86: intel-uncore-freq: add client processors (bsc#1217147). * platform/x86: intel-uncore-freq: conditionally create attribute for read frequency (bsc#1217147). * platform/x86: intel-uncore-freq: fix uncore_freq_common_init() error codes (bsc#1217147). * platform/x86: intel-uncore-freq: prevent driver loading in guests (bsc#1217147). * platform/x86: intel-uncore-freq: use sysfs_emit() to instead of scnprintf() (bsc#1217147). * platform/x86: intel-uncore-frequency: move to intel sub-directory (bsc#1217147). * platform/x86: intel-uncore-frequency: use default_groups in kobj_type (bsc#1217147). * platform/x86: thinkpad_acpi: add battery quirk for thinkpad x120e (git- fixes). * platform/x86: wmi: fix opening of char device (git-fixes). * platform/x86: wmi: fix probe failure when failing to register wmi devices (git-fixes). * platform/x86: wmi: remove unnecessary initializations (git-fixes). * pm / devfreq: rockchip-dfi: make pmuregmap mandatory (git-fixes). * pm: hibernate: use __get_safe_page() rather than touching the list (git- fixes). * powerpc/perf/hv-24x7: update domain value check (bsc#1215931). * powerpc/vas: limit open window failure messages in log bufffer (bsc#1216687 ltc#203927). * powerpc: do not clobber f0/vs0 during fp|altivec register save (bsc#1217780). * pwm: brcmstb: utilize appropriate clock apis in suspend/resume (git-fixes). * pwm: fix double shift bug (git-fixes). * pwm: sti: reduce number of allocations and drop usage of chip_data (git- fixes). * quota: fix slow quotaoff (bsc#1216621). * r8152: cancel hw_phy_work if we have an error in probe (git-fixes). * r8152: check for unplug in r8153b_ups_en() / r8153c_ups_en() (git-fixes). * r8152: check for unplug in rtl_phy_patch_request() (git-fixes). * r8152: increase usb control msg timeout to 5000ms as per spec (git-fixes). * r8152: release firmware if we have an error in probe (git-fixes). * r8152: run the unload routine if we have errors during probe (git-fixes). * regmap: debugfs: fix a erroneous check after snprintf() (git-fixes). * regmap: ensure range selector registers are updated after cache sync (git- fixes). * regmap: prevent noinc writes from clobbering cache (git-fixes). * revert "i2c: pxa: move to generic gpio recovery" (git-fixes). * revert "mmc: core: capture correct oemid-bits for emmc cards" (git-fixes). * revert "tracing: fix warning in trace_buffered_event_disable()" (bsc#1217036) * revert amdgpu patches that caused a regression (bsc#1215802) * rpm/check-for-config-changes: add as_wruss to ignored_configs_re add as_wruss as an ignored_configs_re entry in check-for-config-changes to fix build on x86_32. there was a fix submitted to upstream but it was not accepted: https://lore.kernel.org/all/20231031140504.gczuejkmpxsredh3ma@fat_crate.local/ so carry this in ignored_configs_re instead. * rpm/check-for-config-changes: add have_shadow_call_stack to ignored_configs_re not supported by our compiler. * rpm/mkspec-dtb:add riscv64 dtb-allwinner subpackage * run scripts/renamepatches for sle15-sp4 * s390/ap: fix ap bus crash on early config change callback invocation (git- fixes bsc#1217687). * s390/cio: unregister device when the only path is gone (git-fixes bsc#1217609). * s390/cmma: fix detection of dat pages (ltc#203997 bsc#1217086). * s390/cmma: fix handling of swapper_pg_dir and invalid_pg_dir (ltc#203997 bsc#1217086). * s390/cmma: fix initial kernel address space page table walk (ltc#203997 bsc#1217086). * s390/crashdump: fix tod programmable field size (git-fixes bsc#1217205). * s390/dasd: fix hanging device after request requeue (git-fixes ltc#203629 bsc#1215124). * s390/dasd: protect device queue against concurrent access (git-fixes bsc#1217515). * s390/dasd: use correct number of retries for erp requests (git-fixes bsc#1217598). * s390/ipl: add missing ipl_type_eckd_dump case to ipl_init() (git-fixes bsc#1217511). * s390/ipl: add missing secure/has_secure file to ipl type 'unknown' (bsc#1214976 git-fixes). * s390/mm: add missing arch_set_page_dat() call to gmap allocations (ltc#203997 bsc#1217086). * s390/mm: add missing arch_set_page_dat() call to vmem_crst_alloc() (ltc#203997 bsc#1217086). * s390/pkey: fix/harmonize internal keyblob headers (git-fixes bsc#1217200). * s390/ptrace: fix ptrace_get_last_break error handling (git-fixes bsc#1217599). * sbitmap: fix batched wait_cnt accounting (bsc#1217095 bsc#1217196). * sbitmap: fix up kabi for sbitmap_queue_wake_up() (bsc#1217095 bsc#1217196). * sbsa_gwdt: calculate timeout with 64-bit math (git-fixes). * scsi: lpfc: copyright updates for 14.2.0.16 patches (bsc#1217731). * scsi: lpfc: correct maximum pci function value for ras fw logging (bsc#1217731). * scsi: lpfc: eliminate unnecessary relocking in lpfc_check_nlp_post_devloss() (bsc#1217731). * scsi: lpfc: enhance driver logging for selected discovery events (bsc#1217731). * scsi: lpfc: fix list_entry null check warning in lpfc_cmpl_els_plogi() (bsc#1217731). * scsi: lpfc: fixpossible file string name overflow when updating firmware (bsc#1217731). * scsi: lpfc: introduce log_node_verbose messaging flag (bsc#1217124). * scsi: lpfc: refactor and clean up mailbox command memory free (bsc#1217731). * scsi: lpfc: reject received prlis with only initiator fcn role for npiv ports (bsc#1217124). * scsi: lpfc: remove unnecessary zero return code assignment in lpfc_sli4_hba_setup (bsc#1217124). * scsi: lpfc: return early in lpfc_poll_eratt() when the driver is unloading (bsc#1217731). * scsi: lpfc: treat ioerr_sli_down i/o completion status the same as pci offline (bsc#1217124). * scsi: lpfc: update lpfc version to 14.2.0.15 (bsc#1217124). * scsi: lpfc: update lpfc version to 14.2.0.16 (bsc#1217731). * scsi: lpfc: validate els ls_acc completion payload (bsc#1217124). * scsi: qla2xxx: fix double free of dsd_list during driver load (git-fixes). * scsi: qla2xxx: use field_get() to extract pcie capability fields (git- fixes). * selftests/efivarfs: create-read: fix a resource leak (git-fixes). * selftests/pidfd: fix ksft print formats (git-fixes). * selftests/resctrl: ensure the benchmark commands fits to its array (git- fixes). * selftests/resctrl: reduce failures due to outliers in mba/mbm tests (git- fixes). * selftests/resctrl: remove duplicate feature check from cmt test (git-fixes). * seq_buf: fix a misleading comment (git-fixes). * serial: exar: revert "serial: exar: add support for sealevel 7xxxc serial cards" (git-fixes). * serial: meson: use platform_get_irq() to get the interrupt (git-fixes). * soc: qcom: llcc: handle a second device without data corruption (git-fixes). * spi: nxp-fspi: use the correct ioremap function (git-fixes). * spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies (git-fixes). * spi: tegra: fix missing irq check in tegra_slink_probe() (git-fixes). * staging: media: ipu3: remove ftrace-like logging (git-fixes). * string.h: add array-wrappers for (v)memdup_user() (git-fixes). * supported.conf: marked idpf supported *thermal: core: prevent potential string overflow (git-fixes). * treewide: spelling fix in comment (git-fixes). * tty/sysrq: replace smp_processor_id() with get_cpu() (git-fixes). * tty: 8250: add brainboxes oxford semiconductor-based quirks (git-fixes). * tty: 8250: add support for additional brainboxes px cards (git-fixes). * tty: 8250: add support for additional brainboxes uc cards (git-fixes). * tty: 8250: add support for brainboxes up cards (git-fixes). * tty: 8250: add support for intashield is-100 (git-fixes). * tty: 8250: add support for intashield ix cards (git-fixes). * tty: 8250: fix port count of px-257 (git-fixes). * tty: 8250: fix up px-803/px-857 (git-fixes). * tty: 8250: remove uc-257 and uc-431 (git-fixes). * tty: fix uninit-value access in ppp_sync_receive() (git-fixes). * tty: n_gsm: fix race condition in status line change on dead connections (git-fixes). * tty: serial: meson: fix hard lockup on crtscts mode (git-fixes). * tty: tty_jobctrl: fix pid memleak in disassociate_ctty() (git-fixes). * tty: vcc: add check for kstrdup() in vcc_probe() (git-fixes). * update ath11k hibernation fix patch set (bsc#1207948) * update metadata s390-ipl-add-missing-secure-has_secure-file-to-ipl-type- unknown (bsc#1214976 git-fixes). * usb: cdnsp: fix deadlock issue during using ncm gadget (git-fixes). * usb: chipidea: fix dma overwrite for tegra (git-fixes). * usb: chipidea: simplify tegra dma alignment code (git-fixes). * usb: dwc2: fix possible null pointer dereference caused by driver concurrency (git-fixes). * usb: dwc2: write hcint with intmask applied (bsc#1214286). * usb: dwc3: fix default mode initialization (git-fixes). * usb: dwc3: qcom: fix acpi platform device leak (git-fixes). * usb: dwc3: qcom: fix resource leaks on probe deferral (git-fixes). * usb: dwc3: qcom: fix software node leak on probe errors (git-fixes). * usb: dwc3: qcom: fix wakeup after probe deferral (git-fixes). * usb: dwc3: set the dma max_seg_size (git-fixes). * usb: gadget: f_ncm: always setcurrent gadget in ncm_bind() (git-fixes). * usb: raw-gadget: properly handle interrupted requests (git-fixes). * usb: serial: option: add fibocom l7xx modules (git-fixes). * usb: serial: option: do not claim interface 4 for zte mf290 (git-fixes). * usb: serial: option: fix fm101r-gl defines (git-fixes). * usb: storage: set 1.50 as the lower bcddevice for older "super top" compatibility (git-fixes). * usb: typec: tcpm: fix null pointer dereference in tcpm_pd_svdm() (git- fixes). * usb: typec: tcpm: skip hard reset when in error recovery (git-fixes). * usb: usbip: fix stub_dev hub disconnect (git-fixes). * virtchnl: add virtchnl version 2 ops (bsc#1215458). * wifi: ath10k: do not touch the ce interrupt registers after power up (git- fixes). * wifi: ath10k: fix clang-specific fortify warning (git-fixes). * wifi: ath11k: debugfs: fix to work with multiple pci devices (git-fixes). * wifi: ath11k: fix dfs radar event locking (git-fixes). * wifi: ath11k: fix gtk offload status event locking (git-fixes). * wifi: ath11k: fix htt pktlog locking (git-fixes). * wifi: ath11k: fix temperature event locking (git-fixes). * wifi: ath9k: fix clang-specific fortify warnings (git-fixes). * wifi: iwlwifi: call napi_synchronize() before freeing rx/tx queues (git- fixes). * wifi: iwlwifi: empty overflow queue during flush (git-fixes). * wifi: iwlwifi: honor the enable_ini value (git-fixes). * wifi: iwlwifi: pcie: synchronize irqs before napi (git-fixes). * wifi: iwlwifi: use fw rate for non-data frames (git-fixes). * wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (git- fixes). * wifi: mac80211: fix # of msdu in a-msdu calculation (git-fixes). * wifi: mt76: mt7603: rework/fix rx pse hang check (git-fixes). * wifi: rtlwifi: fix edca limit set by bt coexistence (git-fixes). * wifi: rtw88: debug: fix the null vs is_err() bug for debugfs_create_file() (git-fixes). * x86/alternative: add a __alt_reloc_selftest() prototype (git-fixes). * x86/cpu: clear svm feature if disabled by bios(bsc#1214700). * x86/cpu: fix amd erratum #1485 on zen4-based cpus (git-fixes). * x86/fpu: set x86_feature_osxsave feature after enabling osxsave in cr4 (git- fixes). * x86/hyperv: add hv_expose_invariant_tsc define (git-fixes). * x86/hyperv: fix a warning in mshyperv.h (git-fixes). * x86/hyperv: improve code for referencing hyperv_pcpu_input_arg (git-fixes). * x86/hyperv: make hv_get_nmi_reason public (git-fixes). * x86/sev: do not try to parse for the cc blob on non-amd hardware (git- fixes). * x86/sev: fix calculation of end address based on number of pages (git- fixes). * x86/sev: use the ghcb protocol when available for snp cpuid requests (git- fixes). * x86: move gds_ucode_mitigated() declaration to header (git-fixes). * xfs: add attr state machine tracepoints (git-fixes). * xfs: can't use kmem_zalloc() for attribute buffers (bsc#1216909). * xfs: constify btree function parameters that are not modified (git-fixes). * xfs: convert agf log flags to unsigned (git-fixes). * xfs: convert agi log flags to unsigned (git-fixes). * xfs: convert attr type flags to unsigned (git-fixes). * xfs: convert bmap extent type flags to unsigned (git-fixes). * xfs: convert bmapi flags to unsigned (git-fixes). * xfs: convert btree buffer log flags to unsigned (git-fixes). * xfs: convert buffer flags to unsigned (git-fixes). * xfs: convert buffer log item flags to unsigned (git-fixes). * xfs: convert da btree operations flags to unsigned (git-fixes). * xfs: convert dquot flags to unsigned (git-fixes). * xfs: convert inode lock flags to unsigned (git-fixes). * xfs: convert log item tracepoint flags to unsigned (git-fixes). * xfs: convert log ticket and iclog flags to unsigned (git-fixes). * xfs: convert quota options flags to unsigned (git-fixes). * xfs: convert scrub type flags to unsigned (git-fixes). * xfs: disambiguate units for ftrace fields tagged "blkno", "block", or "bno" (git-fixes). * xfs: disambiguate units for ftrace fields tagged "count" (git-fixes). * xfs: disambiguate units forftrace fields tagged "len" (git-fixes). * xfs: disambiguate units for ftrace fields tagged "offset" (git-fixes). * xfs: make the key parameters to all btree key comparison functions const (git-fixes). * xfs: make the key parameters to all btree query range functions const (git- fixes). * xfs: make the keys and records passed to btree inorder functions const (git- fixes). * xfs: make the pointer passed to btree set_root functions const (git-fixes). * xfs: make the start pointer passed to btree alloc_block functions const (git-fixes). * xfs: make the start pointer passed to btree update_lastrec functions const (git-fixes). * xfs: mark the record passed into btree init_key functions as const (git- fixes). * xfs: mark the record passed into xchk_btree functions as const (git-fixes). * xfs: remove xfs_btree_cur_t typedef (git-fixes). * xfs: rename i_disk_size fields in ftrace output (git-fixes). * xfs: resolve fork names in trace output (git-fixes). * xfs: standardize ag block number formatting in ftrace output (git-fixes). * xfs: standardize ag number formatting in ftrace output (git-fixes). * xfs: standardize daddr formatting in ftrace output (git-fixes). * xfs: standardize inode generation formatting in ftrace output (git-fixes). * xfs: standardize inode number formatting in ftrace output (git-fixes). * xfs: standardize remaining xfs_buf length tracepoints (git-fixes). * xfs: standardize rmap owner number formatting in ftrace output (git-fixes). * xhci: Loosen RPM as default policy to cover for AMD xHC 1.1 (git-fixes). * xhci: enable rpm on controllers that support low-power states (git-fixes). ## Special Instructions and Notes: * Please reboot the system after installing this update. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-4732=1 openSUSE-SLE-15.5-2023-4732=1 * SUSELinux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2023-4732=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2023-4732=1 * SUSE Real Time Module 15-SP5 zypper in -t patch SUSE-SLE-Module-RT-15-SP5-2023-4732=1 ## Package List: * openSUSE Leap 15.5 (noarch) * kernel-source-rt-5.14.21-150500.13.27.2 * kernel-devel-rt-5.14.21-150500.13.27.2 * openSUSE Leap 15.5 (x86_64) * kernel-rt-optional-5.14.21-150500.13.27.2 * kernel-rt_debug-vdso-5.14.21-150500.13.27.2 * dlm-kmp-rt-debuginfo-5.14.21-150500.13.27.2 * kernel-rt_debug-debuginfo-5.14.21-150500.13.27.2 * reiserfs-kmp-rt-5.14.21-150500.13.27.2 * ocfs2-kmp-rt-debuginfo-5.14.21-150500.13.27.2 * kernel-rt-vdso-5.14.21-150500.13.27.2 * cluster-md-kmp-rt-debuginfo-5.14.21-150500.13.27.2 * gfs2-kmp-rt-5.14.21-150500.13.27.2 * kernel-rt-devel-debuginfo-5.14.21-150500.13.27.2 * cluster-md-kmp-rt-5.14.21-150500.13.27.2 * kernel-rt_debug-devel-5.14.21-150500.13.27.2 * kernel-rt-extra-5.14.21-150500.13.27.2 * dlm-kmp-rt-5.14.21-150500.13.27.2 * kernel-livepatch-5_14_21-150500_13_27-rt-1-150500.11.3.2 * kernel-rt-extra-debuginfo-5.14.21-150500.13.27.2 * kernel-rt-vdso-debuginfo-5.14.21-150500.13.27.2 * kernel-rt-livepatch-devel-5.14.21-150500.13.27.2 * kernel-rt-optional-debuginfo-5.14.21-150500.13.27.2 * kernel-rt_debug-livepatch-devel-5.14.21-150500.13.27.2 * kernel-rt_debug-debugsource-5.14.21-150500.13.27.2 * kernel-rt_debug-devel-debuginfo-5.14.21-150500.13.27.2 * reiserfs-kmp-rt-debuginfo-5.14.21-150500.13.27.2 * kernel-rt-debuginfo-5.14.21-150500.13.27.2 * kernel-rt-devel-5.14.21-150500.13.27.2 * ocfs2-kmp-rt-5.14.21-150500.13.27.2 * kernel-rt-debugsource-5.14.21-150500.13.27.2 * gfs2-kmp-rt-debuginfo-5.14.21-150500.13.27.2 * kernel-syms-rt-5.14.21-150500.13.27.1 * kernel-livepatch-SLE15-SP5-RT_Update_8-debugsource-1-150500.11.3.2 * kernel-livepatch-5_14_21-150500_13_27-rt-debuginfo-1-150500.11.3.2 * kernel-rt_debug-vdso-debuginfo-5.14.21-150500.13.27.2 *kselftests-kmp-rt-debuginfo-5.14.21-150500.13.27.2 * kernel-rt-livepatch-5.14.21-150500.13.27.2 * kselftests-kmp-rt-5.14.21-150500.13.27.2 * openSUSE Leap 15.5 (nosrc x86_64) * kernel-rt_debug-5.14.21-150500.13.27.2 * kernel-rt-5.14.21-150500.13.27.2 * SUSE Linux Enterprise Micro 5.5 (nosrc x86_64) * kernel-rt-5.14.21-150500.13.27.2 * SUSE Linux Enterprise Micro 5.5 (x86_64) * kernel-rt-debuginfo-5.14.21-150500.13.27.2 * kernel-rt-debugsource-5.14.21-150500.13.27.2 * SUSE Linux Enterprise Live Patching 15-SP5 (x86_64) * kernel-livepatch-5_14_21-150500_13_27-rt-1-150500.11.3.2 * kernel-livepatch-5_14_21-150500_13_27-rt-debuginfo-1-150500.11.3.2 * kernel-livepatch-SLE15-SP5-RT_Update_8-debugsource-1-150500.11.3.2 * SUSE Real Time Module 15-SP5 (x86_64) * kernel-rt_debug-vdso-5.14.21-150500.13.27.2 * dlm-kmp-rt-debuginfo-5.14.21-150500.13.27.2 * kernel-rt_debug-debuginfo-5.14.21-150500.13.27.2 * ocfs2-kmp-rt-debuginfo-5.14.21-150500.13.27.2 * kernel-rt-vdso-5.14.21-150500.13.27.2 * cluster-md-kmp-rt-debuginfo-5.14.21-150500.13.27.2 * gfs2-kmp-rt-5.14.21-150500.13.27.2 * kernel-rt-devel-debuginfo-5.14.21-150500.13.27.2 * cluster-md-kmp-rt-5.14.21-150500.13.27.2 * kernel-rt_debug-devel-5.14.21-150500.13.27.2 * dlm-kmp-rt-5.14.21-150500.13.27.2 * kernel-rt-vdso-debuginfo-5.14.21-150500.13.27.2 * kernel-rt_debug-debugsource-5.14.21-150500.13.27.2 * kernel-rt_debug-devel-debuginfo-5.14.21-150500.13.27.2 * kernel-rt-debuginfo-5.14.21-150500.13.27.2 * ocfs2-kmp-rt-5.14.21-150500.13.27.2 * kernel-rt-devel-5.14.21-150500.13.27.2 * kernel-rt-debugsource-5.14.21-150500.13.27.2 * gfs2-kmp-rt-debuginfo-5.14.21-150500.13.27.2 * kernel-syms-rt-5.14.21-150500.13.27.1 * kernel-rt_debug-vdso-debuginfo-5.14.21-150500.13.27.2 * SUSE Real Time Module 15-SP5 (noarch) * kernel-source-rt-5.14.21-150500.13.27.2 * kernel-devel-rt-5.14.21-150500.13.27.2 * SUSE Real Time Module 15-SP5 (nosrc x86_64) * kernel-rt_debug-5.14.21-150500.13.27.2 * kernel-rt-5.14.21-150500.13.27.2 ## References: *https://www.suse.com/security/cve/CVE-2023-2006.html * https://www.suse.com/security/cve/CVE-2023-25775.html * https://www.suse.com/security/cve/CVE-2023-3777.html * https://www.suse.com/security/cve/CVE-2023-39197.html * https://www.suse.com/security/cve/CVE-2023-39198.html * https://www.suse.com/security/cve/CVE-2023-4244.html * https://www.suse.com/security/cve/CVE-2023-45863.html * https://www.suse.com/security/cve/CVE-2023-45871.html * https://www.suse.com/security/cve/CVE-2023-46813.html * https://www.suse.com/security/cve/CVE-2023-46862.html * https://www.suse.com/security/cve/CVE-2023-5158.html * https://www.suse.com/security/cve/CVE-2023-5633.html * https://www.suse.com/security/cve/CVE-2023-5717.html * https://www.suse.com/security/cve/CVE-2023-6039.html * https://www.suse.com/security/cve/CVE-2023-6176.html * https://bugzilla.suse.com/show_bug.cgi?id=1207948 * https://bugzilla.suse.com/show_bug.cgi?id=1210447 * https://bugzilla.suse.com/show_bug.cgi?id=1212649 * https://bugzilla.suse.com/show_bug.cgi?id=1214286 * https://bugzilla.suse.com/show_bug.cgi?id=1214700 * https://bugzilla.suse.com/show_bug.cgi?id=1214840 * https://bugzilla.suse.com/show_bug.cgi?id=1214976 * https://bugzilla.suse.com/show_bug.cgi?id=1215095 * https://bugzilla.suse.com/show_bug.cgi?id=1215123 * https://bugzilla.suse.com/show_bug.cgi?id=1215124 * https://bugzilla.suse.com/show_bug.cgi?id=1215292 * https://bugzilla.suse.com/show_bug.cgi?id=1215420 * https://bugzilla.suse.com/show_bug.cgi?id=1215458 * https://bugzilla.suse.com/show_bug.cgi?id=1215710 * https://bugzilla.suse.com/show_bug.cgi?id=1215802 * https://bugzilla.suse.com/show_bug.cgi?id=1215931 * https://bugzilla.suse.com/show_bug.cgi?id=1216058 * https://bugzilla.suse.com/show_bug.cgi?id=1216105 * https://bugzilla.suse.com/show_bug.cgi?id=1216259 * https://bugzilla.suse.com/show_bug.cgi?id=1216527 * https://bugzilla.suse.com/show_bug.cgi?id=1216584 * https://bugzilla.suse.com/show_bug.cgi?id=1216621 *https://bugzilla.suse.com/show_bug.cgi?id=1216687 * https://bugzilla.suse.com/show_bug.cgi?id=1216693 * https://bugzilla.suse.com/show_bug.cgi?id=1216759 * https://bugzilla.suse.com/show_bug.cgi?id=1216761 * https://bugzilla.suse.com/show_bug.cgi?id=1216788 * https://bugzilla.suse.com/show_bug.cgi?id=1216844 * https://bugzilla.suse.com/show_bug.cgi?id=1216861 * https://bugzilla.suse.com/show_bug.cgi?id=1216909 * https://bugzilla.suse.com/show_bug.cgi?id=1216959 * https://bugzilla.suse.com/show_bug.cgi?id=1216965 * https://bugzilla.suse.com/show_bug.cgi?id=1216976 * https://bugzilla.suse.com/show_bug.cgi?id=1217036 * https://bugzilla.suse.com/show_bug.cgi?id=1217068 * https://bugzilla.suse.com/show_bug.cgi?id=1217086 * https://bugzilla.suse.com/show_bug.cgi?id=1217095 * https://bugzilla.suse.com/show_bug.cgi?id=1217124 * https://bugzilla.suse.com/show_bug.cgi?id=1217140 * https://bugzilla.suse.com/show_bug.cgi?id=1217147 * https://bugzilla.suse.com/show_bug.cgi?id=1217195 * https://bugzilla.suse.com/show_bug.cgi?id=1217196 * https://bugzilla.suse.com/show_bug.cgi?id=1217200 * https://bugzilla.suse.com/show_bug.cgi?id=1217205 * https://bugzilla.suse.com/show_bug.cgi?id=1217332 * https://bugzilla.suse.com/show_bug.cgi?id=1217366 * https://bugzilla.suse.com/show_bug.cgi?id=1217511 * https://bugzilla.suse.com/show_bug.cgi?id=1217515 * https://bugzilla.suse.com/show_bug.cgi?id=1217598 * https://bugzilla.suse.com/show_bug.cgi?id=1217599 * https://bugzilla.suse.com/show_bug.cgi?id=1217609 * https://bugzilla.suse.com/show_bug.cgi?id=1217687 * https://bugzilla.suse.com/show_bug.cgi?id=1217731 * https://bugzilla.suse.com/show_bug.cgi?id=1217780 * * * . A critical update for the Linux Kernel resolves several vulnerabilities affecting SUSE environments. Ensure your systems are updated without delay.. Linux Kernel Security, SUSE Update, Important Kernel Fixes, Privilege Escalation, Kernel Bug Fixes. . Severity: Important. LinuxSecurity.com Team
Dec 14, 2023
•Important
SuSE
203
security advisorydenial of servicelighttpdMageia 8: 2022-0369 Moderate Advisory on Lighttpd DoS Vulnerability
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. (CVE-2022-37797) . MGASA-2022-0369 - Updated lighttpd packages fix security vulnerability Publication date: 13 Oct 2022 URL: https://advisories.mageia.org/MGASA-2022-0369.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-37797, CVE-2022-41556 In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. (CVE-2022-37797) A resource leak in mod_fastcgi and mod_scgi could lead to a denial of service after a large number of bad HTTP requests. (CVE-2022-41556) References: - https://bugs.mageia.org/show_bug.cgi?id=30912 - https://lists.debian.org/debian-security-announce/2022/msg00212.html - https://www.cve.org/CVERecord?id=CVE-2022-37797 - https://www.cve.org/CVERecord?id=CVE-2022-41556 SRPMS: - 8/core/lighttpd-1.4.59-1.2.mga8 . Mageia 8 nginx security patch addresses buffer overflow vulnerabilities, preventing potential service interruptions and memory management issues.. lighttpd Update, Mageia Security, Denial Of Service Fix. . LinuxSecurity.com Team
Oct 13, 2022
Mageia
87
security advisorymoderatedenial of serviceDebian 10: DSA-5251-1 Moderate: isc-dhcp DoS, Resource Leak Issues
Several vulnerabilities have been discovered in the ISC DHCP client, relay and server. CVE-2022-2928 . - ------------------------------------------------------------------------- Debian Security Advisory DSA-5251-1
Oct 06, 2022
Debian
197
security advisorydenial of servicehigh severityDebian 10 Buster DLA-3138-1 High: BIND Resource Leak Issues
Several vulnerabilities were discovered in BIND, a DNS server implementation. CVE-2022-2795 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3138-1
Oct 05, 2022
Debian LTS
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!