Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 10 articles for you...
217
security advisoryimportantbind9Oracle Linux 9 ELSA-2026-24368 bind9 Important CVE-2026-3039 CVE-2026-5946
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:. Oracle Linux Security Advisory ELSA-2026-24368 http://linux.oracle.com/errata/ELSA-2026-24368.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: bind9.18-9.18.29-14.el9_8.2.x86_64.rpm bind9.18-chroot-9.18.29-14.el9_8.2.x86_64.rpm bind9.18-devel-9.18.29-14.el9_8.2.i686.rpm bind9.18-devel-9.18.29-14.el9_8.2.x86_64.rpm bind9.18-dnssec-utils-9.18.29-14.el9_8.2.x86_64.rpm bind9.18-doc-9.18.29-14.el9_8.2.noarch.rpm bind9.18-libs-9.18.29-14.el9_8.2.i686.rpm bind9.18-libs-9.18.29-14.el9_8.2.x86_64.rpm bind9.18-utils-9.18.29-14.el9_8.2.x86_64.rpm aarch64: bind9.18-9.18.29-14.el9_8.2.aarch64.rpm bind9.18-chroot-9.18.29-14.el9_8.2.aarch64.rpm bind9.18-devel-9.18.29-14.el9_8.2.aarch64.rpm bind9.18-dnssec-utils-9.18.29-14.el9_8.2.aarch64.rpm bind9.18-doc-9.18.29-14.el9_8.2.noarch.rpm bind9.18-libs-9.18.29-14.el9_8.2.aarch64.rpm bind9.18-utils-9.18.29-14.el9_8.2.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates/bind9.18-9.18.29-14.el9_8.2.src.rpm Related CVEs: CVE-2026-3039 CVE-2026-5946 Description of changes: [32:9.18.29-14.2] - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946) _______________________________________________ El-errata mailing list
Jun 24, 2026
•Important
Oracle
89
security advisorysecurity updatefedoraFedora 43 BIND 9.21.22 Security Fixes for Multiple Issues 2026-ec095a4675
Update to 9.21.22 (rhbz#2480122) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-ec095a4675 2026-06-15 01:10:25.755874+00:00 -------------------------------------------------------------------------------- Name : bind9-next Product : Fedora 43 Version : 9.21.22 Release : 2.fc43 URL : https://www.isc.org/downloads/bind/ Summary : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Description : BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. -------------------------------------------------------------------------------- Update Information: Update to 9.21.22 (rhbz#2480122) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) Avoid unbounded recursion loop. (CVE-2026-5950) Fix crash in resolver when SIG(0)-signed responses are received under load. (CVE-2026-5947) Fix use-after-free error in DNS-over-HTTPS when processing HTTP/2 SETTINGS frames. (CVE-2026-3593) Fix outgoing zone transfers' quota issue. Feature Changes: Fix CPU spikes and slow queries when cache approaches memory limit. Implement RFC 3645 Section 4.1.1 key expiry check in TKEY. Reduce memory footprint by actively returning unused memory to the OS. multiplebugfixes. Source: https://downloads.isc.org/isc/bind9/9.21.22/doc/arm/html/notes.html#notes-for- bind-9-21-22 -------------------------------------------------------------------------------- ChangeLog: * Fri Jun 5 2026 Petr Menšík - 32:9.21.22-2 - Switch downstream change to upstream for 32b mem check * Fri Jun 5 2026 Petr Menšík - 32:9.21.22-1 - Update to 9.21.22 (rhbz#2480122) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2480122 - bind9-next-9.21.22 is available https://bugzilla.redhat.com/show_bug.cgi?id=2480122 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-ec095a4675' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- . Fedora 43 updates BIND with crucial security fixes addressing resource leaks and potential exploits improving DNS reliability.. BIND DNS update, Fedora security patch, resolver leak fix, DNS security enhancement. . Severity: Important. LinuxSecurity.com Team
Jun 14, 2026
•Important
Fedora
89
security advisoryfedorasecurity fixFedora 44 bind9-next Important DNS Server Security Fixes 2026-dbb0776ac5
Update to 9.21.22 (rhbz#2480122) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-dbb0776ac5 2026-06-15 00:48:35.285092+00:00 -------------------------------------------------------------------------------- Name : bind9-next Product : Fedora 44 Version : 9.21.22 Release : 2.fc44 URL : https://www.isc.org/downloads/bind/ Summary : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Description : BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. -------------------------------------------------------------------------------- Update Information: Update to 9.21.22 (rhbz#2480122) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) Avoid unbounded recursion loop. (CVE-2026-5950) Fix crash in resolver when SIG(0)-signed responses are received under load. (CVE-2026-5947) Fix use-after-free error in DNS-over-HTTPS when processing HTTP/2 SETTINGS frames. (CVE-2026-3593) Fix outgoing zone transfers' quota issue. Feature Changes: Fix CPU spikes and slow queries when cache approaches memory limit. Implement RFC 3645 Section 4.1.1 key expiry check in TKEY. Reduce memory footprint by actively returning unused memory to the OS. multiplebugfixes. Source: https://downloads.isc.org/isc/bind9/9.21.22/doc/arm/html/notes.html#notes-for- bind-9-21-22 -------------------------------------------------------------------------------- ChangeLog: * Wed Jun 3 2026 Petr Menšík - 32:9.21.22-2 - Switch downstream change to upstream for 32b mem check * Wed Jun 3 2026 Petr Menšík - 32:9.21.22-1 - Update to 9.21.22 (rhbz#2480122) * Tue May 5 2026 Petr Menšík - 32:9.21.21-7 - Fix build with openssl4 (rhbz#2463851) * Tue May 5 2026 Petr Menšík - 32:9.21.21-6 - Remove unused forgotten files * Thu Apr 30 2026 Petr Menšík - 32:9.21.21-5 - Stop publishing rwtab.d/named -------------------------------------------------------------------------------- References: [ 1 ] Bug #2480122 - bind9-next-9.21.22 is available https://bugzilla.redhat.com/show_bug.cgi?id=2480122 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-dbb0776ac5' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- . Fedora 44's bind9-next update addresses several important security fixes, enhancing DNS server stability and performance.. Fedora bind9-next security fix DNS update. . Severity: Important. LinuxSecurity.com Team
Jun 14, 2026
•Important
Fedora
217
security advisoryremote accessbindOracle Linux 8 bind Important GSS-API Fixes ELSA-2026-24339
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:. Oracle Linux Security Advisory ELSA-2026-24339 http://linux.oracle.com/errata/ELSA-2026-24339.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable LinuxNetwork: x86_64: bind-9.11.36-16.el8_10.8.x86_64.rpm bind-chroot-9.11.36-16.el8_10.8.x86_64.rpm bind-devel-9.11.36-16.el8_10.8.i686.rpm bind-devel-9.11.36-16.el8_10.8.x86_64.rpm bind-export-devel-9.11.36-16.el8_10.8.i686.rpm bind-export-devel-9.11.36-16.el8_10.8.x86_64.rpm bind-export-libs-9.11.36-16.el8_10.8.i686.rpm bind-export-libs-9.11.36-16.el8_10.8.x86_64.rpm bind-libs-9.11.36-16.el8_10.8.i686.rpm bind-libs-9.11.36-16.el8_10.8.x86_64.rpm bind-libs-lite-9.11.36-16.el8_10.8.i686.rpm bind-libs-lite-9.11.36-16.el8_10.8.x86_64.rpm bind-license-9.11.36-16.el8_10.8.noarch.rpm bind-lite-devel-9.11.36-16.el8_10.8.i686.rpm bind-lite-devel-9.11.36-16.el8_10.8.x86_64.rpm bind-pkcs11-9.11.36-16.el8_10.8.x86_64.rpm bind-pkcs11-devel-9.11.36-16.el8_10.8.i686.rpm bind-pkcs11-devel-9.11.36-16.el8_10.8.x86_64.rpm bind-pkcs11-libs-9.11.36-16.el8_10.8.i686.rpm bind-pkcs11-libs-9.11.36-16.el8_10.8.x86_64.rpm bind-pkcs11-utils-9.11.36-16.el8_10.8.x86_64.rpm bind-sdb-9.11.36-16.el8_10.8.x86_64.rpm bind-sdb-chroot-9.11.36-16.el8_10.8.x86_64.rpm bind-utils-9.11.36-16.el8_10.8.x86_64.rpm python3-bind-9.11.36-16.el8_10.8.noarch.rpm aarch64: bind-9.11.36-16.el8_10.8.aarch64.rpm bind-chroot-9.11.36-16.el8_10.8.aarch64.rpm bind-devel-9.11.36-16.el8_10.8.aarch64.rpm bind-export-devel-9.11.36-16.el8_10.8.aarch64.rpm bind-export-libs-9.11.36-16.el8_10.8.aarch64.rpm bind-libs-9.11.36-16.el8_10.8.aarch64.rpm bind-libs-lite-9.11.36-16.el8_10.8.aarch64.rpm bind-license-9.11.36-16.el8_10.8.noarch.rpm bind-lite-devel-9.11.36-16.el8_10.8.aarch64.rpm bind-pkcs11-9.11.36-16.el8_10.8.aarch64.rpm bind-pkcs11-devel-9.11.36-16.el8_10.8.aarch64.rpm bind-pkcs11-libs-9.11.36-16.el8_10.8.aarch64.rpm bind-pkcs11-utils-9.11.36-16.el8_10.8.aarch64.rpm bind-sdb-9.11.36-16.el8_10.8.aarch64.rpm bind-sdb-chroot-9.11.36-16.el8_10.8.aarch64.rpm bind-utils-9.11.36-16.el8_10.8.aarch64.rpm python3-bind-9.11.36-16.el8_10.8.noarch.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates/bind-9.11.36-16.el8_10.8.src.rpm RelatedCVEs: CVE-2026-3039 CVE-2026-5946 Description of changes: [32:9.11.36-16.8] - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946) _______________________________________________ El-errata mailing list
Jun 08, 2026
•Important
Oracle
89
security advisoryfedoraGSS-APIFedora 43 BIND 9.18.49 Important Security Fixes for DNS Issues
Update to 9.18.49 (rhbz#2480121) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-b626e83a45 2026-05-26 01:20:50.020972+00:00 -------------------------------------------------------------------------------- Name : bind Product : Fedora 43 Version : 9.18.49 Release : 1.fc43 URL : https://www.isc.org/downloads/bind/ Summary : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Description : BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. -------------------------------------------------------------------------------- Update Information: Update to 9.18.49 (rhbz#2480121) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) Avoid unbounded recursion loop. (CVE-2026-5950) Fix outgoing zone transfers' quota issue. Feature Changes: Fix CPU spikes and slow queries when cache approaches memory limit. Bug Fixes: Fix named crash when processing SIG records in dynamic updates. Fix rndc modzone behavior for a zone in named.conf. Fix zone verification of NSEC3 signed zones. Prevent a crash when using both dns64 and filter-aaaa. Fixed an assertion failure when processing catalog zones. Prevent malicious DNSSEC zones from exhausting validator CPU. Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits. Prevent crafted queries from degrading RRL performance. Fix a bug in allow-query/allow-transfer catalog zone customproperties. Fix a memory leak issue in catalog zones. Fix suppressed missing-glue check in named-checkzone. Reject record sets too large to serve in DNS. Source: https://downloads.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html#notes-for- bind-9-18-49 -------------------------------------------------------------------------------- ChangeLog: * Wed May 20 2026 Petr Men\u0161k - 32:9.18.49-1 - Update to 9.18.49 (rhbz#2480121) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2480121 - bind-9.18.49 is available https://bugzilla.redhat.com/show_bug.cgi?id=2480121 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-b626e83a45' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- . Discover important security fixes in Fedora 43 BIND 9.18.49, addressing critical resource leaks and recursion issues.. Fedora BIND Update, DNS Security Fixes, CVE-2026-3039, Server Resource Management. . Severity: Important. LinuxSecurity.com Team
May 26, 2026
•Important
Fedora
89
security advisoryfedoraDoSFedora 43 bind-dyndb-ldap Important DoS Resource Leak Fix 2026-b626e83a45
Update to 9.18.49 (rhbz#2480121) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-b626e83a45 2026-05-26 01:20:50.020972+00:00 -------------------------------------------------------------------------------- Name : bind-dyndb-ldap Product : Fedora 43 Version : 11.11 Release : 13.fc43 URL : https://releases.pagure.org/bind-dyndb-ldap Summary : LDAP back-end plug-in for BIND Description : This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server. -------------------------------------------------------------------------------- Update Information: Update to 9.18.49 (rhbz#2480121) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) Avoid unbounded recursion loop. (CVE-2026-5950) Fix outgoing zone transfers' quota issue. Feature Changes: Fix CPU spikes and slow queries when cache approaches memory limit. Bug Fixes: Fix named crash when processing SIG records in dynamic updates. Fix rndc modzone behavior for a zone in named.conf. Fix zone verification of NSEC3 signed zones. Prevent a crash when using both dns64 and filter-aaaa. Fixed an assertion failure when processing catalog zones. Prevent malicious DNSSEC zones from exhausting validator CPU. Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits. Prevent crafted queries from degrading RRL performance. Fix a bug in allow-query/allow-transfer catalog zone custom properties. Fix a memory leak issue in catalog zones. Fix suppressed missing-glue check in named-checkzone. Reject record sets too large to serve inDNS. Source: https://downloads.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html#notes-for- bind-9-18-49 -------------------------------------------------------------------------------- ChangeLog: * Wed May 20 2026 Petr Men\u0161k - 11.11-13 - Rebuilt for BIND 9.18.49 (rhbz#2480121) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2480121 - bind-9.18.49 is available https://bugzilla.redhat.com/show_bug.cgi?id=2480121 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-b626e83a45' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- . Fedora 43 bind-dyndb-ldap update 2026-b626e83a45 with critical security fixes for multiple issues.. bind-dyndb-ldap updates, Fedora vulnerabilities, LDAP security fixes. . Severity: Important. LinuxSecurity.com Team
May 26, 2026
•Important
Fedora
217
security advisorybuffer overflowimportantOracle Linux 9 Kernel Important Update ELSA-2026-50145 Changes
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:. Oracle Linux Security Advisory ELSA-2026-50145 http://linux.oracle.com/errata/ELSA-2026-50145.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: aarch64: bpftool-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-container-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-container-debug-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-core-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-debug-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-debug-core-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-debug-devel-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-debug-modules-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-debug-modules-extra-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-devel-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-doc-5.15.0-318.199.3.2.el9uek.noarch.rpm kernel-uek-modules-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek-modules-extra-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek64k-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek64k-core-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek64k-devel-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek64k-modules-5.15.0-318.199.3.2.el9uek.aarch64.rpm kernel-uek64k-modules-extra-5.15.0-318.199.3.2.el9uek.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates/kernel-uek-5.15.0-318.199.3.2.el9uek.src.rpm RelatedCVEs: CVE-2024-26655 CVE-2024-36903 CVE-2024-36927 CVE-2024-40928 CVE-2024-46830 CVE-2024-49968 CVE-2025-21979 CVE-2025-22022 CVE-2025-22111 CVE-2025-22119 CVE-2025-22121 CVE-2025-37860 CVE-2025-38007 CVE-2025-38022 CVE-2025-38057 CVE-2025-38129 CVE-2025-38232 CVE-2025-38556 CVE-2025-38591 CVE-2025-40110 CVE-2025-40149 CVE-2025-40164 CVE-2025-40256 CVE-2025-68211 CVE-2025-68254 CVE-2025-68255 CVE-2025-68261 CVE-2025-68264 CVE-2025-68282 CVE-2025-68337 CVE-2025-68346 CVE-2025-68349 CVE-2025-68354 CVE-2025-68362 CVE-2025-68364 CVE-2025-68366 CVE-2025-68367 CVE-2025-68372 CVE-2025-68724 CVE-2025-68725 CVE-2025-68732 CVE-2025-68740 CVE-2025-68746 CVE-2025-68757 CVE-2025-68759 CVE-2025-68764 CVE-2025-68771 CVE-2025-68776 CVE-2025-68780 CVE-2025-68782 CVE-2025-68783 CVE-2025-68785 CVE-2025-68788 CVE-2025-68795 CVE-2025-68803 CVE-2025-68813 CVE-2025-68815 CVE-2025-68816 CVE-2025-68818 CVE-2025-68819 CVE-2025-68820 CVE-2025-71066 CVE-2025-71068 CVE-2025-71075 CVE-2025-71077 CVE-2025-71082 CVE-2025-71083 CVE-2025-71084 CVE-2025-71085 CVE-2025-71087 CVE-2025-71091 CVE-2025-71093 CVE-2025-71094 CVE-2025-71096 CVE-2025-71097 CVE-2025-71098 CVE-2025-71104 CVE-2025-71108 CVE-2025-71111 CVE-2025-71113 CVE-2025-71114 CVE-2025-71116 CVE-2025-71118 CVE-2025-71120 CVE-2025-71125 CVE-2025-71127 CVE-2025-71131 CVE-2025-71132 CVE-2025-71133 CVE-2025-71146 CVE-2025-71147 CVE-2025-71154 CVE-2025-71182 CVE-2025-71190 CVE-2025-71194 CVE-2025-71197 CVE-2026-22976 CVE-2026-22977 CVE-2026-22978 CVE-2026-22980 CVE-2026-22984 CVE-2026-22988 CVE-2026-22990 CVE-2026-22991 CVE-2026-22992 CVE-2026-22997 CVE-2026-22998 CVE-2026-22999 CVE-2026-23001 CVE-2026-23003 CVE-2026-23011 CVE-2026-23020 CVE-2026-23021 CVE-2026-23038 CVE-2026-23047 CVE-2026-23049 CVE-2026-23058 CVE-2026-23060 CVE-2026-23061 CVE-2026-23071 CVE-2026-23073 CVE-2026-23074 CVE-2026-23076 CVE-2026-23084 CVE-2026-23085 CVE-2026-23087 CVE-2026-23089 CVE-2026-23091 CVE-2026-23097 CVE-2026-23099 CVE-2026-23101 CVE-2026-23103 CVE-2026-23105 CVE-2026-23108 CVE-2026-23111 CVE-2026-23119 CVE-2026-23120 CVE-2026-23121 CVE-2026-23124 CVE-2026-23125 CVE-2026-23133 CVE-2026-23139 CVE-2026-23145 CVE-2026-23146 CVE-2026-23164 CVE-2026-23202 CVE-2026-23209 Description of changes: [5.15.0-318.199.3.2] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39057366] - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 39057366] {CVE-2026-23209} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 39057346] {CVE-2026-23111} - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 39055945] [5.15.0-318.199.3.1] - nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch) [Orabug: 39026355] - nvme: cancel pending I/O if nvme controller is in terminal state (Nilay Shroff) [Orabug: 39026355] - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch) [Orabug: 39026355] - nvme: ensure disabling pairs with unquiesce (Keith Busch) [Orabug: 39026355] [5.15.0-318.199.3] - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen) - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970594] {CVE-2026-23202} - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao) - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao) - x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper) - KVM: x86: Don't snapshot "max" TSC if host TSC is constant (Sean Christopherson) [Orabug: 38966500] - KVM: x86: Accept KVM_[GS]ET_TSC_KHZ as a VM ioctl. (David Woodhouse) [Orabug: 38966500] - sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree) [Orabug: 37855346] {CVE-2025-37860} - Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38937481] - Revert "net/rds: expand kref coverage to rds_notifier-> n_conn" (Sharath Srinivasan) [Orabug:38937481] [5.15.0-318.199.2] - drivers/soc/pensando/penfw: Add support for pcie serdes fw download. (Hiren Mehta) [Orabug: 38953591] - arm64: pensando: Add support for kpcimgr dynamic event queue (Rob Gardner) [Orabug: 38928823] - procfs: move dropping pde and pid from -> evict_inode() to -> free_inode() (Al Viro) [Orabug: 38945002] - ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38188749] - jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38188749] - Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923519] - Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923519] - Revert "IB/core: Fix off-by-one attr index in setup_hw_port_stats" (Sharath Srinivasan) [Orabug: 38923519] - drivers/soc/pensando/bsm: Fix various issues with secure-mode. (Hiren Mehta) [Orabug: 38944299] - net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928274] - net/rds: rds_send_xmit should INIT_LIST_HEAD(&to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928272] - net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928270] - net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923496] [5.15.0-318.199.1] - LTS version: v5.15.199 (Vijayendra Suman) - wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 39004275] {CVE-2025-22119} - wifi: cfg80211: fully move wiphy work to unbound workqueue (Johannes Berg) - wifi: cfg80211: cancel wiphy_work before freeing wiphy (Miri Korenblit) [Orabug: 39004414] {CVE-2025-21979} - wifi: cfg80211: fix wiphy delayed work queueing (Johannes Berg) - wifi: cfg80211: use system_unbound_wq for wiphy work (Johannes Berg) - team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) - pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski) - mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts) -writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal) - drm/imx/tve: fix probe device leak (Johan Hovold) - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski) - net/sched: act_ife: convert comma to semicolon (Chen Ni) - btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() (Jp Kobryn) - drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li) - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) - genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 39004242] {CVE-2025-38007} - HID: uclogic: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu) - wifi: mac80211: move TDLS work to wiphy work (Johannes Berg) - wifi: mac80211: use wiphy work for sdata-> work (Johannes Berg) - wifi: cfg80211: add a work abstraction with special semantics (Johannes Berg) - Bluetooth: Fix hci_suspend_sync crash (Ying Hsu) - net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) - usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649206] {CVE-2025-40164} - NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158712] {CVE-2025-38232} - ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (Luis Henriques) - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094997] {CVE-2025-38057} - fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik) - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon) - drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED (Gaosheng Cui) - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes) [Orabug: 38773375] {CVE-2025-68211} - mm/pagewalk: add walk_page_range_vma() (David Hildenbrand) - ksmbd: smbd: fixdma_unmap_sg() nents (Thomas Fourier) - mei: trace: treat reg parameter as string (Alexander Usyskin) - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) - nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff) - nvme-pci: do not directly handle subsys reset fallout (Keith Busch) - nvme-fc: rename free_ctrl callback to match name pattern (Daniel Wagner) - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) - dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold) - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold) - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930799] {CVE-2025-71197} - w1: w1_therm: use swap() to make code cleaner (Yang Guang) - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento) - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931015] {CVE-2026-23087} - iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold) - of: platform: Use default match table for /firmware (Rob Herring) - comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott) - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649138] {CVE-2025-40149} - net: Add locking to protect skb-> dev access in ip_output (Sharath Chandra Vurukala) - mptcp: only reset subflow errors when propagated (Matthieu Baerts) - scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier) - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li) - ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam) - dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi) - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev) - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi) - net: bridge: fix static keycheck (Martin Kaiser) - nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima) - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Gal Pressman) - net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) - ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg) - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima) - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970353] {CVE-2026-23164} - ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera) - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan) - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan) - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970605] {CVE-2026-23146} - bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335081] {CVE-2025-38591} - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798882] {CVE-2025-68725} - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931067] {CVE-2026-23097} - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931121] {CVE-2026-23108} - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930883] {CVE-2026-23061} - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930860] {CVE-2026-23058} - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931002] {CVE-2026-23085} - perf/x86/intel: Do not enable BTS for guests (Fernand Sieber) - netrom: fix double-free in nr_route_frame() (Jeongjun Park) - uacce: ensure safe queue release with state management (Chenghai Huang) - uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen) - uacce: fixcdev handling in the cleanup path (Wenkai Lin) - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931041] {CVE-2026-23091} - slimbus: core: fix device reference leak on report present (Johan Hovold) - slimbus: core: fix runtime PM imbalance on report present (Johan Hovold) - octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier) - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930941] {CVE-2026-23073} - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter) - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970255] {CVE-2026-23133} - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz) - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931030] {CVE-2026-23089} - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930967] {CVE-2026-23076} - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich) - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao) - iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin) - of: fix reference count leak in of_alias_scan() (Weigang He) - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931092] {CVE-2026-23101} - x86: make page fault handling disable interrupts properly (Cedric Xing) - net/sched: act_ife: avoid possible NULL deref (Eric Dumazet) - octeontx2-af: Fix error handling (Ratheesh Kannoth) - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970200] {CVE-2026-23119} - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930993] {CVE-2026-23084} - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf) - drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf) - usbnet: limitmax_mtu based on device's hard_mtu (Laurent Vivier) - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970223] {CVE-2026-23124} - mISDN: annotate data-race around dev-> work (Eric Dumazet) [Orabug: 38970211] {CVE-2026-23121} - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao) - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao) - ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan) - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930931] {CVE-2026-23071} - iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin) - staging:iio:adc:ad7280a: Register define cleanup. (Jonathan Cameron) - x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper) - scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li) - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng) - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi) - Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo) - w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li) - comedi: dmm32at: serialize use of paged registers (Ian Abbott) - crypto: authencesn - reject too-short AAD (assoclen head (Eric Dumazet) [Orabug: 39004363] {CVE-2026-22988} - net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914761] {CVE-2026-23021} - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872325] {CVE-2026-22976} - HID: quirks: work around VID/PID conflict for appledisplay (René Rebe) - bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose) - net/mlx5e: Don't print error message due to invalid module (Gal Pressman) - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu) - net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877947] {CVE-2026-22977} - inet: ping: Fix icmp outcounting (Yuan Gao) - net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu) - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht) - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari) - netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970278] {CVE-2026-23139} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan) - netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera) - ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray) - arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen) - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang) - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong) - NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust) - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) - alpha: don't reference obsolete termio struct for TC* constants (Sam James) - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior) - csky: fix csky_cmpxchg_fixup not working (Yang Li) - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin) [Orabug: 37844521] {CVE-2025-22121} - ext4: introduce ITAIL helper (Ye Bin) - libceph: make calc_target() set t-> paused, not just clear it (Ilya Dryomov) [Orabug: 38930821] {CVE-2026-23047} - libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887697] {CVE-2026-22992} - libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887691] {CVE-2026-22991} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887685] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887673] {CVE-2026-22984} - wifi: avoid kernel-infoleak fromstruct iw_point (Eric Dumazet) [Orabug: 38887650] {CVE-2026-22978} - drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin) - lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers) - mei: me: add nova lake point S DID (Alexander Usyskin) - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914755] {CVE-2026-23020} - atm: Fix dma_free_coherent() size (Thomas Fourier) - usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold) - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (Su Hui) [Orabug: 39004163] {CVE-2024-40928} - firmware: arm_scmi: Fix unused notifier-block in unregister (Amitai Gottlieb) - ext4: fix error message when rejecting the default hash (Gabriel Krisman Bertazi) - ext4: factor out ext4_hash_info_init() (Jason Yan) - ext4: filesystems without casefold feature cannot be mounted with siphash (Lizhi Xu) [Orabug: 37206152] {CVE-2024-49968} - pwm: stm32: Always program polarity (Sean Nyekjaer) - x86: remove __range_not_ok() (Arnd Bergmann) - selftests: net: test_vxlan_under_vrf: fix HV connectivity test (Andrea Righi) - ipv4: Fix uninit-value access in __ip_make_skb() (Shigeru Yoshida) [Orabug: 36683410] {CVE-2024-36927} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Shigeru Yoshida) [Orabug: 36683284] {CVE-2024-36903} - KVM: arm64: sys_regs: disable -Wuninitialized-const-pointer warning (Justin Stitt) - HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334903] {CVE-2025-38556} - KVM: x86: Acquire kvm-> srcu when handling KVM_SET_VCPU_EVENTS (Sean Christopherson) [Orabug: 37116451] {CVE-2024-46830} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152994] {CVE-2025-38129} - drm/i915/selftests: fix subtraction overflow bug (Andrzej Hajda) - mmc: core: use sysfs_emit() instead of sprintf() (Sergey Shtylyov) - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug:37844500] {CVE-2025-22111} - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann) - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852361] {CVE-2025-71127} - ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold) - lockd: fix vfs_test_lock() calls (Neil Brown) - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand) - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand) - mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand) - mm/balloon_compaction: make balloon page compaction callbacks static (Miaohe Lin) - ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold) - ASoC: stm32: sai: Use the devm_clk_get_optional() helper (Christophe Jaillet) - ASoC: stm: Use dev_err_probe() helper (Kuninori Morimoto) - r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe) - iommu/qcom: fix device leak on of_xlate() (Johan Hovold) - powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom) - PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan) - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand) - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin) - media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski) - NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847872] {CVE-2025-68803} - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne) - media: vpif_capture: fix section mismatch (Johan Hovold) - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li) - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852341] {CVE-2025-71120} - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson) - crypto: af_alg - zero initializememory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852312] {CVE-2025-71113} - svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847976] {CVE-2025-71068} - ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre) - usb: ohci-nxp: fix device leak on probe failure (Johan Hovold) - usb: ohci-nxp: Use helper function devm_clk_get_enabled() (Zhang Zekun) - mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts) - usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami) - f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu) - f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu) - f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu) - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu) - xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li) - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang) - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever) - ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo) - ALSA: wavefront: Use standard print API (Takashi Iwai) - ALSA: wavefront: Clear substream pointers on close (Junrui Luo) - wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann) - btrfs: don't rewrite ret from inode_permission (Josef Bacik) - tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848017] {CVE-2025-71077} - jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin) - xhci: dbgtty: fix device unregister (Łukasz Bartosik) - xhci: dbgtty: use IDR to support several dbc instances. (Mathias Nyman) - usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773636] {CVE-2025-68282} - usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michał Pecio) [Orabug: 37844150] {CVE-2025-22022} - usb: xhci: move link chain bit quirk checks into one helper function. (NiklasNeronin) - drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin) [Orabug: 38643537] {CVE-2025-40110} - virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner) - kbuild: Use CRC32 and a 1MiB dictionary for XZ compressed modules (Martin Nybo Andersen) - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park) - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park) - mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park) - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park) - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park) - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park) - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park) - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park) - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094814] {CVE-2025-38022} - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park) - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park) - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul) - drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848052] {CVE-2025-71083} - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen) - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey) - net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore) - nfsd: Drop the client reference in client_states_open() (Haoxiang Li) - fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li) - e1000: fix OOB ine1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848099] {CVE-2025-71093} - RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848058] {CVE-2025-71084} - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848117] {CVE-2025-71096} - idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox) - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou) - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou) - media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou) - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov) - media: cec: Fix debugfs leak on bus_register() failure (Xu Wang) - fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe) - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum) - fbdev: gbefb: fix to use physical address instead of dma address (René Rebe) - dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki) - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov) - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle) - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle) - media: rc: st_rc: Fix reset control resource leak (Xu Wang) - mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski) - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold) - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz) - leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz) - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner) - HID: logitech-dj: Remove duplicate error logging (Hans de Goede) - iommu/tegra: fix device leak on probe_device() (Johan Hovold) - iommu/sun50i: fix device leak on of_xlate() (JohanHovold) - iommu/omap: fix device leaks on probe_device() (Johan Hovold) - iommu/mediatek: fix device leak on of_xlate() (Johan Hovold) - iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold) - iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold) - iommu/exynos: fix device leak on of_xlate() (Johan Hovold) - iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold) - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla) - ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla) - ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla) - ASoC: stm32: sai: fix device leak on probe (Johan Hovold) - selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou) - RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier) - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang) - RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap) - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari) - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari) - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu) - RDMA/efa: Remove possible negative shift (Michael Margolin) - RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852379] {CVE-2025-71133} - net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse) - ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848125] {CVE-2025-71097} - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848061] {CVE-2025-71085} - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur) - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya) - net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848107] {CVE-2025-71094} - net: dsa: b53: skip multicast entries forfdb_dump() (Jonas Gorski) - firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier) - genalloc.h: fix htmldocs warning (Andrew Morton) - smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852376] {CVE-2025-71132} - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887620] {CVE-2025-71154} - team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848088] {CVE-2025-71091} - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo) - platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier) - ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848131] {CVE-2025-71098} - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen) - net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou) - net: mdio: aspeed: move reg accessing part into separate functions (Potin Lai) - Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848044] {CVE-2025-71082} - crypto: seqiv - Do not use req-> iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852370] {CVE-2025-71131} - iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848073] {CVE-2025-71087} - i40e: Refactor argument of i40e_detect_recover_hung() (Ivan Vecera) - i40e: Refactor argument of several client notification functions (Ivan Vecera) - i40e: fix scheduling in set_rx_mode (Przemyslaw Korba) - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852300] {CVE-2025-71111} - hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han) - i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke) - rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla) - soc: amlogic: canvas: fix device leak on lookup (Johan Hovold) - soc: qcom: ocmem: fix device leak on lookup (JohanHovold) - amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold) - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher) - io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) - svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers) - nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko) - fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847800] {CVE-2025-68788} - tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852355] {CVE-2025-71125} - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson) - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson) - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed) - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852273] {CVE-2025-71104} - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang) - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson) - libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852325] {CVE-2025-71116} - parisc: Do not reprogram affinitiy on ASP chip (Helge Deller) - scs: fix a wrong parameter in __scs_magic (Zhichi Lin) - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih) - ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847688] {CVE-2025-68771} - media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park) - tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield) - f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu) - f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey) - scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin)[Orabug: 38847770] {CVE-2025-68782} - NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo) - scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848009] {CVE-2025-71075} - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847931] {CVE-2025-68818} - cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin) - intel_th: Fix error handling in intel_th_output_open (Ma Ke) - char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen) - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li) - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin) - usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold) - USB: lpc32xx_udc: Fix error handling in probe (Ma Ke) - phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold) - media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King) - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847937] {CVE-2025-68819} - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng) - media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart) - jbd2: use a weaker annotation in journal handling (Byungchul Park) - ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun) - ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848276] {CVE-2025-68820} - ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt) - floppy: fix for PAGE_SIZE != 4KB (René Rebe) - block: rate-limit capacity change info log (Li Chen) - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers) - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg) - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887597] {CVE-2025-71147} - vhost/vsock: improve RCU read sections aroundvhost_vsock_get() (Stefano Garzarella) - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao) - nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner) - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin) - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng) - usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie) - usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852285] {CVE-2025-71108} - usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu) - exfat: fix remount failure in different process environments (Yuezhang Mo) - via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852318] {CVE-2025-71114} - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby) - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby) - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby) - powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins) - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 (Josua Mayer) - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer) - firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan) - ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo) - ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo) - ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847775] {CVE-2025-68783} - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang) - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang) - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847724] {CVE-2025-68776} - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas) - spi: fsl-cpm: Check length parity before switching to 16 bit mode(Christophe Leroy) - ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang) - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg) - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao) - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng) - net: hns3: add VLAN id validation before using (Jian Shen) - net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen) - net: hns3: Align type of some variables with their print type (Hao Chen) - net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen) - net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory) - net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847914] {CVE-2025-68816} - ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847826] {CVE-2025-68795} - net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers (Daniil Tatianin) - net/ethtool/ioctl: remove if n_stats checks from ethtool_get_phy_stats (Daniil Tatianin) - ethtool: use phydev variable (Tom Rix) - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter) - net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847910] {CVE-2025-68815} - caif: fix integer underflow in cffrml_receive() (Junrui Luo) - ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847900] {CVE-2025-68813} - netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38974757] {CVE-2025-71146} - broadcom: b44: prevent uninitialized value usage (Alexey Simakov) - net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847784] {CVE-2025-68785} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel) - mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel) -ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov) - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847965] {CVE-2025-71066} - netrom: Fix memory leak in nr_sendmsg() (Wang Liang) - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li) - btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo) - hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko) - hfsplus: Verify inode mode when loading from disk (Tetsuo Handa) - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi) - hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko) - fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov) - livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu) - cpufreq: s5pv210: fix refcount leak (Shuhao Fu) - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus) - ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852333] {CVE-2025-71118} - x86/ptrace: Always inline trivial accessors (Peter Zijlstra) - sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847753] {CVE-2025-68780} - btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey) - bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek) - spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A) - coresight: etm4x: Correct polling IDLE bit (Leo Yan) - netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around (Nicklas Bo Jensen) - NFS: Fix missing unlock in nfs_unlink() (Sun Ke) - ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang) - ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo) [Orabug: 38798767] {CVE-2025-68346} - usb: phy: Initialize struct usb_phy list_head (Diogo Ivo) - usb: gadget: tegra-xudc: Always reinitialize datatoggle when clear halt (Haotien Hsu) - ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov) - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab) - efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab) - efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab) - dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang) - dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov) - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan) - ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa) - dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp) - blk-mq: Abort suspend when wakeup events are pending (Cong Zhang) - ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang) - ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang) - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang) - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov) - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf) - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818237] {CVE-2025-68764} - fs_context: drop the unused lsm_flags member (Ondrej Mosnacek) - Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust) - Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust) - Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust) - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798775] {CVE-2025-68349} - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust) - NFS: Fix the verifier for case sensitive filesystem in nfs_atomic_open() (Trond Myklebust) - NFSv4: Add some support for case insensitive filesystems (Trond Myklebust) - fs/nls: Fix utf16 to utf8 conversion (ArminWolf) - NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust) - NFS: don't unhash dentry during unlink/rename (Neil Brown) - NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink() (Trond Myklebust) - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal) - pinctrl: single: Fix incorrect type for error return variable (Xu Wang) - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (Matthijs Kooijman) - perf tools: Fix split kallsyms DSO counting (Namhyung Kim) - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc) - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko) - net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev) - netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera) - netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera) - netfilter: nf_conncount: reduce unnecessary GC (William Tu) - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso) - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798787] {CVE-2025-68354} - ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski) - virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin) - virtio_vdpa: fix misleading return in void function (Alok Tiwari) - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun) - ext4: remove unused return value of __mb_check_buddy (Kemeng Shi) - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe) - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter) - ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang) - ASoC: fsl_xcvr: Add support for i.MX93 platform (Chancel Liu) - ASoC: fsl_xcvr: Add Counter registers (Shengjiu Wang) - RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo) -RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo) - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold) - backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap) - backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli) - backlight: led_bl: Take led_access lock when required (Mans Rullgard) - wifi: ieee80211: correct FILS status codes (Ria Thomas) - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin) - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie) - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan) - crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang) - selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski) - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski) - usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang) - usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang) - usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang) - usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum) - ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798922] {CVE-2025-68740} - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798815] {CVE-2025-68362} - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang) - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang) - pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König) - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu) - fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis) - fs/ntfs3: out1 also needs to put mi (Edward Adam Davis) - fs/ntfs3: Make ni_ins_new_attr return error (Konstantin Komarov) - fs/ntfs3: Add new argument is_mft to ntfs_mark_rec_free (Konstantin Komarov) - fs/ntfs3: Removeunused mi_mark_free (Konstantin Komarov) - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani) - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818222] {CVE-2025-68759} - NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov) - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang) - watchdog: wdat_wdt: Stop watchdog when uninstalling module (Liu Xinpeng) - selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov) - ps3disk: use memcpy_{from,to}_bvec index (René Rebe) - PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli) - leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang) - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang) - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang) - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798824] {CVE-2025-68364} - lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko) - clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang) - coresight: etm4x: Add context synchronization before enabling trace (Leo Yan) - coresight: etm4x: Extract the trace unit controlling (Leo Yan) - coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang) - coresight: etm4x: Use Trace Filtering controls dynamically (Suzuki K Poulose) - coresight: etm4x: Save restore TRFCR_EL1 (Suzuki K Poulose) - nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798833] {CVE-2025-68366} - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal) - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798838] {CVE-2025-68367} - powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy) - RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke) - dt-bindings: PCI: amlogic: Fix the register name ofthe DBI region (Manivannan Sadhasivam) - dt-bindings: PCI: convert amlogic,meson-pcie.txt to dt-schema (Neil Armstrong) - scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang) - nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798851] {CVE-2025-68372} - nbd: partition nbd_read_stat() into nbd_read_reply() and nbd_handle_reply() (Yu Kuai) - nbd: clean up return value checking of sock_xmit() (Yu Kuai) - regulator: core: disable supply if enabling main regulator fails (Gabor Juhos) - perf/x86/intel: Correct large PEBS flag check (Dapeng Mi) - ext4: correct the checking of quota files before moving extents (Zhang Yi) - ext4: minor defrag code improvements (Eric Whitney) - mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang) - spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798944] {CVE-2025-68746} - spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A) - scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche) - power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska) - power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov) - i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu) - i3c: fix refcount inconsistency in i3c_master_register (Frank Li) - pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang) - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu) - x86: kmsan: don't instrument stack walking functions (Alexander Potapenko) - kmsan: introduce __no_sanitize_memory and __no_kmsan_checks (Alexander Potapenko) - compiler-gcc.h: Define __SANITIZE_ADDRESS__ under hwaddress sanitizer (Kees Cook) - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima) - phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur) - firmware: imx: scu-irq: fix OF node leak in (Peng Fan) - s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens) - s390/smp: Fixfallback CPU detection (Heiko Carstens) - crypto: hisilicon/qm - restore original qos values (Nieweiqiang) - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798875] {CVE-2025-68724} - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang) - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey) - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra) - iio: imu: st_lsm6dsx: discard samples during filters settling time (Lorenzo Bianconi) - iio: imu: st_lsm6dsx: introduce st_lsm6dsx_device_set_enable routine (Lorenzo Bianconi) - inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang) - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang) - ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela) - ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault) - irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold) - USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae) - drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818212] {CVE-2025-68757} - drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther) - gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798899] {CVE-2025-68732} - smack: fix bug: unprivileged task can create labels (Konstantin Andreev) - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K) [Orabug: 38773544] {CVE-2025-68254} - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K) [Orabug: 38773554] {CVE-2025-68255} - comedi: check device's attached status in compat ioctls (Nikita Zhandarovich) - comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich) - comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott) - HID: elecom: Add support for ELECOM M-XT3URBK (018F) (NaokiUeki) - platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia) - platform/x86: acer-wmi: Ignore backlight event (Armin Wolf) - pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari) - bfs: Reconstruct file type when loading from disk (Tetsuo Handa) - spi: imx: keep dma request disabled before dma transfer setup (Robin Gong) - spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado) - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold) - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold) - serial: add support of CPCI cards (Magne Bruno) - USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold) - USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda) - USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda) - USB: serial: option: add Foxconn T99W760 (Slark Xiao) - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich) - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773587] {CVE-2025-68261} - locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin) - ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773603] {CVE-2025-68264} - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792633] {CVE-2025-68337} - Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya) - leds: spi-byte: Use devm_led_classdev_register_ext() (Stefan Kalscheuer) - leds: Replace all non-returning strlcpy with strscpy (Azeem Shaikh) - drm/i915/selftests: Fix inconsistent IS_ERR and PTR_ERR (Kai Song) - dpaa2-mac: bail if the dpmacs fwnode is not found (Robert-Ionut Alexa) - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca) - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) [Orabug: 39004269]{CVE-2025-40256} - Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca) [5.15.0-317.197.5] - KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38801641] - Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38801641] - uek-rpm: pensando: Move crashkernel to cnic-image-builder (Henry Willard) [Orabug: 38851137] - ext4: drop dio overwrite only flag and associated warning (Brian Foster) [Orabug: 38381010] - ext4: fix racy may inline data check in dio write (Brian Foster) [Orabug: 38381010] - ext4: allow concurrent unaligned dio overwrites (Brian Foster) [Orabug: 38381010] - ext4: dio take shared inode lock when overwriting preallocated blocks (Zhang Yi) [Orabug: 38381010] - net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38172423] - uek-rpm: hnic: add unique hnic signing certs (Tom Saeger) [Orabug: 38894488] - drivers/soc/pensando/sbus: Secure mode support. (Hiren Mehta) [Orabug: 38894106] - drivers/soc/pensando/pen_secure: Report register address on access errors (Maciej S. Szmigiero) [Orabug: 38894106] - drivers/edac/elba_edac: Secure mode support (Hiren Mehta) [Orabug: 38894106] - drivers/soc/pensando/bsm: Add secure-mode support. (Hiren Mehta) [Orabug: 38894106] - drivers/soc/pensando/rstcause: Add secure mode support. (Hiren Mehta) [Orabug: 38894106] - drivers/soc/pensando/penfw: New SMC support for secure-mode. (Hiren Mehta) [Orabug: 38894106] - drivers/soc/pensando/sbus: Secure mode support (Hiren Mehta) [Orabug: 38894106] - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334981,38932988] {CVE-2025-38571} - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334968,38932991] {CVE-2025-38566} - xfrm: delete x-> tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730492,38933003] {CVE-2025-40215} [5.15.0-317.197.4] - gpio: mlxbf3: use platform_get_irq_optional() (David Thompson) [Orabug: 38755419] -platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari) [Orabug: 38755419] - pinctrl: mlxbf3: Fix return value check for devm_platform_ioremap_resource (Chen Ni) [Orabug: 38755419] - net/mlx5e: Query FW for buffer ownership (Alexei Lazar) [Orabug: 38755419] - net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi) [Orabug: 38755419] - net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38755419] - net/mlx5e: Support FEC settings for 100G/lane modes (Cosmin Ratiu) [Orabug: 38755419] - net/mlx5e: Extract checking of FEC support for a link mode (Cosmin Ratiu) [Orabug: 38755419] - tcp: Set pingpong threshold via sysctl (Haiyang Zhang) [Orabug: 38853979] - arm64: hnic: config: Add NBD driver (Patrick Colp) [Orabug: 38858773] - arm64: pensando: Fix spec file for HNIC (Rob Gardner) [Orabug: 38858773] - Enable additional drivers needed to support MIPS64 SmartNic (Vijay Kumar) [Orabug: 38846771] - MIPS: Fix build error for mips ARCH_ATOMIC (Vijay Kumar) [Orabug: 38846771] - Added atomic addition,subtraction functions. (Anagha K J) [Orabug: 38846771] - Allocate the required IV size referenced by the cypher handle in init_state (Anagha K J) [Orabug: 38846771] - Setting up numa system and memory initializations (Anagha K J) [Orabug: 38846771] - Implemented clocksource provider driven by node-0 FPA_CLK_COUNT (Anagha K J) [Orabug: 38846771] - Processor cache information made available to userspace (Anagha K J) [Orabug: 38846771] - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer) [Orabug: 38851582] - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon) - ext4: clear i_state_flags when alloc inode (Haibo Chen) - ext4: align max orphan file size with e2fsprogs limit (Baokun Li) - PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki) - net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang) - net/sched: sch_cake: Fix incorrect qlen reductionin cake_drop (Xiang Mei) [Orabug: 38783137] {CVE-2025-68325} - block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong) - fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847946] {CVE-2025-68821} - i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero) - fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov) - ntfs3: init run lock for extend inode (Edward Adam Davis) [5.15.0-317.197.3] - kpcimgr: Enable loading firmware via kernel infrastructure (Joseph Dobosenski) [Orabug: 38546110] - Move hnic crashkernel to cnic-image-builder (Henry Willard) [Orabug: 38546110] - Bump supported capmem range count from 64 to 256 (Jan Setje-Eilers) [Orabug: 38546110] - irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38546110] - pensando: Allow sparse allowed ranges in cap_mem (Maciej S. Szmigiero) [Orabug: 38546110] - soc/pensando/cap-pcie: Handle zero-ed out MS_CFG_WDT_IDX/WDT_IDX (Joao Martins) [Orabug: 38546110] - pensando: Enable penfw driver for smartnic (Jan Setje-Eilers) [Orabug: 38546110] - irqchip/gic-v3-its: remove WARN_ON gic_reserve_range (Tom Saeger) [Orabug: 38546110] - hnic: Disable CONFIG_OVERLAY_FS_INDEX (Patrick Colp) [Orabug: 38546110] - pensando: missing diffs from AMD (Jan Setje-Eilers) [Orabug: 38546110] - hnic: config: Build FUSE into the kernel (not as a module) (Patrick Colp) [Orabug: 38546110] - hnic: config: Add DM_VERITY support (Patrick Colp) [Orabug: 38546110] - hnic config: Add LOCKDOWN_LSM support (Patrick Colp) [Orabug: 38546110] - Subject: uek-rpm: Build hostnic kernel for Pensando (Dave Kleikamp) [Orabug: 38546110] - pensando: kpcimgr: support pcie port bifurcation (Darshan Prajapati) [Orabug: 38546110] - Add changes for penfw and sbus.c for secureboot (Rahshekh) [Orabug: 38546110] - arm64: GIC ITS MSI encapsulator address configured from device tree (Brad Larson) [Orabug: 38546110] - perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug:38546110] - reset: salinasr: Add AMD Pensando Salina SoC reset (Brad Larson) [Orabug: 38546110] - spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38546110] - EDAC/elba: Support AMD Pensando Giglio SoC (Brad Larson) [Orabug: 38546110] - arm64: defconfig: Add AMD Pensando Salina SoC defconfig (Brad Larson) [Orabug: 38546110] - soc/pensando: Support AMD Pensando Salina SoC (Brad Larson) [Orabug: 38546110] - arm64: dts: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38546110] - mmc: sdhci-cadence: Support AMD Salina SoC (Brad Larson) [Orabug: 38546110] - PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597010] {CVE-2025-40034} - mm/hugetlb: disable huge_pmd_unshare TLB sync by default on Exadata (Joe Jin) [Orabug: 38829889] - vhost: Account for worker thread under owner's nproc (Mike Christie) [Orabug: 38770748] - vhost: revert CAP_SYS restrictions on worker ioctls (Mike Christie) [Orabug: 38770748] - RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753654] - mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38420735,38773370] {CVE-2025-68209} - uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38744825] [5.15.0-317.197.2] - x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756952] - net/sched: adjust device watchdog timer to detect stopped queue at right time (Praveen Kumar Kannoju) [Orabug: 38341919] - KVM: arm64: Add minimal handling for the ARMv8.7 PMU (Marc Zyngier) [Orabug: 38784458] - scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175026] {CVE-2025-38239} - Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38790823] - mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38619860] - mm: list_lru: fix UAF for memory cgroup (Muchun Song) [Orabug: 38619860] - net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728740] - net/rds: expand kref coverageto rds_notifier-> n_conn (Sharath Srinivasan) [Orabug: 38728740] - net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728740] - net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728743] - net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38512377] - devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38512377] - devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38512377] - devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38512377] - devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38512377] - devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38512377] - net/mlx5: remove fw reporter dump option for non PF (Moshe Shemesh) [Orabug: 38512377] - net/mlx5: remove fw_fatal reporter dump option for non PF (Moshe Shemesh) [Orabug: 38512377] - devlink: Hold devlink lock on health reporter dump get (Moshe Shemesh) [Orabug: 38512377] - Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38512377] - NVIDIA: SAUCE: iommu/arm-smmu-v3: Allow default substream bypass with a pasid support (Nicolin Chen) [Orabug: 38463999] - RDMA/mlx5: Fix a WARN during dereg_mr for DM type (Yishai Hadas) [Orabug: 37766291,38463999] {CVE-2025-21888} - uek-rpm: replace CONFIG_IOMMU_SVA_LIB with CONFIG_IOMMU_SVA (Junxiao Bi) [Orabug: 38463999] - iommu/sva: Rename CONFIG_IOMMU_SVA_LIB to CONFIG_IOMMU_SVA (Fenghua Yu) [Orabug: 38463999] [5.15.0-317.197.1] - LTS version: v5.15.197 (Vijayendra Suman) - libbpf: Fix invalid return address register in s390 (Daniel T. Lee) - libbpf, riscv: Use a0 for RC register (Yixun Lan) - libbpf: Fix riscv register names (Ilya Leoshkevich) - selftests/bpf: Don't rely on preserving volatile in PT_REGS macros in loop3 (Andrii Nakryiko) - scsi: pm80xx: Set phy->enable_completion only when we (Igor Pylypiv) [Orabug: 37159744] {CVE-2024-47666} - Bluetooth: Add more enc key size check (Alex Lu) - usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea) [Orabug: 38792571] {CVE-2025-68327} - usb: renesas_usbhs: Convert to platform remove callback returning void (Uwe Kleine-König) - smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773704] {CVE-2025-68295} - mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773435] {CVE-2025-68227} - mptcp: avoid unneeded subflow-level drops (Paolo Abeni) - selftests: mptcp: join: rm: set backup flag (Matthieu Baerts) - staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann) - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773649] {CVE-2025-68284} - libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773655] {CVE-2025-68285} - drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773664] {CVE-2025-68286} - drm: sti: fix device leaks at component probe (Johan Hovold) - USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang) - USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov) - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman) - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar) [Orabug: 38773671] {CVE-2025-68287} - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792593] {CVE-2025-68331} - usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762730] {CVE-2025-40345} - usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773677] {CVE-2018-1000204,CVE-2025-68288} - usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai) [Orabug: 38773687] {CVE-2025-68289} - usb: cdns3: Fix double resource releasein cdns3_pci_probe (Miaoqian Lin) - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin) - firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli) - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin) - thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski) - drivers/usb/dwc3: fix PCI parent check (Jamie Iles) - dm-verity: fix unreliable memory allocation (Mikulas Patocka) - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde) - can: sja1000: fix max irq loop handling (Thomas Mühlbacher) - atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han) - iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792587] {CVE-2025-68330} - iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet) - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra) - Revert "perf/x86: Always store regs-> ip in perf_callchain_kernel()" (Jiri Olsa) [Orabug: 38893604] - spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou) - mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang) - net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773729] {CVE-2025-68301} - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean) - net: dsa: sja1105: simplify static configuration reload (Russell King) - net: dsa: sja1105: Convert to mdiobus_c45_read (Andrew Lunn) - net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev) - net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino) - net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng) - platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter) - Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz) - can: kvaser_usb: leaf: Fix potential infinite loop in commandparsers (Seungjin Bae) [Orabug: 38773760] {CVE-2025-68308} - Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797] - Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797] - mptcp: do not fallback when OoO is present (Paolo Abeni) - mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730656] {CVE-2025-40257} - mptcp: fix premature close in case of fallback (Paolo Abeni) - mptcp: fix ack generation for fallback msk (Paolo Abeni) - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski) - Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae) - Input: remove third argument of usb_maxpacket() (Vincent Mailhol) - usb: deprecate the third argument of usb_maxpacket() (Vincent Mailhol) - mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen) - selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts) - pmdomain: samsung: plug potential memleak during probe (André Draszik) - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla) - pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin) - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao) [Orabug: 38773509] {CVE-2025-68245} - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin) - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor) - btrfs: fix crash on racing fsync and size-extending write into prealloc (Omar Sandoval) [Orabug: 36774582] {CVE-2024-37354} - btrfs: add helper to truncate inode items when logging inode (Filipe Manana) - Makefile.compiler: replace cc-ifversion with compiler-specific macros (Nick Desaulniers) - tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun) - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon) - ALSA: usb-audio: fixuac2 clock source at terminal parser (René Rebe) - mm/secretmem: fix use-after-free race in fault handler (Lance Yang) [Orabug: 38737039] {CVE-2025-40272} - mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres) - kconfig/nconf: Initialize the default locale at startup (Jakub Horký) - kconfig/mconf: Initialize the default locale at startup (Jakub Horký) - net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit) - selftests: net: use BASH for bareudp testing (Po-Hsu Lin) - scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773426] - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730611,38786193,38788594] {CVE-2025-40248} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730629] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Alejandro Colomar) - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang) - s390/ctcm: Fix double-kfree (Aleksei Nikiforov) - net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730648] {CVE-2025-40254} - net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin) - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan) - drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke) - mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730659,38932997] {CVE-2025-40258} - MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki) - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773440] {CVE-2025-68229} - scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730663] {CVE-2025-40259} - nvme: nvme-fc: Ensure -> ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730673] {CVE-2025-40261} - Input: imx_sc_key - fix memory corruption onunload (Dan Carpenter) - Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730680] {CVE-2025-40263} - be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730689] {CVE-2025-40264} - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang) - mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara) - net/sched: act_connmark: handle errno on tcf_idr_check_alloc (Pedro Tammela) - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [Orabug: 38798907] {CVE-2025-68734} - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara) - EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara) - spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede) - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai) - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai) [Orabug: 38737023] {CVE-2025-40269} - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38737033,38786194,38788587] {CVE-2025-40271} - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [Orabug: 38773495] {CVE-2025-68241} - strparser: Fix signed/unsigned mismatch bug (Nate Karstens) - gcov: add support for GCC 15 (Peter Oberparleiter) - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia) [Orabug: 38737042] {CVE-2025-40273} - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa) - mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter) - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers) - mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592026] {CVE-2025-40040} - bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet) [Orabug: 38773327] {CVE-2025-68200} - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [Orabug: 38737051] {CVE-2025-40275} - NFSv4: Fix an incorrectparameter when calling nfs4_call_sync() (Trond Myklebust) - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [Orabug: 38737060] {CVE-2025-40277} - ASoC: cs4271: Fix regulator leak on probe failure (Xu Wang) - regulator: fixed: fix GPIO descriptor leak on register failure (Xu Wang) - acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue) - Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen) - hsr: Fix supervision frame sending on HSRv0 (Felix Maurer) - net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet) - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman) - net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman) - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N) - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N) [Orabug: 38737072] {CVE-2025-40279} - net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet) - net/sched: act_connmark: transition to percpu stats and rcu (Pedro Tammela) - net: sched: act_connmark: get rid of tcf_connmark_walker and tcf_connmark_search (Zhengchao Shao) - net: sched: act: move global static variable net_id to tc_action_ops (Zhengchao Shao) - wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg) - net: mdio: fix resource leak in mdiobus_register_device() (Csaba Buday) - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38737082,38786195,38788585] {CVE-2025-40280} - net/smc: fix mismatch between CLC header and proposal (D. Wythe) - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet) [Orabug: 38737090] {CVE-2025-40281} - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen) - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen) - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen) -Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [Orabug: 38737103] {CVE-2025-40283} - net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang) - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad) - NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew) - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb) - NFS4: Fix state renewals missing after boot (Joshua Watt) - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov) - compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra) - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik) [Orabug: 38773506] {CVE-2025-68244} - selftests: netdevsim: set test timeout to 10 minutes (Jakub Kicinski) - extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski) - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor) - rtc: rx8025: fix incorrect register reference (Yuta Hayama) - tracing: Fix memory leaks in create_field_var() (Zilin Guan) - bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh Ap) - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [Orabug: 38773282] {CVE-2025-68192} - sctp: Hold sock lock while iterating over address list (Stefan Wiehler) - sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [Orabug: 38747446] {CVE-2025-40331} - sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler) - net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski) - net: dsa: b53: fix enabling ip multicast (Jonas Gorski) - net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski) - net: vlan: sync VLAN features with lower device (Hangbin Liu) - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang) - netdevsim: add Makefile forselftests (David Wei) - selftests/net: use destination options instead of hop-by-hop (Anubhav Singh) - selftests/net: fix GRO coalesce test and add ext header coalesce tests (Richard Gobert) - selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh) - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski) - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer) - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang) - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang) - ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko) - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti) - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [Orabug: 38737181] {CVE-2025-40304} - ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus) - 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry) - cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling) - 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry) - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer) - clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner) - ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre) - rtc: pcf2127: clear minute/second interrupt (Josua Mayer) - um: Fix help message for ssl-non-raw (Tiwei Bie) - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue) - btrfs: mark dirty extent range for out of bound prealloc extents (Austinchang) - RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang) - RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni) - RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni) - RDMA/irdma: Fix SD index calculation (Jacob Moroni) - ACPICA: Update dsmethod.c to get rid of unused variable warning (SaketDumbre) - orangefs: fix xattr related buffer overflow... (Mike Marshall) - page_pool: Clamp pool size to max 16K pages (Dragos Tatulea) - exfat: limit log print for IO error (Chi Zhiling) - ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen) - Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [Orabug: 38737212] {CVE-2025-40308} - Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [Orabug: 38737223] {CVE-2025-40309} - net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun) - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (Chuguangqing) - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari) - nfs4_setup_readdir(): insufficient locking for -> d_parent-> d_inode dereferencing (Al Viro) [Orabug: 38773244] {CVE-2025-68185} - NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos) - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia) - remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold) - sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma) - PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang) - r8169: set EEE speed down ratio to 1 (Chunhao Lin) - net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das) - wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain) - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab) - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko) - jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane) - jfs: Verify inode mode when loading from disk (Tetsuo Handa) - ipv6: np-> rxpmtu race annotation (Eric Dumazet) - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati) - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman) - allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro) - scsi: lpfc: Define size of debugfs entry for xrirebalancing (Justin Tee) - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee) - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee) - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng) - page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski) [Orabug: 38773835] {CVE-2025-68321} - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin) - net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao) - udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari) [Orabug: 38773275] {CVE-2025-68191} - selftests: Replace sleep with slowwait (David Ahern) - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer) - selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern) - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li Rongqing) - netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal) - selftests: traceroute: Use require_command() (Ido Schimmel) - media: redrat3: use int type to store negative error codes (Rong Qianfeng) - net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund) - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch) - phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy) - ntfs3: pretend $Extend records as regular files (Tetsuo Handa) - net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas) - drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco) - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng) - usb: gadget: f_hid: Fix zero length packet transfer (William Wu) - iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra) - net: call cond_resched() less often in __release_sock() (Eric Dumazet) - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000ms (Juraj Šarinay) - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing) - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski) - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski) - dmaengine: dw-edma: Set status for callback_result (Devendra K Verma) - dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev) - dmaengine: sh: setup_xref error handling (Thomas Andreatta) - ptp: Limit time setting of PTP clocks (Miroslav Lichvar) - scsi: pm8001: Use int instead of u32 to store error codes (Rong Qianfeng) - mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski) - mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski) - mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski) - media: fix uninitialized symbol warnings (Chelsy Ratnawat) - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin) - extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski) - scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez) - scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil) - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai) - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim) - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima) - net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch) - char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu) - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (Raub Camaioni) - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi) - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov) - media: imon: make send_packet() more robust (Tetsuo Handa) [Orabug: 38773297] {CVE-2025-68194} - net: ipv6: fix field-spanningmemcpy warning in AH output (Charalampos Mitrodimas) [Orabug: 38773140] {CVE-2025-40363} - bridge: Redirect to backup port when port is administratively down (Ido Schimmel) - powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle) - thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner) - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang) - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov) - drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary) - drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen) - media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart) - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey Mcrae) - selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu) - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu) - PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives) - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab) - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S) - drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar) - drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar) - mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne) - mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann) - mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein) - mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein) - tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown) - tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown) - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar) - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar) - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (Armin Wolf) - uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa) -clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano) - cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki) - tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar) - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel) - nvme-fc: use lock accessing port_state and rport state (Daniel Wagner) [Orabug: 38747531] {CVE-2025-40342} - nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner) [Orabug: 38747538] {CVE-2025-40343} - tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi) - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede) - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg) - power: supply: sbs-charger: Support multiple devices (Fabien Proriol) - hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen) - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede) - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang Song) - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel) - arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook) - cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier) - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière) - ACPI: video: force native for Lenovo 82K8 (Mario Limonciello) - memstick: Add timeout to prevent indefinite waiting (Jiayi Li) - mmc: host: renesas_sdhi: Fix the actual clock (Biju Das) - pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang) - bpf: Don't use %pK through printk (Thomas Weißschuh) - soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh) - spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh) - soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel) - soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen) - block: makeREQ_OP_ZONE_OPEN a write operation (Damien Le Moal) - drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann) [Orabug: 38773123] {CVE-2025-40360} - drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner) - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu) - Revert "docs/process/howto: Replace C89 with C11" (Matthieu Baerts) - arch: back to -std=gnu89 in < v5.18 (Matthieu Baerts) - x86/boot: Compile boot code with -std=gnu11 too (Alexey Dobriyan) - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman) - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman) - xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman) - xhci: dbc: Allow users to modify DbC poll interval via sysfs (Uday M Bhat) - xhci: dbc: poll at different rate depending on data transfer activity (Mathias Nyman) - xhci: dbc: Provide sysfs option to configure dbc descriptors (Mathias Nyman) - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger) - net: phy: dp83867: Disable EEE support as not implemented (Emanuele Ghidoli) - can: gs_usb: increase max interface to U8_MAX (Celeste Liu) - net: ravb: Enforce descriptor type ordering (Lad Prabhakar) - ravb: Exclude gPTP feature support for RZ/G2L (Biju Das) - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang) - serial: 8250_dw: handle reset control deassert error (Artem Shimko) - serial: 8250_dw: Use devm_add_action_or_reset() (Andy Shevchenko) - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal) - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith) - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith) - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang) - net: hns3: return error code when function fails (Jijie Shao) - drm/etnaviv: fix flushsequence logic (Tomeu Vizoso) - usbnet: Prevents free active kevent (Lizhi Xu) [Orabug: 38773783] {CVE-2025-68312} - libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko) - libbpf: Normalize PT_REGS_xxx() macro definitions (Andrii Nakryiko) - riscv, libbpf: Add RISC-V (RV64) support to bpf_tracing.h (Björn Töpel) - bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek) - bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal) [Orabug: 38737284] {CVE-2025-40319} - ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen) - drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen) - wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain) - ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla) - mptcp: restore window probe (Paolo Abeni) - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin) - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs) - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [Orabug: 38737291] {CVE-2025-40321} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [Orabug: 38737300] {CVE-2025-40322} - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [Orabug: 38687004] {CVE-2025-40211} - fbdev: atyfb: Check if pll_ops-> init_pll failed (Daniel Palmer) - net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin) - NFSD: Fix crash in nfsd4_read_release() (Chuck Lever) [Orabug: 38737315] {CVE-2025-40324} - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana) - btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana) - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum) - x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan) - net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [Orabug: 38597084]{CVE-2025-40083} _______________________________________________ El-errata mailing list
Mar 12, 2026
•Important
Oracle
197
security advisorycriticaldebianDebian 11: Advisories for Erlang Resource Leak & Critical Path Issues
Multiple vulnerabilities were fixed in Erlang an concurrent, real-time, distributed functional language. CVE-2025-4748 . ------------------------------------------------------------------------- Debian LTS Advisory DLA-4376-1
Nov 24, 2025
•Critical
Debian LTS
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!