Title of the patch: Security update for the Linux Kernel

---

Description of the patch: The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731). - CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225). - CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629). - CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788). - CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073). - CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004). - CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061). - CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133). - CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619). - CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541). - CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335). - CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587). - CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446). - CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584). - CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788). - CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068). - CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121). - CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897). - CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023). - CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501). - CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238). - CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612). - CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874). - CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860). - CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013). - CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987). - CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004). - CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979). - CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972). - CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113). - CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234). - CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242). - CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). - CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126). - CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114). - CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388). - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655). - CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695). - CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412). - CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783). - CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530). - CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965). - CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969). - CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985). - CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167). - CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635). - CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665). - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306). - CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590). - CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686). - CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381). - CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301). - CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256). - CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774). - CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731) - CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238). - CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579). - CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713). - CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815). - CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090). - CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108). - CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251). - CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111). - CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365). - CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830). - CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230). - CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260). - CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297). - CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182). - CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179). - CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175). - CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429). - CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486). - CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497). - CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569). - CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571). - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385). - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390). - CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423). - CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641). - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877). - CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008). - CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019). - CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662). - CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484). - CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673). - CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028). - CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963). - CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027). - CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868). - CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038). - CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030). - CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734). - CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774). - CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804). - CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831). - CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834). - CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105). - CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882). - CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891). - CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762). - CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766). - CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060). - CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484). - CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983). - CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490). - CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488). - CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516). - CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748). - CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741). - CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262). - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742). - CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745). - CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749). - CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743). - CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346). - CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063). - CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956). - CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957). - CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200). - CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150). - CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210). - CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213). - CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() (bsc#1272799). - CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798). - CVE-2026-64222: octeontx2-pf: avoid double free of pool->stack on AQ init failure (bsc#1272788). - CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786). - CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905). - CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276). - CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058). - CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325). - CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525). - CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975). - CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944). - CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968). - CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028). - CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598). - CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936). - CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958). - CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305). - CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422). - CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868). - CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603). - CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860). - CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291). - CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426). - CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541). - CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539). - CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543). - CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545). - CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061). - CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077). - CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780). - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274). - CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880). - CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277). - CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982). - CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523). - CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273). - CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075). - CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547). - CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289). - CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335). - CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303). - CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311). - CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318). - CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337). - CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813). - CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323). - CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336). - CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340). - CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930). - CVE-2026-64563: rhashtable: clear stale iter->p on table restart (bsc#1273995). - CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006). - CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014). - CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030). - CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031). - CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041). - CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040). - CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497). - CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297). - CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298). - CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580). - CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581). - CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713). - CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876). - CVE-2026-68117: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (bsc#1274881). - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888). - CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169). - CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237). - CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517). - CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553). - CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474). - CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941). - CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578). - CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582). - CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583). - CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584). - CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294). - CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301). - CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303). - CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304). - CVE-2026-68156: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (bsc#1275305). - CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307). - CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470). - CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472). - CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892). - CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930). - CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161). - CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934). - CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704). - CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817). - CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150). - CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970). - CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973). - CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975). - CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976). - CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091). - CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040). - CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088). - CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083). - CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663). - CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665). - CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662). - CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659). - CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656). - CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649). - CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651). - CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646). - CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645). - CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642). - CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644). - CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640). - CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639). - CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629). - CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831). - CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814). - CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898). - CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908). - CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709). - CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696). - CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690). - CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698). - CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706). - CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700). - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274705). - CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800). - CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801). - CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834). - CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500). - CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208). - CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506). - CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961). - CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034). - CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528). - CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155). - CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535). - CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540). - CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523). - CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551). - CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665). - CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669). - CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827). - CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204). - CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678). - CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886). - CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905). - CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923). - CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160). - CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159). - CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925). - CVE-2026-72341: net/mlx5e: Fix publication race for priv->channel_stats[] (bsc#1277660). - CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775). - CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776). - CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869). - CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064). - CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069). - CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057). - CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059). - CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047). - CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037). - CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941). - CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937). - CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943). - CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551). - CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546). - CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542). - CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507). - CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452). - CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446). - CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864). - CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202). - CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr->pd (bsc#1277095). - CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285). - CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408). - CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077). - CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073). - CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335). - CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355). - CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346). - CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350). - CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864). - CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867). - CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946). - CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950). - CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954). - CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797). - CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798). - CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805). - CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687). - CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695). - CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688). - CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696). - CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574). - CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566). - CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569). - CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561). - CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782). - CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784). - CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066). - CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054). - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391). - CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927). - CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625). - CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931). - CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569). - CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561). - CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688). - CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022). - CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275). - CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516). The following non security issues were fixed: - accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes). - accessibility: speakup: unregister tty ldisc on later init failures (git-fixes). - ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes). - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes). - ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes). - ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes). - ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes). - ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes). - ACPI: video: Release PCI device reference after lookup (git-fixes). - add my missing Reviewed-by: tag. - ALSA: 6fire: bound the MIDI event length from the device (git-fixes). - ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes). - ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes). - ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes). - ALSA: dummy: Check card index validity at probe (stable-fixes). - ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes). - ALSA: hda: Fix connection list comparison in proc output (git-fixes). - ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes). - ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes). - ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes). - ALSA: seq: midi: Serialize input teardown with event_input (git-fixes). - ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes). - ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes). - ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes). - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes). - ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes). - ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes). - apparmor: advertise the tcp fast open fix is applied (git-fixes). - ASoC: adau1761: sort the register default table (git-fixes). - ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes). - ASoC: apple: mca: increase SERDES reset delay (git-fixes). - ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes). - ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes). - ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes). - ASoC: cs35l41: sort the register default table (git-fixes). - ASoC: cs35l45: sort the register default table (git-fixes). - ASoC: cs4265: sort the register default table (git-fixes). - ASoC: cx2072x: sort the register default table (git-fixes). - ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes). - ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes). - ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes). - ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes). - ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes). - ASoC: fsl_easrc: sort the register default table (git-fixes). - AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes). - ASoC: max9860: sort the register default table (git-fixes). - ASoC: meson: Keep link pointers valid on realloc failure (git-fixes). - ASoC: ml26124: sort the register default table (git-fixes). - ASoC: pcm512x: sort the register default table (git-fixes). - ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes). - ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes). - ASoC: rt274: sort the register default table (git-fixes). - ASoC: rt286: sort the register default table (git-fixes). - ASoC: rt298: sort the register default table (git-fixes). - ASoC: rt700-sdw: always drain jack work on remove (git-fixes). - ASoC: rt700: drop duplicate reg_default entry (git-fixes). - ASoC: rt700: sort the register default table (git-fixes). - ASoC: rt711-sdca: sort the register default tables (git-fixes). - ASoC: rt711: sort the register default table (git-fixes). - ASoC: rt712-sdca-dmic: sort the register default table (git-fixes). - ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes). - ASoC: rt715-sdca: sort the register default tables (git-fixes). - ASoC: rt715: sort the register default table (git-fixes). - ASoC: rt1316-sdw: sort the register default table (git-fixes). - ASoC: rt1318-sdw: sort the register default table (git-fixes). - ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes). - ASoC: sgtl5000: sort the register default table (git-fixes). - ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes). - ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes). - ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes). - ASoC: SOF: validate topology volume range before allocation (git-fixes). - ASoC: sti-sas: sort the register default table (git-fixes). - ASoC: tas2552: sort the register default table (git-fixes). - ASoC: tas2764: sort the register default table (git-fixes). - ASoC: tas2780: sort the register default table (git-fixes). - ASoC: tegra210_i2s: sort the register default table (git-fixes). - ASoC: tegra210_mixer: sort the register default table (git-fixes). - ASoC: tegra: Fix the MIXER enable default value (git-fixes). - ASoC: tegra: Sort MBDRC register defaults (git-fixes). - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes). - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes). - batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes). - batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes). - batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes). - batman-adv: fix stale receive device on merged fragments (git-fixes). - Bluetooth: btintel: Fix diagnostics event detection (git-fixes). - Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes). - Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes). - Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes). - Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes). - Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes). - Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes). - Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes). - Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes). - Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes). - Bluetooth: hci_event: fix LE list UAF on reset (git-fixes). - Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes). - Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes). - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes). - Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes). - Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes). - Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes). - Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes). - Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes). - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes). - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes). - Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes). - bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes). - bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes). - bus: ti-sysc: Fix /chosen node reference leak (git-fixes). - cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes). - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes). - crypto: aspeed - Propagate platform_get_irq() errors (git-fixes). - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes). - crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes). - crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes). - crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes). - crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes). - crypto: doc - Remove extra parenthesis (git-fixes). - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes). - crypto: keembay - Initialize completion before requesting IRQ (git-fixes). - crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes). - crypto: mxs-dcp - fix source scatterlist length access (git-fixes). - crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes). - crypto: qat - clear AES key schedule from stack (git-fixes). - crypto: qce - fix CCM AAD buffer underallocation (git-fixes). - crypto: qce - fix error path in devm_qce_register_algs (git-fixes). - crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes). - crypto: sa2ul - stop probe if context pool creation fails (git-fixes). - crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes). - device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes). - dmaengine: dw-edma: Clear stale requests on termination (git-fixes). - dmaengine: dw-edma: Complete descriptors before pausing (git-fixes). - dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes). - dmaengine: dw-edma: Serialize abort state updates (git-fixes). - dmaengine: dw-edma: Serialize channel state checks (git-fixes). - dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes). - dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes). - dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes). - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes). - dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes). - driver core: soc: Unregister bus on early device registration failure (git-fixes). - drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes). - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes). - drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes). - drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes). - drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes). - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes). - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes). - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes). - drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes). - drm/amdgpu: check ASPM on the dGPU host link (git-fixes). - drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes). - drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes). - drm/amdgpu: fix autosuspend cleanup during removal (git-fixes). - drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes). - drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes). - drm/amdgpu: Fix UVD min buffer sizes (stable-fixes). - drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes). - drm/amdgpu: Implement insert_end for VCE 3 (git-fixes). - drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes). - drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes). - drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes). - drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes). - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes). - drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes). - drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes). - drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes). - drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes). - drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes). - drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes). - drm/connector: Fix epoch_counter docs to reflect reality (git-fixes). - drm/hibmc: Fix list of formats on the primary plane (git-fixes). - drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes). - drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes). - drm/lima: call drm_mm_init() with a valid allocation range (git-fixes). - drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes). - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes). - drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes). - drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes). - drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes). - drm/radeon: fix autosuspend cleanup during teardown (git-fixes). - drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes). - drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes). - drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes). - drm/sun4i: crtc: Propagate layer initialization error (git-fixes). - drm/sun4i: Drop node references while building component list (git-fixes). - drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes). - drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes). - drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes). - drm/sun4i: tcon: Drop remote endpoint reference (git-fixes). - drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes). - drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes). - drm/sun4i: vi scaler: Fix coefficient selection (git-fixes). - drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes). - drm/tve200: add OF module alias for autoloading (git-fixes). - drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes). - drm: lcdif: Wait for vblank before disabling DMA (git-fixes). - drm: Remove unused header in drm_dumb_buffers.c (git-fixes). - ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes). - fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes). - fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes). - fbdev: kyro: Validate overlay viewport coordinates (git-fixes). - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes). - fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes). - fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes). - fbdev: uvesafb: unregister connector callback on init failure (git-fixes). - firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes). - firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes). - firmware: arm_scmi: Fix requested device removal race (git-fixes). - firmware: arm_scmi: Free transport channel on IDR failure (git-fixes). - firmware: arm_scmi: Protect device request lookup with RCU (git-fixes). - firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes). - firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes). - firmware: arm_scmi: Use channel ID for transport teardown (git-fixes). - firmware_loader: do not queue completed sysfs fallback requests (git-fixes). - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes). - fpga: dfl: fme: add error handling (git-fixes). - fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes). - gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes). - gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes). - HID: core: fix number/pointer type confusion on long items (git-fixes). - HID: core: fix OOB read of field->usage in hid_set_field() (git-fixes). - HID: hyperv: validate initial device info bounds (git-fixes). - HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes). - HID: lg4ff: validate report length before fixed offsets (git-fixes). - HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes). - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes). - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes). - HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes). - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes). - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes). - HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes). - HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes). - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes). - HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes). - HID: roccat: bound device-supplied profile index (git-fixes). - HID: roccat: free buffered reports when destroying device (git-fixes). - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes). - HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes). - HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes). - HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes). - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes). - hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes). - hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes). - hwmon: (max6621) fix temperature clamp range (git-fixes). - hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes). - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes). - hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes). - hwrng: omap - Fix probe error path cleanup (git-fixes). - hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes). - i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes). - i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes). - i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes). - i2c: mux: Fix channel node leak on adapter add failure (git-fixes). - i2c: ocores: Disable clock on failed resume (git-fixes). - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes). - i3c: master: Fix device_register() error path (git-fixes). - i3c: master: Fix info leak and UAF in device unregister path (git-fixes). - i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes). - ibmvnic: Only record tx completed bytes once per handler (bsc#1274620). - iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes). - iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes). - iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes). - iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes). - iio: dac: m62332: Fix regulator reference count imbalance (git-fixes). - iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes). - iio: light: cm32181: return zero after writing calibscale (git-fixes). - iio: light: gp2ap002: Disable regulators on resume failure (git-fixes). - iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes). - iio: light: isl29028: return zero in write_raw() on success (git-fixes). - iio: light: tsl2583: return zero in write_raw() on success (git-fixes). - iio: light: tsl2772: fix ALS calibscale readback (git-fixes). - iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes). - iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes). - iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes). - iio: srf04: fix pm_runtime handling on probe error path (git-fixes). - iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes). - Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes). - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes). - Input: evdev - fix information leak in evdev_pass_values() (stable-fixes). - Input: evdev - sanitize event type index when fetching event masks (stable-fixes). - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes). - Input: focaltech - use signed coordinates to prevent underflow (git-fixes). - Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes). - Input: iforce - validate input packet lengths (stable-fixes). - Input: iqs5xx - validate firmware record destination span (git-fixes). - Input: mms114 - fix Y-resolution configuration (git-fixes). - Input: psxpad-spi - set driver data before use (git-fixes). - Input: sur40 - fix input device registration ordering (stable-fixes). - Input: sur40 - fix V4L error path cleanup (stable-fixes). - Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes). - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes). - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes). - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes). - Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes). - Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes). - interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes). - ipmi: ipmb: validate write message length (git-fixes). - ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes). - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes). - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes). - leds: pca9532: Fix inverted GPIO output polarity (git-fixes). - leds: pca9532: Fix phantom device registration on missing hardware (git-fixes). - lib/string: fix memchr_inv() for large ranges (git-fixes). - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes). - mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes). - mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes). - maple_tree: fix argument name in header (git-fixes). - md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261). - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes). - media: cec-pin: Fix event FIFO ordering (git-fixes). - media: cec: disable delayed work before freeing an interrupted transmit (git-fixes). - media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes). - media: cec: Serialize exclusive follower delivery (git-fixes). - media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes). - media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes). - media: cobalt: Avoid freeing ALSA private data twice (git-fixes). - media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes). - media: cx23885: cancel NetUP CI work before teardown (git-fixes). - media: em28xx: defer audio-only extension registration (git-fixes). - media: em28xx: fix use-after-free of dev_next->devlist on disconnect (git-fixes). - media: go7007: defer the ALSA v4l2 put until card release (git-fixes). - media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes). - media: i2c: ov7740: fix use-after-destroy in remove (git-fixes). - media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes). - media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes). - media: mc-entity: Add missing kerneldoc (git-fixes). - media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes). - media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes). - media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes). - media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes). - media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes). - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes). - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes). - media: s2255: bound JPEG frame size before copying into the buffer (git-fixes). - media: s2255: check firmware size before reading trailing marker (git-fixes). - media: saa7164: fix cleanup on resource allocation failure (git-fixes). - media: tda18250: fix possible integer overflow (git-fixes). - media: usbtv: keep device alive while ALSA card exists (git-fixes). - media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes). - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes). - media: venus: fix payload size calculation in parse_raw_formats() (git-fixes). - media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes). - media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes). - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes). - media: vimc: fix pixel format lookup in enum_framesizes (git-fixes). - media: zoran: Avoid freeing a registered video_device twice (git-fixes). - mei: pull kvfree out of spinlock (git-fixes). - mfd: iqs62x: Reject zero-length firmware records (git-fixes). - mfd: rave-sp: validate received frame payload lengths (git-fixes). - misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes). - misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes). - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes). - misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes). - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (git-fixes). - misc: rtsx: add missing write register handling (git-fixes). - misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes). - mkspec-dtb: Move DTS prefix into package list. - mkspec-dtb: Move provides-obsoletes to package list. - mkspec-dtb: Put per-architecture package lists into a hash. - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes). - mmc: sdhci: unmap the bounce buffer before device release (git-fixes). - mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes). - mtd: afs: validate v2 image info bounds (git-fixes). - mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes). - mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes). - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes). - mtd: rawnand: validate ONFI extended parameter page sections (git-fixes). - net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes). - net: mana: Add handler for sriov configure (bsc#1272756). - net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes). - net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes). - net: mana: Fall back to scattered pages for GDMA queues (git-fixes). - net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792). - net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792). - net: mana: Route ring-buffer access through offset-based helpers (git-fixes). - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550). - net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes). - net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes). - net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes). - net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes). - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes). - net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes). - nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes). - nfc: digital: Do not dump a NULL response in command completion (git-fixes). - nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes). - nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes). - nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes). - nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes). - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes). - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (git-fixes). - nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes). - nfc: microread: validate target discovery payload lengths (git-fixes). - nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes). - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes). - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes). - nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes). - nfc: nci: free destination parameters when closing a connection (git-fixes). - nfc: pn533: hold a reference to the request skb during send_frame (git-fixes). - nfc: pn533: purge fragmented skbs during cleanup (git-fixes). - nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes). - nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes). - PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes). - PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes). - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes). - PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes). - PCI: meson: Fix GPIO state while requesting PERST# (git-fixes). - phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes). - phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes). - phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes). - phy: sunplus: fix error handling in sp_uphy_init() (git-fixes). - pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes). - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes). - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes). - pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes). - pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes). - platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes). - platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes). - platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes). - platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes). - platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes). - platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes). - platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes). - platform/surface: acpi-notify: Check ACPI companion before use (git-fixes). - platform/x86: dell-privacy: Fix race condition (git-fixes). - platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes). - platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes). - platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes). - platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes). - platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes). - platform/x86: ISST: Validate level in perf mask ioctls (git-fixes). - platform/x86: ISST: Validate logical CPU id and clos id (git-fixes). - platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes). - PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes). - power: supply: bd99954: Drop bad register fields (git-fixes). - power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes). - power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes). - power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes). - power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes). - power: supply: bq24257: fix use-after-free on remove (git-fixes). - power: supply: bq25890: Fix power_supply reference leak (git-fixes). - power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes). - power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes). - power: supply: isp1704_charger: cancel work on remove (git-fixes). - power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes). - power: supply: max17040: drop incorrect I2C functionality check (git-fixes). - power: supply: max17040: synchronize work cancellation on suspend (git-fixes). - power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes). - power: supply: rt9455: quiesce delayed work before teardown (git-fixes). - power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes). - power: supply: twl4030_charger: cancel workers via devm (git-fixes). - power: supply: ucs1002: fix use-after-free on remove (git-fixes). - powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes). - powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash (bsc#1271256). - powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752 ltc#221290). - powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283). - ppdev: prevent overflow when setting port timeout (git-fixes). - qede: fix out-of-bounds check for cqe->len_list (git-fixes). - rapidio: clear mport->net when rio_add_net() fails (git-fixes). - rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes). - RDMA/irdma: Remove redundant legacy_mode checks (git-fixes). - RDMA/mana_ib: drain QP references after partial table insertion (git-fixes). - RDMA/mana_ib: unify QP lookup table (git-fixes). - RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes). - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes). - regulator: core: use system_freezable_wq for init complete work (git-fixes). - regulator: devres: add API for reference voltage supplies (stable-fixes). - regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes). - regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes). - regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes). - remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (git-fixes). - remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes). - remoteproc: scp: Fix device reference leak on failed lookup (git-fixes). - Revert "drm/amdgpu: fix aperture mapping leak" (git-fixes). - Revert "media: v4l2-dev: fix error handling in __video_register_device()" (git-fixes). - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" (stable-fixes). - rpmsg: core: Fix incorrect return value documentation (git-fixes). - rpmsg: glink: smem: order FIFO read after availability check (git-fixes). - rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes). - rtc: pcf8563: fix clock provider leak on unbind (git-fixes). - rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes). - rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes). - rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes). - rtc: zynqmp: Return optional clock lookup errors (git-fixes). - scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes). - sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes). - serial: 8250_dma: Clear stale RX state on shutdown (git-fixes). - serial: amba-pl011: unprepare console clock on unregister (git-fixes). - serial: core: clear freed pointers on uart_register_driver() failure (git-fixes). - serial: qcom-geni: fix TX DMA buffer flush (git-fixes). - serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes). - smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902). - smb: client: reject overlapping data areas in SMB2 responses (git-fixes). - smb: client: require net admin for CIFS SWN netlink (bsc#1273966). - smb: client: resolve SWN tcon from live registrations (bsc#1273872). - soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes). - soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes). - soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes). - software node: Fix software_node_get_reference_args() with index -1 (git-fixes). - soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes). - speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes). - spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes). - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes). - spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes). - staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes). - staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes). - staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes). - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes). - staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes). - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes). - staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes). - staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes). - staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes). - staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes). - thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes). - thermal/drivers/qoriq: Disable clock on resume failure (git-fixes). - thermal: intel: int3400: clean up ODVP on probe failures (git-fixes). - thunderbolt: Bound the DROM dual link port number before indexing sw->ports (git-fixes). - thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes). - tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes). - tpm: st33zp24: Return zero on status read failure (git-fixes). - tpm: st33zp24: Validate locality read result (git-fixes). - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes). - tty: clear cdev pointer after cdev_add() failure (git-fixes). - tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes). - tty: skip cdev_del() when no cdev is registered (git-fixes). - uio: Fix stale info pointer in failed registration path (git-fixes). - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes). - usb: atm: usbatm: fix invalid ci_range initialization (git-fixes). - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes). - usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes). - usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes). - usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes). - usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes). - usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes). - usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes). - usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes). - usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes). - usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes). - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes). - usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes). - usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes). - usb: gadget: uac: validate rate list length before storing (git-fixes). - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes). - usb: mtu3: allow system suspend during active gadget connection (git-fixes). - usb: musb: omap2430: clean up probe error handling (stable-fixes). - USB: phy: fsl-usb: fix missing static keywords (git-fixes). - usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes). - USB: serial: digi_acceleport: fix port registration order (git-fixes). - USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes). - USB: serial: option: add TDTECH MT5710-CN (stable-fixes). - USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes). - USB: serial: spcp8x5: drop broken carrier detect support (git-fixes). - USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes). - usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes). - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes). - usb: xhci: Handle USB3 port events when there is one roothub (git-fixes). - vt: add permission check for KDSKBMETA ioctl (stable-fixes). - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes). - w1: ds28e17: reject an oversize length on an I2C block read (git-fixes). - w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes). - wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes). - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes). - wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes). - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes). - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes). - wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes). - wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes). - wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes). - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes). - wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes). - wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes). - wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes). - wifi: iwlwifi: mei: pass correct argument to function (git-fixes). - wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes). - wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes). - wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes). - wifi: mac80211: skip unused probe response countdown offsets (git-fixes). - wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes). - wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes). - wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes). - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes). - wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes). - wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes). - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes). - wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes). - wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes). - wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes). - wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes). - wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes). - wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes). - wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes). - wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes). - wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes). - wifi: mt76: mt7921: validate CLC firmware records (git-fixes). - wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes). - wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes). - wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes). - wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes). - wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes). - wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes). - wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes). - wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes). - wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes). - wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes). - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes). - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes). - wifi: rtw89: fix HE extended capability length check (git-fixes). - wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes). - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes). - xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes). - xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).

---

Patchnames: SUSE-SLE-Micro-6.0-kernel-601

---

Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).