SUSE-SU-2026:4706

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538). - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408). - CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474). - CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602). - CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747). - CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410). - CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735). - CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464). - CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373). - CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648). - CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848). - CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985). - CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000). - CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685). - CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816). - CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817). - CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906). - CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572). - CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426). - CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890). - CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473). - CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471). - CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971). - CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847). - CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782). - CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879). - CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750). - CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059). - CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759). - CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145). - CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215). - CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899). - CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793). - CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953). - CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870). - CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938). - CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976). - CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339). - CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420). - CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889). - CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776). - CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258). - CVE-2026-64405: Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync (bsc#1273512). - CVE-2026-64425: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (bsc#1273522). - CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320). - CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316). - CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319). - CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245). - CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999). - CVE-2026-64528: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (bsc#1272847). - CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309). - CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251). - CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036). - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037). - CVE-2026-64589: i2c: core: fix hang on adapter registration failure (bsc#1274494). - CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730). - CVE-2026-68128: ice: reject out-of-range ptype in ice_parser_profile_init (bsc#1275238). - CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094). - CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890). - CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588). - CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803). - CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866). - CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142). - CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137). - CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129). - CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977). - CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092). - CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637). - CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836). - CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824). - CVE-2026-68395: ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (bsc#1274900). - CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776). - CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838). - CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287). - CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295). - CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388). - CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504). - CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495). - CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783). - CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840). - CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852). - CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865). - CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793). - CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923). - CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078). - CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801). - CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803). - CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814). - CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818). - CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821). - CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249). - CVE-2026-72063: gpio: tegra: do not call pinctrl for GPIO direction (bsc#1277148). - CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149). - CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153). - CVE-2026-72085: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (bsc#1275542). - CVE-2026-72086: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (bsc#1277179). - CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543). - CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314). - CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321). - CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349). - CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350). - CVE-2026-72125: can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER (bsc#1277535). - CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545). - CVE-2026-72130: nvmet: Introduce nvmet_req_transfer_len() (bsc#1275549). - CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571). - CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574). - CVE-2026-72138: xen/gntdev: fix error handling in ioctl (bsc#1277235). - CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234). - CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544). - CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233). - CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231). - CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553). - CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556). - CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218). - CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217). - CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215). - CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615). - CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655). - CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656). - CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662). - CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674). - CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728). - CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738). - CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924). - CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748). - CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143). - CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972). - CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985). - CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761). - CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764). - CVE-2026-72337: Bluetooth: 6lowpan: avoid untracked enable work (bsc#1277773). - CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006). - CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783). - CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007). - CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784). - CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822). - CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009). - CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823). - CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818). - CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857). - CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128). - CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381). - CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553). - CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031). - CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035). - CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122). - CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023). - CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120). - CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053). - CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054). - CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056). - CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245). - CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874). - CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115). - CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876). - CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114). - CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100). - CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109). - CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108). - CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108). - CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113). - CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092). - CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229). - CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767). - CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766). - CVE-2026-72491: net/9p: fix race condition on rdma->state in trans_rdma.c (bsc#1276947). - CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547). - CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535). - CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532). - CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538). - CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528). - CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (bsc#1276519). - CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508). - CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512). - CVE-2026-74278: ALSA: seq: Fix kernel heap address leak in bounce_error_event() (bsc#1278132). - CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474). - CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473). - CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475). - CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468). - CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs (bsc#1276471). - CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460). - CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461). - CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462). - CVE-2026-74302: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (bsc#1276445). - CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905). - CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880). - CVE-2026-74310: vhost/net: complete zerocopy ubufs only once (bsc#1276891). - CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876). - CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866). - CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129). - CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155). - CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180). - CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063). - CVE-2026-74359: configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067). - CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070). - CVE-2026-74365: kabi: nvdimm/btt: handling (bsc#1278225). - CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649). - CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401). - CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236). - CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233). - CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240). - CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405). - CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255). - CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098). - CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253). - CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087). - CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088). - CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091). - CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098). - CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410). - CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395). - CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564). - CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210). - CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211). - CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215). - CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216). - CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178). - CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070). - CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801). - CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805). - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792). - CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781). - CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340). - CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339). - CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341). - CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354). - CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353). - CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892). - CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349). - CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352). - CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337). - CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338). - CVE-2026-74513: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (bsc#1275956). - CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953). - CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802). - CVE-2026-74533: replace additional lock in hci_conn with a common spinlock (bsc#1275804). - CVE-2026-74534: Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths (bsc#1275801). - CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (bsc#1275812). - CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799). - CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682). - CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681). - CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694). - CVE-2026-74551: hwmon: (nzxt-smart2) DMA-align output buffer (bsc#1275680). - CVE-2026-74553: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (bsc#1275684). - CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690). - CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685). - CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567). - CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559). - CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885). - CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820). - CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766). - CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904). - CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900). - CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843). - CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910). - CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493). - CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918). - CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640). - CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896). - CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915). - CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796). - CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906). - CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505). - CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901). - CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813). - CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862). - CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036). - CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191). - CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195). - CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199). - CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371). - CVE-2026-74637: perf: Fix dangling cgroup pointer in cpuctx (bsc#1277372). - CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374). - CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296). - CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272). - CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311). - CVE-2026-74665: net: fix skb length accounting after generic XDP frag adjustment (bsc#1277407). - CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032). - CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396). - CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392). - CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489). - CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314). - CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930). - CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897). - CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626). - CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921). - CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922). - CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579). - CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570). - CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573). - CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() (bsc#1276572). - CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563). - CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565). - CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030). - CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898). - CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247). - CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908). - CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094). - CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315). - CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590). - CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268). - CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294). - CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342). - CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328). - CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335). - CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293). - CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205). - CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308). - CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558). - CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513). - CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331). - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335). - CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555). - CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324). - CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557). - CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416). - CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245). - CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395). - CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561). - CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840). - CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837). - CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn (bsc#1277845). - CVE-2026-80722: wifi: mac80211: validate individual TWT params before driver setup (bsc#1277860). - CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452). - CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716). - CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487). - CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733). - CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536). - CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708). - CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590). - CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619). - CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621). - CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799). - CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811). - CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580). - CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819). - CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875). - CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835). - CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888). - CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786). - CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878). - CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850). - CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581). - CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532). - CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535). - CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525). - CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527). - CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497). - CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422). - CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143). - CVE-2026-80947: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (bsc#1280239). - CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298). - CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299). - CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296). - CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309). - CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263). - CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375). - CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379). - CVE-2026-89451: iommu/sva: Set handle->dev before the SVA handle is visible (bsc#1280383). - CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384). - CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338). - CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786). - CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449). - CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451). - CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350). - CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456). - CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544). - CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551). - CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508). - CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288). - CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738). - CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985). - CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993). - CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711). - CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716). - CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717). - CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719). - CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388). - CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387). - CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758). - CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548). - CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546). - CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726). - CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727). - CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797). - CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733). - CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577). - CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923). - CVE-2026-89609: ecryptfs: hold msg ctx list lock when cleaning daemon queue (bsc#1281793). - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496). - CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042). - CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046). - CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054). - CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509). - CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518). - CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057). - CVE-2026-89671: nfsd: gate nfs3 setacl by argp->mask (bsc#1280252). - CVE-2026-89672: nfsd: gate nfs2 setacl by argp->mask (bsc#1280235). - CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237). - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243). - CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206). - CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178). - CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184). - CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151). - CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146). - CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148). - CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077). - CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487). - CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490). - CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468). - CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455). - CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870). - CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872). - CVE-2026-89780: net: qualcomm: rmnet: restore skb->dev on deaggregated frames (bsc#1280969). - CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224). - CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226). - CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383). - CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201). - CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202). - CVE-2026-89929: KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (bsc#1281358). - CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359). - CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427). - CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229). - CVE-2026-89970: nvmet-auth: Synchronize timeout work during SQ teardown (bsc#1281231). - CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273). - CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295). - CVE-2026-90047: drm/xe: Don't hand out the flat CCS storage as usable VRAM (bsc#1280927). - CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660). - CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496). - CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397). - CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514). - CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546). - CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955). - CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599). - CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644). - CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964). - CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818). - CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808). - CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795). - CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717). - CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683). - CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682). - CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845). - CVE-2026-90255: Bluetooth: hci_conn: fix the SCO setup context lifetime (bsc#1281694). - CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680). - CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922). - CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054). - CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777). - CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778). - CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732). - CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050). - CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786). - CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789). - CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825). - CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197). - CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113). - CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110). - CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143). - CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973). - CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013). - CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003). - CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993). - CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072). - CVE-2026-92500: ext4: use fsdata to track inline data write state and fix race (bsc#1282193). - CVE-2026-92503: ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (bsc#1282383). - CVE-2026-92507: RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (bsc#1281988). - CVE-2026-92508: RDMA/core: Fix potential use after free in ib_free_cq() (bsc#1282034). - CVE-2026-92509: RDMA/core: Fix potential use after free in counter_release() (bsc#1282040). - CVE-2026-92510: RDMA/core: Fix potential use after free in ib_destroy_srq_user() (bsc#1282041). - CVE-2026-92511: RDMA/core: Fix potential use after free in ib_destroy_cq_user() (bsc#1282042). - CVE-2026-92512: RDMA/core: Fix use after free in ib_query_qp() (bsc#1281995). - CVE-2026-92514: RDMA/erdma: Fix CEQ tasklet use-after-free on removal (bsc#1281997). - CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271). - CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (bsc#1282270). - CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020). - CVE-2026-93102: RDMA/hfi1: Free RX data on late probe failure (bsc#1282170). - CVE-2026-93103: RDMA/hfi1: Preserve unit 0 on (bsc#1282286). - CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284). - CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399). - CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408). - CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379). - CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387). - CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104). - CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672). - CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774). - CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812). - CVE-2026-93269: ext4: fix circular lock dependency in ext4_ext_migrate (bsc#1282810). - CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906). - CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154). - CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213). - CVE-2026-93813: btrfs: tree-checker: validate INODE_REF's namelen (bsc#1282767). - CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891). - CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803). - CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975). - CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176). - CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230). - CVE-2026-97505: PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (bsc#1283500). - CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201). - CVE-2026-97934: tracing: Fix memory corruption from a 'STACKTRACE' histogram key (bsc#1282997). - CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163). - CVE-2026-97947: x86/amd_node: Fix potential NULL pointer dereference (bsc#1283130). - CVE-2026-97950: configfs: pin the symlink target's dirent instead of chasing ->ci_dentry (bsc#1283121). - CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312). - CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489). - CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973). - CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805). - CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935). - CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881). The following non security issues were fixed: - accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (git-fixes). - accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes). - ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes). - ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes). - ACPICA: add boundary checks in two places (stable-fixes). - ACPICA: Add package limit checks in parser functions (stable-fixes). - ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes). - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes). - ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes). - ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes). - ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes). - ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes). - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes). - ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes). - ACPICA: Prevent adding invalid references (stable-fixes). - ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes). - ACPICA: validate handler object type in two places (stable-fixes). - ALSA: 6fire: Clean ups with guard() (stable-fixes). - ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes). - ALSA: aloop: Check card index validity at probe (stable-fixes). - ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes). - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes). - ALSA: caiaq: Fix potential double-free at error path (git-fixes). - ALSA: caiaq: unregister the input device when probe fails (git-fixes). - ALSA: core: Add scoped cleanup helper for card references (stable-fixes). - ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes). - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes). - ALSA: dummy: Report a change when one capture switch channel moves (git-fixes). - ALSA: es18xx: check control allocation before private data setup (stable-fixes). - ALSA: harmony: initialize locks before requesting IRQ (git-fixes). - ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes). - ALSA: hda/common: Use guard() for mutex locks (stable-fixes). - ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes). - ALSA: hda/core: Use guard() for mutex locks (stable-fixes). - ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes). - ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes). - ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes). - ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes). - ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes). - ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes). - ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes). - ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes). - ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes). - ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes). - ALSA: hda: Report a change when only the channel status bytes move (git-fixes). - ALSA: hda: restore MFG widget enumeration after core split (git-fixes). - ALSA: hda: trace PCM open only after assigning a stream (git-fixes). - ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes). - ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes). - ALSA: line6: reject oversized playback packets (git-fixes). - ALSA: mpu401: Check card index validity at probe (stable-fixes). - ALSA: mts64: Check card index validity at probe (stable-fixes). - ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes). - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes). - ALSA: pcm: set timer->private_data before registering the PCM timer (git-fixes). - ALSA: portman2x4: Check card index validity at probe (stable-fixes). - ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes). - ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes). - ALSA: seq: Serialize compat port-info ioctls (git-fixes). - ALSA: serial-u16550: Check card index validity at probe (stable-fixes). - ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes). - ALSA: ump: Copy FB name string more safely (stable-fixes). - ALSA: ump: Copy safe string name to rawmidi (stable-fixes). - ALSA: ump: Update rawmidi name per EP name update (stable-fixes). - ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes). - ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes). - ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes). - ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes). - ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes). - ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes). - ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices (git-fixes). - ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes). - ALSA: usb-audio: Propagate write errors in generic mixer put callbacks (stable-fixes). - ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes). - ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes). - ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes). - ALSA: virmidi: Check card index validity at probe (stable-fixes). - ALSA: virtio: reset device before deleting virtqueues (git-fixes). - Also reflect disabled BATMAN in supported.conf Fixes: 4058797e93cc ('Disable CONFIG_BATMAN_ADV (jsc#PED-16892)'). - arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes). - arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes). - arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes). - arm64: percpu: Fix this_cpu_and() mask generation (git-fixes). - arm64: percpu: Fix this_cpu_write() casting (git-fixes). - arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes). - ASoC: ab8500: Correct digital interface format setup (git-fixes). - ASoC: ab8500: Repair the DAPM capture graph (git-fixes). - ASoC: ab8500: Reset the audio block before configuring it (git-fixes). - ASoC: ab8500: Validate and program TDM slots correctly (git-fixes). - ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes). - ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes). - ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes). - ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes). - ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes). - ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes). - ASoC: codecs: max98363: fix uninitialized stream_config->type (git-fixes). - ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes). - ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes). - ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes). - ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes). - ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type (git-fixes). - ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type (git-fixes). - ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes). - ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes). - ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes). - ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology (git-fixes). - ASoC: Intel: avs: Fix unbalanced module reference count (git-fixes). - ASoC: Intel: catpt: Complete coredump handling (stable-fixes). - ASoC: Intel: SST: Publish the PCI module aliases (git-fixes). - ASoC: mt6351: Publish the OF module alias (git-fixes). - ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes). - ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes). - ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes). - ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes). - ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes). - ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes). - ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes). - ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes). - ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes). - ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes). - ASoC: ux500: Correct MSP frame and bit clock setup (git-fixes). - ASoC: ux500: Fix MSP stream lifecycle handling (git-fixes). - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes). - ASoC: ux500: Program the MSP FIFO watermarks (git-fixes). - ASoC: ux500: Propagate MSP setup errors (git-fixes). - ASoC: ux500: Request the MSP MMIO resource (git-fixes). - ASoC: ux500: Validate MSP DAI configuration (git-fixes). - ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes). - ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes). - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes). - Bluetooth: btintel: bound firmware ID by TLV length (git-fixes). - Bluetooth: btintel: Export few static functions (stable-fixes). - Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config (git-fixes). - Bluetooth: btintel: Print firmware SHA1 (stable-fixes). - Bluetooth: btintel: validate version TLV value lengths (git-fixes). - Bluetooth: btintel_pcie: Clear automask on spurious interrupts (git-fixes). - Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes). - Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (git-fixes). - Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes). - Bluetooth: btintel_pcie: validate packet_len before skb_put_data (git-fixes). - Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (git-fixes). - Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes). - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes). - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes). - Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes). - Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes). - Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes). - Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes). - Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes). - Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes). - Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes). - Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes). - Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes). - Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes). - Bluetooth: btusb: refactor endpoint lookup (stable-fixes). - Bluetooth: coredump: Quiesce dump work on unregister (git-fixes). - Bluetooth: eir: validate service data length before reading UUID (git-fixes). - Bluetooth: hci_codec: validate vendor codec count length (git-fixes). - Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes). - Bluetooth: hci_core: Fix race condition during device registration (git-fixes). - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes). - Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes). - Bluetooth: hci_sock: validate event length before filtering (git-fixes). - Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes). - Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes). - Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes). - Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes). - Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes). - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes). - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes). - Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (git-fixes). - Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes). - Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes). - Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes). - Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes). - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes). - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO (git-fixes). - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes). - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes). - Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes). - bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes). - bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes). - bnxt_en: use irq_update_affinity_hint() (bsc#1280750). - bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823). - bus: fsl-mc: wait for the MC firmware to complete its boot (stable-fixes). - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes). - char/nvram: Remove redundant nvram_mutex (stable-fixes). - compiler_types: Introduce __flex_counter() and family (bsc#1280139). - default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139). - dm/amdgpu: fix malformed link_settings debugfs output (git-fixes). - dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes). - dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes). - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes). - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes). - dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes). - dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes). - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes). - dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes). - dmaengine: wait for RCU readers before releasing dma_device (git-fixes). - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes). - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes). - driver core: Better advertise dev_err_probe() (stable-fixes). - driver core: Make dev_err_probe() silent for -ENOMEM (stable-fixes). - drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes). - drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes). - drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes). - drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes). - drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes). - drm/amd/display: Fix CRC open failure during active rendering (stable-fixes). - drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes). - drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes). - drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes). - drm/amd/display: Initialize dsc_caps to 0 (stable-fixes). - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes). - drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes). - drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes). - drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes). - drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes). - drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes). - drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 (git-fixes). - drm/amd/pm: hide pp_table sysfs on APUs (git-fixes). - drm/amdgpu: add a helper to calculate ring distance (stable-fixes). - drm/amdgpu: check ras and obj before dereference (git-fixes). - drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes). - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146). - drm/amdgpu: Failed to check various return code (stable-fixes). - drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes). - drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes). - drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes). - drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes). - drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes). - drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes). - drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes). - drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes). - drm/amdgpu: increase hmm range get pages timeout (stable-fixes). - drm/amdgpu: make an improvement on amdgpu_hmm_range_get_pages (stable-fixes). - drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes). - drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes). - drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes). - drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes). - drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes). - drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes). - drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes). - drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap (stable-fixes). - drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes). - drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes). - drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes). - drm/amdkfd: Remove arbitrary timeout for hmm_range_fault (stable-fixes). - drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes). - drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes). - drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes). - drm/ast: Automatically clean up poll helper (stable-fixes). - drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes). - drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes). - drm/cirrus: Use video aperture helpers (stable-fixes). - drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes). - drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes). - drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes). - drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes). - drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes). - drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes). - drm/gud: NUL-terminate TV mode names read from the device (git-fixes). - drm/gud: validate TV mode names before creating enum property (git-fixes). - drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes). - drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes). - drm/i915: fix incorrect RCU teardown order (git-fixes). - drm/i915: Fix memory leak in query_perf_config_list() (git-fixes). - drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes). - drm/imagination: clamp freelist reconstruction requests (git-fixes). - drm/imagination: Fix page count for page table for map() interface (git-fixes). - drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes). - drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes). - drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes). - drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes). - drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes). - drm/mediatek: Fix ovl adaptor platform device leak (git-fixes). - drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes). - drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes). - drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes). - drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes). - drm/nouveau/bios: skip the IFR header if present (stable-fixes). - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes). - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes). - drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes). - drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes). - drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes). - drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes). - drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes). - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes). - drm/nouveau: fix autosuspend cleanup during teardown (git-fixes). - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes). - drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes). - drm/nouveau: Fix gem reference leak in validate_init() (git-fixes). - drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes). - drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes). - drm/nouveau: unsubscribe the channel-kill event before the fence context (git-fixes). - drm/nouveau: Use write-combined maps for coherent (git-fixes). - drm/omap: dsi: Do not copy isr table (git-fixes). - drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes). - drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes). - drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes). - drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes). - drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes). - drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes). - drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes). - drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes). - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes). - drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes). - drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes). - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes). - drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() (git-fixes). - drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes). - drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564). - drm: add drm_memory_stats_is_zero (stable-fixes). - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes). - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes). - drm: rz-du: Ensure correct suspend/resume ordering with VSP (stable-fixes). - EDAC/amd64: Add support for AMD family 1Ah-based newer models (jsc#PED-16968). - EDAC/mc_sysfs: Increase legacy channel support to 16 (jsc#PED-16968). - efi: fix stale reference to efi_recover_from_page_fault() (git-fixes). - fbcon: don't suspend/resume when vc is graphics mode (stable-fixes). - fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes). - fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes). - fbdev: vfb: defer cleanup until the last reference (git-fixes). - firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes). - firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes). - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes). - firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes). - firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes). - firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes). - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes). - gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes). - gpio: pisosr: Read 'ngpios' as u32 (stable-fixes). - gpio: zynq: fix runtime PM leak on request error path (git-fixes). - HID: alps: fix use-after-free on input2 registration failure (git-fixes). - HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes). - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes). - HID: elecom: fix bus type for M-XGL20DLBK (git-fixes). - HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes). - HID: ft260: validate i2c input report length (stable-fixes). - HID: i2c-hid: Fix '(null)' output when reading report descriptor fails (git-fixes). - HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() (stable-fixes). - HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor (stable-fixes). - HID: i2c-hid: Revert to await reset ACK before reading report descriptor (git-fixes). - HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions (stable-fixes). - HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (stable-fixes). - HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes). - HID: mcp2221: stop device IO before hid_hw_stop (git-fixes). - HID: pidff: Support device error response from PID_BLOCK_LOAD (stable-fixes). - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes). - HID: rmi: fix OOB access with undersized RMI reports (git-fixes). - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes). - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes). - host1x: bus: Fix missing ops null check in error teardown (stable-fixes). - hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes). - hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes). - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes). - hwmon: (emc1403) Add support for EMC1428 and EMC1438 (stable-fixes). - hwmon: (emc1403) Add support for EMC1442 (stable-fixes). - hwmon: (emc1403) Convert to with_info API (stable-fixes). - hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes). - hwmon: (emc1403) Rely on subsystem locking (stable-fixes). - hwmon: (emc1403) Support 11 bit accuracy (stable-fixes). - hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes). - hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes). - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() (git-fixes). - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes). - hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes). - hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes). - hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes). - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes). - hwmon: (w83793) release probe data through kref (git-fixes). - i2c: at91: release DMA channels on remove and probe error (git-fixes). - i2c: atr: fix dangling adapter pointer on add failure (git-fixes). - i2c: core: fix adapter registration race (git-fixes). - i2c: core: fix irq domain leak on adapter registration failure (git-fixes). - i2c: imx: disable autosuspend on remove (git-fixes). - i2c: imx: release DMA channels on probe error (git-fixes). - i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (stable-fixes). - i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 (git-fixes). - i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes). - i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (stable-fixes). - ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852). - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (jsc#PED-16854). - ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854). - ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854). - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes). - ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes). - ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes). - iio: accel: kionix-kx022a: Fix array boundary check (git-fixes). - iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes). - iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes). - iio: accel: sca3000: fix frequency divider condition check (git-fixes). - iio: adc: max1363: sign-extend bipolar differential channel reads (git-fixes). - iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes). - iio: adc: stm32-adc: fix check on internal channel availability (git-fixes). - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes). - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes). - iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes). - iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes). - iio: buffer: serialize buffer teardown with mode claims (git-fixes). - iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes). - iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes). - iio: imu: adis16400: fix unprotected debugfs reads (git-fixes). - iio: imu: adis16480: fix unprotected debugfs reads (git-fixes). - iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes). - iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes). - iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes). - iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes). - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes). - iio: proximity: sx9324: Correct proximity channel resolution (git-fixes). - iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes). - iio: trigger: cancel reenable_work before freeing trigger (git-fixes). - inode: make __iget() a static inline (bsc#1282383). - Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes). - Input: aiptek - validate raw macro indices before updating state (stable-fixes). - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes). - Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes). - Input: eeti_ts - publish the OF module alias (git-fixes). - Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes). - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes). - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes). - Input: s6sy761 - fix resume ordering and restore sensing (git-fixes). - Input: soc_button_array - check btns_desc->package.count (git-fixes). - Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes). - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes). - Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes). - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes). - Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes). - Input: xpad - add support for Azeron devices (stable-fixes). - Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes). - Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes). - Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes). - integrity: Check for NULL returned by asymmetric_key_public_key (stable-fixes). - iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX (git-fixes). - kernel-binary.spec.in: Fix syntax error. - KEYS: encrypted: fix integer overflow of datablob_len (git-fixes). - keys: fix lost wakeup when reaping a dead key type (git-fixes). - KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes). - KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes). - KVM: arm64: vgic: Free gic_kvm_info on initialization failure (git-fixes). - KVM: nVMX: Always flush vpid02 on first use (git-fixes). - KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes). - KVM: s390: pci: Fix aisb calculation (bsc#1277451). - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic (bsc#1277451). - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure (bsc#1277451). - KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1277451). - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages (bsc#1277451). - KVM: s390: pci: Fix missing error codes and memory unaccounting (bsc#1277451). - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (bsc#1277451). - KVM: s390: pci: Fix resource leak on IRQ registration failure (bsc#1277451). - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1277451). - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages (bsc#1277451). - KVM: VMX: Prioritize DR7.GD=1 #DB over CPL>0 #GP on Intel (git-fixes). - KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes). - KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes). - KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes). - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes). - KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority (git-fixes). - KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL (git-fixes). - KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value (git-fixes). - KVM: x86: Treat any non-zero return from set_dr() as a faulting condition (git-fixes). - leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes). - leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes). - media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes). - media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes). - media: hevc: add bounded tile-count helpers (git-fixes). - media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes). - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes). - media: rc: mceusb: Add support for 04eb:e033 (stable-fixes). - media: v4l2-ctrls: validate AV1 tile counts (git-fixes). - media: v4l2-ctrls: validate HEVC tile counts (git-fixes). - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes). - media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes). - media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (git-fixes). - media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (git-fixes). - media: video-i2c: fix buffer queue ordering (stable-fixes). - media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes). - memstick: ms_block: destroy io_queue workqueue on removal (git-fixes). - mfd: db8500-prcmu: Remove needless return in three void APIs (stable-fixes). - mfd: rsmu: Add 8a34002 support (stable-fixes). - mmc: core: Add validation for host-provided max_segs (stable-fixes). - mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes). - mmc: core: Fix OF node reference leak on card add failure (git-fixes). - mmc: davinci: avoid NULL deref of host->data in IRQ handler (stable-fixes). - mmc: davinci: fix mmc_add_host order in probe (stable-fixes). - mmc: hsq: Fix use-after-free in retry work (git-fixes). - mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes). - mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes). - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes). - mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes). - mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes). - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes). - mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes). - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes). - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes). - mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes). - net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852). - net: ibmveth: added KUnit tests for some buffer pool functions (jsc#PED-16852). - net: ibmveth: Indented struct ibmveth_adapter correctly (jsc#PED-16852). - net: ibmveth: Refactored veth_pool_store for better maintainability (jsc#PED-16852). - net: ibmveth: Reset the adapter when unexpected states are detected (jsc#PED-16852). - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes). - net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes). - net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes). - net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes). - net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401). - net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes). - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes). - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes). - net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes). - net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes). - net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes). - net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (stable-fixes). - net: usb: sr9700: include receive overhead in the length check (git-fixes). - net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes). - net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes). - net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes). - net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes). - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes). - nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes). - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes). - nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes). - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes). - nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes). - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes). - nfc: nfcmrvl: validate helper command length before pull (git-fixes). - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes). - nfc: port100: reject frames whose declared length exceeds the received data (git-fixes). - nfc: st21nfca: validate ISO15693 inventory length (git-fixes). - nfc: st21nfca: validate received frame size (git-fixes). - nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes). - nvme-tcp: fix usage of page_frag_cache (bsc#1267882). - of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes). - of: property: add missing kerneldoc for of_graph_get_endpoint_count() (stable-fixes). - PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes). - PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes). - PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes). - PCI/proc: Use file_ns_capable() when checking config space read access (stable-fixes). - PCI/proc: Warn on writes to kernel-exclusive config space regions (stable-fixes). - PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes). - PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes). - PCI: altera: Protect root bus removal with rescan lock (stable-fixes). - PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes). - PCI: iproc: Protect root bus removal with rescan lock (stable-fixes). - PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes). - PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes). - PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes). - PCI: switchtec: Add Gen6 Device IDs (stable-fixes). - PCI: Wait for device readiness after D3hot -> D0uninitialized transition (stable-fixes). - PCI: xgene: Drop unnecessary OF node reference (git-fixes). - PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes). - perf: Reject exited events as group leaders (git-fixes). - phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes). - phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes). - pinctrl: meson: Fix typo in s4 group name (git-fixes). - pinctrl: single: free the IRQ on domain creation failure (git-fixes). - platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes). - platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes). - platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes). - platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes). - power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes). - power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes). - power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes). - power: supply: sc2731_charger: cancel work on remove (git-fixes). - power: supply: sc2731_charger: Convert to platform remove callback returning void (stable-fixes). - powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979). - powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes). - powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906). - powerpc/perf: Set cpumode flags using sample address (jsc#PED-16906). - powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979). - powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906). - powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979). - powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes). - powerpc: Add Power12 architected mode (jsc#PED-16906). - powerpc: Add Power12 raw mode (jsc#PED-16906). - RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes). - RDMA/core: Fix potential use after free in counter_release() (git-fixes). - RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes). - RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes). - RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes). - RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes). - RDMA/core: Fix use after free in ib_query_qp() (git-fixes). - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes). - RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes). - RDMA/hfi1: Align probe error unwinding with device removal (git-fixes). - RDMA/hfi1: Allocate device data after PCI initialization (git-fixes). - RDMA/hfi1: Create workqueues before device initialization (git-fixes). - RDMA/hfi1: Defer device creation until probe succeeds (git-fixes). - RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes). - RDMA/hfi1: Free RX data on late probe failure (git-fixes). - RDMA/hfi1: Initialize debugfs after probe completes (git-fixes). - RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes). - RDMA/hfi1: Preserve unit 0 on (git-fixes). - RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes). - RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes). - RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes). - RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes). - RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes). - RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes). - RDMA/rvt: Return NULL after port allocation failure (git-fixes). - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896). - rtc: aspeed: add AST2700 compatible (stable-fixes). - rtc: bq32000: add delay between RTC reads (stable-fixes). - selftests/alsa: Fix the step check for INTEGER controls (git-fixes). - selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401). - selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401). - selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401). - serial: 8250: fix possible ISR soft lockup (stable-fixes). - serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes). - serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes). - serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes). - slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139). - slab: Introduce kmalloc_flex() and family (bsc#1280139). - slab: Introduce kmalloc_obj() and family (bsc#1280139). - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139). - smb: client: harden DFS cache against invalid target hints (git-fixes). - soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes). - soundwire: cadence_master: wait and cancel cdns->work before clock stop (git-fixes). - soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes). - soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes). - soundwire: only handle alert events when the peripheral is attached (stable-fixes). - soundwire: validate DT compatible before parsing it (stable-fixes). - spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (stable-fixes). - spi: core: Abort active target transfer on controller suspend (stable-fixes). - spi: davinci: Unset POWERDOWN bit when releasing resources (stable-fixes). - spi: dw-dma: Wait for controller idle before completing Tx (stable-fixes). - spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (stable-fixes). - spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes). - spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes). - staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes). - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes). - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes). - thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes). - thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes). - thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes). - thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes). - thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes). - thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes). - thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes). - thunderbolt: Keep the domain reference while processing hotplug (stable-fixes). - thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes). - thunderbolt: Reject oversized XDomain properties responses (git-fixes). - thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes). - thunderbolt: Set tb->root_switch to NULL when domain is stopped (stable-fixes). - thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes). - tls: add counters for rekey (bsc#1267564 jsc#PED-16401). - tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401). - tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401). - tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401). - tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes). - tty: vt: fix memory leak in vc_allocate() (git-fixes). - usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes). - USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes). - USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes). - USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes). - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes). - usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes). - usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes). - usb: core: Add lock to usb_wakeup_notification() (git-fixes). - usb: core: Add lock to usb_wakeup_notification() (stable-fixes). - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes). - usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes). - usb: core: Strengthen error handling in hub_hub_status() (git-fixes). - usb: core: Strengthen error handling in hub_hub_status() (stable-fixes). - usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes). - usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes). - usb: fix UAF when probe runs concurrent to dyn ID removal (git-fixes). - usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes). - usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes). - usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes). - usb: gadget: aspeed_udc: Convert to platform remove callback returning void (stable-fixes). - USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes). - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes). - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes). - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes). - usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes). - usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (stable-fixes). - usb: gadget: udc: skip pullup() if already connected (stable-fixes). - usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes). - usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes). - usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes). - USB: make to_usb_driver() use container_of_const() (stable-fixes). - usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes). - usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes). - usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes). - usb: ohci-st: disable controller wakeup on removal (git-fixes). - USB: serial: fix driver deregistration order (git-fixes). - USB: serial: fix dynamic id driver deregistration race (git-fixes). - USB: serial: fix port tear down use-after-free (git-fixes). - USB: serial: quatech2: fix baud rate overflow (git-fixes). - usb: serial: spcp8x5: don't store usb_device_id (stable-fixes). - USB: serial: ssu100: fix baud rate overflow (git-fixes). - usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes). - usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes). - usb: typec: tcpm: recover after failure to start the frs ams (git-fixes). - usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes). - usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes). - usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes). - usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes). - usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes). - usb: usbtest: disable dynamic ID support (stable-fixes). - usb: usbtmc: don't store usb_device_id (stable-fixes). - usb: xhci: use cached HCSPARAMS1 value (stable-fixes). - usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes). - usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes). - watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes). - watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes). - watchdog: digicolor: Avoid division by zero (git-fixes). - watchdog: fix hrtimer start when pretimeout is zero (git-fixes). - watchdog: msc313e: Avoid division by zero (git-fixes). - watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes). - watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes). - watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes). - watchdog: msc313e: Fix premature reset during timeout update (git-fixes). - watchdog: msc313e: Fix spurious reset on suspend (git-fixes). - watchdog: msc313e: Fix undefined behavior (git-fixes). - watchdog: msc313e: Propagate error code in resume() (git-fixes). - watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes). - watchdog: rtd119x: Avoid division by zero (git-fixes). - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes). - watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes). - wifi: ath9k_htc: don't store usb_device_id (stable-fixes). - wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes). - wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() (git-fixes). - wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes). - wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes). - wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes). - wifi: ath11k: implement handling of P2P NoA event (stable-fixes). - wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes). - wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes). - wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes). - wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes). - wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes). - wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes). - wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes). - wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes). - wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes). - wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes). - wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes). - wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes). - wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes). - wifi: iwlegacy: fix broadcast stations deallocation (git-fixes). - wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes). - wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes). - wifi: iwlwifi: mei: add support for SAP version 4 (stable-fixes). - wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes). - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes). - wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes). - wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes). - wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes). - wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes). - wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes). - wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes). - wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes). - wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes). - wifi: libertas: reject short monitor TX frames (stable-fixes). - wifi: libipw: fix key index receive bound checks (stable-fixes). - wifi: libipw: reject too-short association responses (git-fixes). - wifi: libipw: reject too-short beacon and probe responses (git-fixes). - wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes). - wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes). - wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes). - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes). - wifi: mac80211: don't access the TSF of a down interface (git-fixes). - wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes). - wifi: mac80211: don't allow link changes when iface is down (git-fixes). - wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes). - wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes). - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes). - wifi: mac80211: don't start a ROC while scanning (git-fixes). - wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes). - wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes). - wifi: mac80211: mesh: release the channel if start fails (git-fixes). - wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes). - wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes). - wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes). - wifi: mac80211: reset state when starting AP fails (git-fixes). - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes). - wifi: mac80211: set up the TX info early to fix failure paths (git-fixes). - wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes). - wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes). - wifi: mac80211: validate deauth frame length before reason access (stable-fixes). - wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (git-fixes). - wifi: mt76: mt7915: report RX chain signal for all RX paths (git-fixes). - wifi: mt76: mt7915: set correct background radar capability (stable-fixes). - wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes). - wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes). - wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes). - wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes). - wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes). - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes). - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes). - wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes). - wifi: mwifiex: validate action frame fixed fields (git-fixes). - wifi: mwifiex: validate scan response extents (git-fixes). - wifi: nl80211: reject beacons with bad HE operation (stable-fixes). - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes). - wifi: p54: validate curve data length in the calibration curve converters (git-fixes). - wifi: ralink: RT2X00: init EEPROM properly (stable-fixes). - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes). - wifi: rsi: fix heap OOB write on key removal (git-fixes). - wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes). - wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes). - wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (stable-fixes). - wifi: rtw88: Fix the random 'error beacon valid' messages for USB (stable-fixes). - wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes). - wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes). - wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes). - wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes). - wifi: virt_wifi: don't transfer operstate before register (git-fixes). - wifi: virt_wifi: free skb when disconnected (git-fixes). - wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes). - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes). - wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes). - x86/mce: Add support for physical address valid bit (jsc#PED-16968). - x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455). - x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951). - x86/tsx: Make tsx_ctrl_state static (bsc#1250951). - xfs: don't free cowblocks from under dirty pagecache on unshare (bsc#1278709). - xhci: fix lost bounce buffers on TDs spanning several ring segments (git-fixes). - xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).