-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 31 Oct 2026 15:51:21 +0100 Source: linux Architecture: source Version: 6.12.115-1 Distribution: trixie-security Urgency: high Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org> Changed-By: Salvatore Bonaccorso <carnil@debian.org> Closes: 1112238 1151097 1151281 Changes: linux (6.12.115-1) trixie-security; urgency=high . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.114 - spi: mpc52xx: clean up interrupt handling - usb: gadget: f_hid: Add missing error code - [amd64] iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported - [amd64] iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() - ice: fix use-after-free in dynamic port cleanup - xfs: stop exchanging reflink flags when exchanging mappings - xfs: fix exchange-range-to-eof file size exchange - ip6_gre: remove obsolete ERSPAN PMTU update - xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock - xfs: catch stale AGF/AGF metadata - xfs: avoid dquot buffer pin deadlock - xfs: rearrange code in xfs_buf_item.c - xfs: factor out stale buffer item completion - xfs: fix unmount hang with unflushable inodes stuck in the AIL - drm/amd: Create a device link between APU display and XHCI devices - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge - wifi: mt76: connac: tolerate inactive BSS deactivation - net: team: Remove unused team_mode_op, port_enabled - net: team: Rename port_disabled team mode op to port_tx_disabled - net: team: fix NULL pointer dereference in team_xmit during mode change (CVE-2026-64190) - net: team: stop reusing skb after queue override - sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler - Bluetooth: hci_sync: Fix command skb lifetime during scan setup - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex - drm/vmwgfx: Stop using dev_private to store driver data. - drm/vmwgfx: validate pitch coming from userspace - namespace: don't inherit MNT_UMOUNT in clone_mnt() - namespace: check the mounts before reading their parents in pivot_root() - dm-integrity: use internal variable for digestsize - dm-integrity: rename internal_hash - dm-integrity: fix buffer overflow in inline mode with large tag size - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop - [riscv64] patch: Avoid early phys_to_page() - [riscv64] patch: fix handling of bpf-jit execmem addresses - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ - scsi: ch: Do not keep references to data transfer element devices - scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe() - scsi: ufs: core: Add debug log for MCQ command timeout - scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock() - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() - drm/vc4: Use video aperture helpers - drm/vc4: Fix firmware reference leak in vc4_drm_bind() - namespace: unhash a dentry before detaching the mounts on it - namespace: check the target before walking it in do_mount_setattr() - fcntl: refuse F_SET_RW_HINT on an immutable inode - namespace: handle mount locking for automounts correctly - smb: client: improve compound padding in encryption - smb: client: get rid of bounds check in SMB2_ioctl_init() - smb: client: fix compound alignment with encryption - [amd64] drm/i915/display: pass display to intel_crtc_for_pipe() - [amd64] drm/i915/vga: Convert VGA code to intel_display - [amd64] drm/i915/display: convert I915_STATE_WARN() to struct intel_display - [amd64] drm/i915/gmbus: convert to struct intel_display - [amd64] drm/i915/crt: convert to struct intel_display - [amd64] drm/i915: Grab intel_display from the encoder to avoid potential oopsies (CVE-2024-58074) - ax25: Remove broken autobind (CVE-2025-22109) - f2fs: quota: fix to avoid warning in dquot_writeback_dquots() (CVE-2025-23132) - [riscv64] KVM: Teardown riscv specific bits after kvm_exit (CVE-2025-23135) - wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info - wifi: ath12k: fix incorrect TID updation in DP monitor status path - wifi: ath12k: Avoid explicit type cast in monitor status parse handler - wifi: ath12k: Avoid memory leak while enabling statistics (CVE-2025-37743) - perf/dwc_pcie: Qualify RAS DES VSEC Capability by Vendor, Revision - perf/dwc_pcie: fix duplicate pci_dev devices (CVE-2025-37746) - ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd (CVE-2025-37906) - kasan: avoid sleepable page allocation from atomic context (CVE-2025-38029) - clk: sunxi-ng: h616: Reparent CPU clock during frequency changes - clk: sunxi-ng: h616: Reparent GPU clock during frequency changes (CVE-2025-38041) - net: ethernet: ti: am65-cpsw: streamline RX queue creation and cleanup - dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn (CVE-2025-38042) - virtio: break and reset virtio devices on device_shutdown() (CVE-2025-38064) - coresight: holding cscfg_csdev_lock while removing cscfg from csdev (CVE-2025-38132) - PCI/pwrctl: Use of_platform_device_create() to create pwrctl devices - PCI/pwrctl: Create pwrctl device only if at least one power supply is present - PCI/pwrctrl: Cancel outstanding rescan work when unregistering (CVE-2025-38137) - drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (CVE-2025-38187) - wifi: ath12k: convert struct ath12k_sta::update_wk to use struct wiphy_work - wifi: ath12k: ath12k_mac_op_sta_state(): clean up update_wk cancellation - wifi: ath12k: prepare vif data structure for MLO handling - wifi: ath12k: Fix memory leak due to multiple rx_stats allocation (CVE-2025-38199) - mm: fix uprobe pte be overwritten when expanding vma (CVE-2025-38207) - [riscv64] Enable cbo.zero only when all harts support Zicboz - [riscv64] Add support for per-thread envcfg CSR values - [riscv64] save the SR_SUM status over switches (CVE-2025-38261) - wifi: rtw89: pci: configure manual DAC mode via PCI config API only (CVE-2025-38284) - [s390x] entry: Remove __GMAP_ASCE and use _PIF_GUEST_FAULT again - [s390x] kvm: Remove kvm_arch_fault_in_page() - [s390x] mm/fault: Handle guest-related program interrupts in KVM - [s390x] mm: Simplify get_fault_type() - [s390x] mm: Get rid of fault type switch statements - [s390x] mm: Fix in_atomic() handling in do_secure_storage_access() (CVE-2025-38359) - [amd64] platform/x86/amd/pmf: Switch to platform_get_resource() and devm_ioremap_resource() - [amd64] platform/x86/amd: pmf: Use device managed allocations (CVE-2025-38421) - drm/rockchip: vop2: Consistently use dev_err_probe() - drm/rockchip: vop2: Register the primary plane and overlay plane separately - drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (CVE-2025-38597) - wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (CVE-2025-38605) - rv: Remove trailing whitespace from tracepoint string - rv: Use strings in da monitors tracepoints (CVE-2025-38636) - wifi: iwlwifi: return ERR_PTR from opmode start() - wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (CVE-2025-38656) - net/sched: Fix backlog accounting in qdisc_dequeue_internal (CVE-2025-39677) - mm/mremap: fix WARN with uffd that has remap events disabled (CVE-2025-39775) - [amd64] crypto: x86/aegis128 - eliminate some indirect calls - [amd64] crypto: x86/aegis128 - optimize length block preparation using SSE4.1 - [amd64] crypto: x86/aegis128 - improve assembly function prototypes - [amd64] crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT - [amd64] crypto: x86/aegis - Add missing error checks (CVE-2025-39789) - net/mlx5: HWS, denote how refcounts are protected - net/mlx5: HWS, simplify allocations as we support only FDB - net/mlx5: HWS, handle returned error value in pool alloc - net/mlx5: HWS, update flow - remove the use of dual RTCs - net/mlx5: HWS, Remove unused element array - net/mlx5: HWS, Make pool single resource - net/mlx5: HWS, Refactor pool implementation - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (CVE-2025-39830) - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (CVE-2025-39834) - ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (CVE-2025-39859) - wifi: mt76: mt7915: fix list corruption after hardware restart (CVE-2025-39862) - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() (CVE-2025-39910) - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (CVE-2025-39933) - [s390x] iommu/s390: handle IOAT registration based on domain - [s390x] iommu/s390: set appropriate IOTA region type - [s390x] iommu/s390: Make attach succeed when the device was surprise removed (CVE-2025-39958) - [riscv64] KVM: Write hgatp register with valid mode bits (CVE-2025-40065) - drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (CVE-2025-40086) - remoteproc: Switch back to struct platform_driver::remove() - remoteproc: qcom: pas: Make remoteproc name human friendly - remoteproc: qcom_q6v5_pas: Simplify with dev_err_probe() - remoteproc: qcom: pas: Conclude the rename from adsp - remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E (CVE-2025-40113) - scsi: ufs: core: Fix data race in CPU latency PM QoS request handling (CVE-2025-40130) - crypto: hisilicon/hpre - enable all clusters clock gating - crypto: hisilicon/qm - request reserved interrupt for virtual function (CVE-2025-40136) - [amd64] ASoC: Intel: avs: Use topology information for endpoint numbers - [amd64] ASoC: Intel: avs: Do not share the name pointer between components (CVE-2025-40338) - sysfs: check visibility before changing group attribute ownership (CVE-2025-40355) - amd/amdkfd: enhance kfd process check in switch partition (CVE-2025-68174) - drm/xe/guc: Add devm release action to safely tear down CT (CVE-2025-68193) - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage - net/mlx5: HWS, fix bad parameter in CQ creation - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET - net/mlx5: Store the global doorbell in mlx5_priv - net/mlx5e: Prepare for using different CQ doorbells - mlx5: Fix default values in create CQ (CVE-2025-68209) - scsi: ufs: qcom : Refactor phy_power_on/off calls - scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) (CVE-2025-68236) - clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL (CVE-2025-68318) - netconsole: Acquire su_mutex before navigating configs hierarchy (CVE-2025-68319) - net: vxlan: prevent NULL deref in vxlan_xmit_one (CVE-2025-68353) - btrfs: fix double free of qgroup record after failure to add delayed ref head (CVE-2025-68359) - wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (CVE-2025-68360) - md: init bioset in mddev_init (CVE-2025-68368) - coresight-tmc: change tmc_drvdata spinlock's type to raw_spinlock_t - coresight: ETR: Fix ETR buffer use-after-free issue (CVE-2025-68376) - wifi: ath12k: Fix MSDU buffer types handling in RX error path (CVE-2025-68729) - accel/ivpu: Allow to import single buffer into multiple contexts - accel/ivpu: Rework bind/unbind of imported buffers - accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() (CVE-2025-68730) - drm/panthor: Prevent potential UAF in group creation (CVE-2025-68735) - scsi: qla2xxx: Clear cmds after chip reset (CVE-2025-68745) - staging: most: remove broken i2c driver (CVE-2025-68755) - wifi: mac80211: fix typo in HE MCS check - wifi: mac80211: log link information in ieee80211_determine_chan_mode - wifi: mac80211: don't WARN for connections on invalid channels (CVE-2025-71227) - accel/qaic: Add config structs for supported cards - net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels (CVE-2025-71285) - PCI: endpoint: Add missing NULL check for alloc_workqueue() (CVE-2025-71313) - bpf: Mark bpf_refcount field as unique (CVE-2026-100074) - staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths (CVE-2026-100076) - drm/msm: Recover HW before retire hung submit (CVE-2026-100077) - block: zero non-PI portion of auto integrity buffer (CVE-2026-23007) - idpf: fix error handling in the init_task on load (CVE-2026-23017) - stddef: Introduce TRAILING_OVERLAP() helper macro - virtio_net: Fix misalignment bug in struct virtnet_info (CVE-2026-23143) - ALSA: usb-audio: Prevent excessive number of frames (CVE-2026-23208) - riscv: trace: fix snapshot deadlock with sbi ecall (CVE-2026-23217) - io_uring/rw: free potentially allocated iovec on cache put failure (CVE-2026-23259) - cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (CVE-2026-23327) - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (CVE-2026-23371) - ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz (CVE-2026-23377) - netfilter: nf_tables: clone set on flush only (CVE-2026-23385) - serial: rename local uart_port_lock() -> uart_port_ref_lock() - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (CVE-2026-23472) - RDMA/efa: Fix use of completion ctx after free (CVE-2026-31493) - bpf: Fix exception exit lock checking for subprogs (CVE-2026-31526) - drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (CVE-2026-31562) - [s390x] mm: Add missing secure storage access fixups for donated memory (CVE-2026-31568) - dm: limit swapping tables for devices with zone write plugs (CVE-2025-38140) - drm/tilcdc: Fix removal actions in case of failed probe (CVE-2025-71141) - net: Factorise setup_net() and cleanup_net(). - net: Add ops_undo_single for module load/unload. - net: Add ->exit_rtnl() hook to struct pernet_operations. - wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (CVE-2026-31579) - [amd64] KVM: SEV: Use long-term pin when registering encrypted memory regions - [amd64] KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (CVE-2026-31592) - rxrpc: proc: size address buffers for %pISpc output (CVE-2026-31630) - Bluetooth: hci_event: move wake reason storage into validated event handlers (CVE-2026-31771) - bpf: Factor out atomic_ptr_type_ok() - bpf: Factor out check_atomic_rmw() - bpf: Factor out check_load_mem() and check_store_reg() - bpf: Fix incorrect pruning due to atomic fetch precision tracking (CVE-2026-43009) - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (CVE-2026-43022) - bnxt_en: Update firmware interface spec to 1.10.3.85 - bnxt_en: set backing store type from query type (CVE-2026-43034) - mpls: Hold dev refcnt for mpls_nh. - mpls: Unify return paths in mpls_dev_notify(). - mpls: Add mpls_dev_rcu(). - mpls: Pass net to mpls_dev_get(). - mpls: Add mpls_route_input(). - mpls: Convert mpls_dump_routes() to RCU. - mpls: Protect net->mpls.platform_label with a per-netns mutex. - mpls: add seqcount to protect the platform_label{,s} pair (CVE-2026-43042) - HID: core: Add reserved item tag for main items - HID: rate-limit hid_warn to prevent log flooding - HID: core: Mitigate potential OOB by removing bogus memset() (CVE-2026-43048) - xfs: remove bp->b_error check in xfs_attr3_root_inactive - xfs: factor out xfs_attr3_node_entry_remove - xfs: close crash window in attr dabtree inactivation (CVE-2026-43053) - net: ioam6: fix OOB and missing lock (CVE-2026-43083) - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (CVE-2026-43101) - types: move struct rcuwait into types.h - irqwork: Move data struct to a types header - srcu: Use irq_work to start GP in tiny SRCU (CVE-2026-43115) - btrfs: tree-log: don't use token set/get accessors in fill_inode_item() - btrfs: fix zero size inode with non-zero size after log replay (CVE-2026-43118) - fs/ntfs3: Accumulated refactoring changes - ntfs3: fix circular locking dependency in run_unpack_ex (CVE-2026-43127) - wifi: iwlwifi: fix 22000 series SMEM parsing (CVE-2026-43172) - ksmbd: fix signededness bug in smb_direct_prepare_negotiation() (CVE-2026-43185) - drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (CVE-2026-43191) - ASoC: qcom: q6asm: handle the responses after closing - ASoC: qcom: q6asm: drop DSP responses for closed data streams (CVE-2026-43204) - wifi: rtw89: pci: validate sequence number of TX release report (CVE-2026-43213) - team: avoid NETDEV_CHANGEMTU event when unregistering slave (CVE-2026-43234) - media: chips-media: wave5: Fix Null reference while testing fluster (CVE-2026-43263) - ring-buffer: Fix possible dereference of uninitialized pointer (CVE-2026-43272) - drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (CVE-2026-43294) - drm/amdgpu: Skip vcn poison irq release on VF (CVE-2026-43298) - btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (CVE-2026-43299) - btrfs: remove 'reserved' argument from btrfs_pin_extent() - btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (CVE-2026-43308) - md raid: fix hang when stopping arrays with metadata through dm-raid (CVE-2026-43309) - media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure - media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC (CVE-2026-43310) - KVM: Export hardware virtualization enabling/disabling functions - syscore: Pass context data to callbacks - soc/tegra: pmc: Fix unsafe generic_handle_irq() call (CVE-2026-43311) - wifi: iwlwifi: mvm: don't send a 6E related command when not supported (CVE-2026-43325) - drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (CVE-2026-43337) - ice: ptp: don't WARN when controlling PF is unavailable (CVE-2026-43346) - i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (CVE-2026-43352) - i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (CVE-2026-43353) - scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) - [amd64] ASoC: amd: acp-mach-common: Add missing error check for clock acquisition (CVE-2026-43443) - rxrpc: kdoc: Update function descriptions and add link from rxrpc.rst - rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() (CVE-2026-43463) - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (CVE-2026-43464) - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (CVE-2026-43465) - nouveau/gsp: drop WARN_ON in ACPI probes (CVE-2026-43485) - bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932) - btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation (CVE-2026-45934) - net: stmmac: fix oops when split header is enabled (CVE-2026-45940) - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() (CVE-2026-45956) - gfs2: fix memory leaks in gfs2_fill_super error path (CVE-2026-45961) - [amd64] KVM: SVM: Add missing save/restore handling of LBR MSRs (CVE-2026-46014) - ipmi:ssif: Clean up kthread on errors (CVE-2026-46044) - [amd64] KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" - [amd64] KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (CVE-2026-46059) - ceph: Remove call to PagePrivate2() - ceph: extend ceph_writeback_ctl for ceph_writepages_start() refactoring - ceph: introduce ceph_process_folio_batch() method - ceph: Remove uses of page from ceph_process_folio_batch() - ceph: fix num_ops off-by-one when crypto allocation fails (CVE-2026-46066) - [amd64] KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (CVE-2026-46071) - dm-verity-fec: fix reading parity bytes split across blocks (take 3) (CVE-2026-46130) - spi: microchip-core-qspi: Support per spi-mem operation frequency switches - spi: microchip-core-qspi: set min_speed_hz during probe - spi: microchip-core-qspi: remove unused param from mchp_coreqspi_write_op() - spi: microchip-core-qspi: control built-in cs manually (CVE-2026-46148) - [riscv64] kvm: fix vector context allocation leak (CVE-2026-46171) - f2fs: fix fsck inconsistency caused by FGGC of node block (CVE-2026-46175) - refcount: provide ops for cases when object's memory can be reused - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) - spi: ch341: switch to use devm_spi_alloc_host() - spi: ch341: fix devres lifetime (CVE-2026-46228) - drm/amd/display: Fix dc_link NULL handling in HPD init (CVE-2026-46245) - NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages (CVE-2026-46256) - coresight: tmc-etr: Fix race condition between sysfs and perf mode (CVE-2026-46272) - selinux: allow multiple opens of /sys/fs/selinux/policy (CVE-2026-46302) - netfilter: nf_tables: use list_del_rcu for netlink hooks (CVE-2026-46324) - RDMA/rxe: Move some code to rxe_loc.h in preparation for ODP - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (CVE-2026-46325) - Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330) - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (CVE-2026-52937) - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (CVE-2026-52956) - net: airoha: fix BQL imbalance in TX path (CVE-2026-52983) - sched/psi: fix race between file release and pressure write (CVE-2026-52991) - netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000) - ice: fix double-free of tx_buf skb (CVE-2026-53009) - f2fs: fix data loss caused by incorrect use of nat_entry flag (CVE-2026-53017) - f2fs: avoid reading already updated pages during GC (CVE-2026-53018) - greybus: raw: fix use-after-free on cdev close (CVE-2026-53025) - net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) - wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (CVE-2026-53103) - wifi: mt76: Fix memory leak destroying device (CVE-2026-53104) - [powerpc*] 64s: Fix unmap race with PMD migration entries (CVE-2026-53108) - [powerpc*] pgtable-frag: Fix bad page state in pte_frag_destroy (CVE-2026-53109) - vdpa: use generic driver_override infrastructure (CVE-2026-53118) - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (CVE-2026-53178) - sctp: validate embedded INIT chunk and address list lengths in cookie (CVE-2026-53224) - wifi: fix leak if split 6 GHz scanning fails (CVE-2026-53258) - [arm64] KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CVE-2026-53277) - [amd64] iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281) - btrfs: only release the dirty pages io tree after successful writes (CVE-2026-53284) - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (CVE-2026-53285) - net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind (CVE-2026-53292) - net: mana: Guard mana_remove against double invocation (CVE-2026-53297) - io_uring/napi: protect concurrent io_napi_entry timeout accesses - io_uring/napi: improve __io_napi_add - io_uring/napi: Use lock guards - io_uring/napi: clean up __io_napi_do_busy_loop - io_uring/napi: cap busy_poll_to 10 msec (CVE-2026-53321) - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() (CVE-2026-53330) - f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage (CVE-2026-53368) - drm/msm: always recover the gpu (CVE-2026-53377) - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap - fbdev: omap2: fix use-after-free in omapfb_mmap (CVE-2026-53401) - f2fs: read COW data with the original inode during atomic write (CVE-2026-63811) - gcov: use atomic counter updates to fix concurrent access crashes (CVE-2026-63825) - wifi: mt76: add wcid publish check in mt76_sta_add (CVE-2026-63832) - drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (CVE-2026-63853) - net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() (CVE-2026-63857) - net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() (CVE-2026-63859) - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) - net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979) - ethtool: module: call ethnl_ops_complete() on module flash errors (CVE-2026-63998) - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (CVE-2026-63999) - netfilter: nf_tables: fix dst corruption in same register operation (CVE-2026-64006) - tcp: Remove sk->sk_prot->orphan_count. - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) - cgroup/rstat: validate cpu before css_rstat_cpu() access (CVE-2026-64036) - hwmon: (lm90) Stop work before releasing hwmon device (CVE-2026-64038) - netfs: Fix leak of request in netfs_write_begin() error handling (CVE-2026-64060) - netfs: Fix missing locking around retry adding new subreqs (CVE-2026-64068) - netfilter: bridge: eb_tables: close module init race (CVE-2026-64076) - netfilter: ebtables: move to two-stage removal scheme (CVE-2026-64077) - netfilter: x_tables: allow initial table replace without emitting audit log message - netfilter: x_tables: allocate hook ops while under mutex (CVE-2026-64079) - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117) - erofs: fix metabuf leak in inode xattr initialization (CVE-2026-64146) - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (CVE-2026-64154) - netfs: Fix zeropoint update where i_size > remote_i_size (CVE-2026-64159) - hwmon: (lm90) Add lock protection to lm90_alert (CVE-2026-64213) - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (CVE-2026-64283) - smb/client: fix chown/chgrp with SMB3 POSIX Extensions (CVE-2026-64388) - ksmbd: validate NTLMv2 response before updating session key (CVE-2026-64389) - ksmbd: prevent path traversal bypass by restricting caseless retry (CVE-2026-64400) - [amd64] KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state - [amd64] KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) - [amd64] KVM: x86: Rename APIC base setters to better capture their relationship - [amd64] KVM: x86: Move update_cr8_intercept() to lapic.c - [amd64] KVM: x86: Unconditionally recompute CR8 intercept on PPR update (CVE-2026-64513) - [amd64] KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (CVE-2026-68081) - drm/amdgpu: Fix kernel panic during driver load failure (CVE-2026-68105) - media: stm32: dcmipp: use v4l2_subdev_is_streaming - media: stm32: dcmipp: replace s_stream with enable/disable_streams - media: stm32-dcmipp: Return queued buffers on start_streaming() failure (CVE-2026-68211) - drm/vc4: Shut down BO cache timer before teardown (CVE-2026-68233) - drm/amdgpu: Use dbg level for VBIOS check messages - drm/amdgpu: Add wrapper for freeing vbios memory - drm/amdgpu: Release VFCT ACPI table reference (CVE-2026-68238) - [amd64] drm/i915/mst: limit DP MST ESI service loop (CVE-2026-68241) - [amd64] drm/i915/gt: Fix NULL deref on sched_engine alloc failure (CVE-2026-68242) - drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (CVE-2026-68258) - idpf: fix max_vport related crash on allocation error during init (CVE-2026-68291) - LoongArch: BPF: Zero-extend signed ALU32 div/mod results (CVE-2026-68295) - cifs: prevent readdir from changing file size due to stale directory metadata - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (CVE-2026-68312) - tipc: serialize udp bearer replicast list updates (CVE-2026-68323) - fwctl/bnxt_en: Refactor aux bus functions to be more generic - bnxt_en: Handle partially initialized auxiliary devices (CVE-2026-68375) - drm/xe/guc: Keep scheduler timeline name alive (CVE-2026-68383) - Bluetooth: hci_sync: extend conn_hash lookup critical sections (CVE-2026-68393) - bpf: Disable migration when destroying sock storage - bpf: Disable migration when cloning sock storage - rcu: add rcu_read_lock_dont_migrate() - bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c - bpf: Fix UAF in sock clone early bailouts (CVE-2026-68399) - firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() (CVE-2026-68401) - wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404) - wifi: mac80211: refactor populating mesh related fields in sinfo - wifi: cfg80211: add link_station_info structure to support MLO statistics - wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409) - wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() (CVE-2026-68412) - RDMA/irdma: Prevent user-triggered null deref on QP create (CVE-2026-68418) - sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() (CVE-2026-68421) - xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) - drm/amd/display: use kvzalloc to allocate struct dc (CVE-2026-68436) - net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (CVE-2026-68441) - drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (CVE-2026-68447) - ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448) - [s390x] zcrypt: Fix buffer over-read in cca_cipher2protkey (CVE-2026-68453) - wifi: mac80211: validate extension-frame layout before RX (CVE-2026-68470) - wifi: ieee80211: validate MLE common info length (CVE-2026-68471) - ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD (CVE-2026-72031) - mmc: vub300: Use devm_mmc_alloc_host() helper - mmc: vub300: fix use-after-free on disconnect - mmc: vub300: rename probe error labels - mmc: vub300: fix use-after-free on probe failure (CVE-2026-72073) - dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098) - ocfs2: correct l_next_free_rec in online check - ocfs2: add suballoc slot check in ocfs2_validate_inode_block() - ocfs2: add extra consistency checks for chain allocator dinodes - ocfs2: validate i_refcount_loc when refcount flag is set - ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec (CVE-2026-72162) - [arm64] KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288) - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (CVE-2026-72321) - net/liquidio: drop cached VF pci_dev LUT (CVE-2026-72329) - Bluetooth: 6lowpan: avoid untracked enable work (CVE-2026-72337) - net/mlx5e: Fix publication race for priv->channel_stats[] (CVE-2026-72341) - netfs: Clean up some whitespace in trace header - netfs: Use a folio_queue allocation and free functions - netfs: Add a tracepoint to log the lifespan of folio_queue structs - netfs: Abstract out a rolling folio buffer implementation - netfs: Drop the was_async arg from netfs_read_subreq_terminated() - netfs: Fix netfs_create_write_req() to handle async cache object creation (CVE-2026-72366) - iomap: guard io_size EOF trim against concurrent truncate underflow (CVE-2026-72367) - afs: Fix reinitialisation of the inode, in particular ->lock_work (CVE-2026-72375) - xen/pvcalls: bound backend response req_id before indexing rsp[] (CVE-2026-72380) - sctp: fix addr_wq_timer race in sctp_free_addr_wq() (CVE-2026-72383) - drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock (CVE-2026-72388) - hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() (CVE-2026-72397) - sctp: add INIT verification after cookie unpacking (CVE-2026-72398) - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (CVE-2026-72404) - bpf: Guard conntrack opts error writes (CVE-2026-72423) - md/raid10: fix writes_pending leak on write request failures (CVE-2026-72439) - md/raid1: fix writes_pending and barrier reference leaks on write failures (CVE-2026-72440) - soundwire: fix bug in sdw_add_element_group_count found by syzkaller (CVE-2026-72488) - net: serialize netif_running() check in enqueue_to_backlog() (CVE-2026-72493) - RDMA/irdma: Replace waitqueue and flag with completion (CVE-2026-72494) - RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (CVE-2026-72495) - RDMA/bnxt_re: Add a max slot check for SQ (CVE-2026-72497) - RDMA/bnxt_re: Free CQ toggle page after firmware teardown (CVE-2026-72499) - RDMA/bnxt_re: Fix budget handling of notification queue - RDMA/bnxt_re: Remove unusable nq variable - RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (CVE-2026-72500) - RDMA/bnxt_re: Initialize dpi variable to zero (CVE-2026-72501) - sockmap: Fix use-after-free in udp_bpf_recvmsg() (CVE-2026-74257) - ALSA: seq: Clean up fifo locking with guard - ALSA: seq: avoid stale FIFO cells during resize (CVE-2026-74261) - net: watchdog: fix refcount tracking races (CVE-2026-74264) - bnxt: fix head underflow on XDP head-grow (CVE-2026-74269) - cxl/region: Block region delete during region creation (CVE-2026-74273) - ixgbe: do not configure xps for XDP queues (CVE-2026-74317) - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time (CVE-2026-74338) - ocfs2: validate fast symlink target during inode read (CVE-2026-74350) - wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (CVE-2026-74368) - md: replace wait loop with wait_event() in md_handle_request() - md/raid1,raid10: fix deadlock in read error recovery path (CVE-2026-74375) - md/raid1,raid10: fix bio accounting for split md cloned bios (CVE-2026-74373) - md/raid1,raid10: fix error-path detection with md_cloned_bio() (CVE-2026-74374) - nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (CVE-2026-74385) - ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (CVE-2026-74388) - OPP: Fix race between OPP addition and lookup (CVE-2026-74405) - wifi: ath11k: cancel SSR work items during PCI shutdown (CVE-2026-74407) - drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (CVE-2026-74449) - [s390x] ap: Move response_type struct into ap_msg struct - [s390x] ap/zcrypt: Rework AP message buffer allocation - [s390x] ap: Introduce ap message buffer pool - [s390x] ap/zcrypt: New xflag parameter - [s390x] zcrypt: Move inline function rng_type6cprb_msgx from header to code - [s390x] zcrypt: Rework domain processing within zcrypt device driver - [s390x] zcrypt: Close speculative mem read possibility (CVE-2026-74466) - afs: Fix UAF when sending a message (CVE-2026-74506) - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (CVE-2026-74513) - [amd64] iommu/iommufd: Fix IOPF group ownership UAF (CVE-2026-74520) - octeontx2-af: Block VFs from clobbering special CGX PKIND state (CVE-2026-74527) - Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (CVE-2026-74529) - Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (CVE-2026-74530) - Bluetooth: ISO: hold sk properly in iso_conn_ready (CVE-2026-74537) - Bluetooth: ISO: lock sk in iso_connect_ind (CVE-2026-74538) - netfs: Fix folio_queue ENOMEM in writeback by adding a mempool (CVE-2026-74542) - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (CVE-2026-74544) - xsk: drain continuation descs after overflow in xsk_build_skb() (CVE-2026-74559) - xsk: provide sufficient space in pool->tx_descs - xsk: reclaim invalid Tx descriptors in ZC batch path (CVE-2026-74558) - btrfs: skip global block reserve accounting for rescue mounts (CVE-2026-74571) - mm/page_table_check: skip special zero mappings (CVE-2026-74600) - eventfs: Use children field for rcu head and add memory barriers (CVE-2026-74605) - tls: rx: restore msg_iter before TLS 1.3 optimistic retry (CVE-2026-74611) - watchdog: at91sam9_wdt: prevent timer rearm during teardown (CVE-2026-74687) - [s390x] ism: Fix UAF of sba and ieq during ism_dev_exit() (CVE-2026-74690) - netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (CVE-2026-74695) - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption (CVE-2026-74697) - hwmon: (pmbus) Fix type confusion in notification logic (CVE-2026-74711) - vhost_iotlb: bound map allocation in add_range (CVE-2026-74713) - bpf: Fix netns reference imbalance in conntrack kfuncs (CVE-2026-74715) - btrfs: lzo: reject inline extents without valid headers (CVE-2026-74723) - xfs: handle NULL b_addr in xfs_buf_free (CVE-2026-74728) - soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read (CVE-2026-74729) - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (CVE-2026-74733) - firewire: ohci: fix NULL pointer dereference in ar_context_release (CVE-2026-74734) - ipvs: revalidate ihl to prevent out-of-bounds access (CVE-2026-74747) - sctp: validate cookie AUTH state before use (CVE-2026-74752) - scsi: core: pair EH runtime PM get and put (CVE-2026-74754) - ASoC: SOF: Relocate and rework functionality for PCM stream freeing - ASoC: SOF: pcm: Move period/buffer configuration print after platform open - ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err() - ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout (CVE-2026-80581) - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg (CVE-2026-80607) - net: ibm: emac: use devm_platform_ioremap_resource - net: ibm: emac: use platform_get_irq - net: emac: Fix NULL pointer dereference in emac_probe (CVE-2026-80614) - ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() (CVE-2026-80616) - coresight: ete: Always save state on power down (CVE-2026-80623) - ALSA: seq: oss: Serialize readq reset state with q->lock (CVE-2026-80628) - btrfs: lzo: reject compressed segment that overflows the compressed input (CVE-2026-80631) - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag (CVE-2026-80634) - EDAC/igen6: Initialize edac_op_state according to the configuration data - EDAC/igen6: Add polling support - EDAC/igen6: Skip absent memory controllers - EDAC/igen6: Fix call trace due to missing release() (CVE-2026-80643) - scsi: hisi_sas: Add slave_destroy interface for v3 hw (CVE-2026-80653) - soc: xilinx: Fix race condition in event registration (CVE-2026-80655) - cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size (CVE-2026-80662) - netfilter: nf_conntrack_expect: use conntrack GC to reap expectations (CVE-2026-80668) - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (CVE-2026-80692) - idpf: bound interrupt-vector register fill to the allocated array (CVE-2026-80693) - dmaengine: idxd: fix double free of wq, engine, and group structs (CVE-2026-80698) - drm/amd/display: check if dml21_add_phantom_plane() is successful (CVE-2026-80705) - btrfs: initialize inode mapping flags for cached inodes (CVE-2026-80734) - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie (CVE-2026-80738) - drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length - drm/amdkfd: Add bounds check for CRAT subtype length (CVE-2026-80747) - Bluetooth: ISO: zero the sockaddr before returning it in getname (CVE-2026-80761) - fbdev: Wrap user-invoked calls to fb_set_var() in helper (CVE-2026-80786) - tipc: avoid busy looping in tipc_exit_net() (CVE-2026-80866) - NTB: core: Add .get_dma_dev() callback to ntb_dev_ops - NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers - ntb: Store original DMA address for future release (CVE-2026-80884) - tap: Keep hdr_len in tap_get_user() - net: tap: fix wrong transport_header when sending VLAN-tagged frame (CVE-2026-80905) - io_uring: defer eventfd signaling when queued from a wakeup handler (CVE-2026-80920) - wifi: iwlwifi: dvm: pair transport op-mode enter/leave - wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() (CVE-2026-80948) - svcrdma: Reject Read lists that exceed the page budget (CVE-2026-89528) - svcrdma: Add Write chunk WRs to the RPC's Send WR chain - svcrdma: wake sq waiters when the transport closes - svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (CVE-2026-89534) - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 (CVE-2026-89537) - ext2: Fix lost inode updates for IS_SYNC inodes (CVE-2026-89601) - smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (CVE-2026-89642) - ceph: cap delegated inode count in ceph_parse_deleg_inos() (CVE-2026-89648) - ceph: fix UAF in check_new_map() on session freed during unlock (CVE-2026-89654) - nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net (CVE-2026-89682) - nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (CVE-2026-89705) - lockd, nfsd: RCU-protect nlmsvc_ops dispatch (CVE-2026-89709) - mm/mglru: reset page lru tier bits when activating - mm/mglru: use the common routine for dirty/writeback reactivation - mm/mglru: fix and remove redundant unevictable folio handling (CVE-2026-89757) - ksmbd: fix tree connection use-after-free in smb2_tree_connect() (CVE-2026-89788) - drm/amdkfd: Fix partial migrate issue - drm/amdkfd: return migration pages from copy function - Revert "drm/amdkfd: return migration pages from copy function" - drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram (CVE-2026-89808) - drm/amdkfd: return migration pages from copy function - again - drm/amdkfd: Fix error path at svm_migrate_copy_to_ram (CVE-2026-89810) - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811) - drm/amdgpu: force complete the MES ring fences on reset (CVE-2026-89812) - drm/amdgpu: force complete the KIQ ring fences on reset (CVE-2026-89813) - f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() (CVE-2026-89833) - [arm64] KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (CVE-2026-89913) - [s390x] KVM: s390: Fix memory corruption by not reinjecting CK machine checks (CVE-2026-89920) - mm/huge_memory: transfer the pmd dirty bit to the folio on zap (CVE-2026-89987) - netfilter: nf_tables: prefer nft_trans_elem_alloc helper - netfilter: nf_tables: add nft_trans_commit_list_add_elem helper - netfilter: nf_tables: prepare for multiple elements in nft_trans_elem structure - netfilter: nf_tables: skip double clone set expressions on element insert (CVE-2026-90061) - net_sched: sch_fq: add three drop_reason - net/sched: add qstats_cpu_drop_inc() helper - net/sched: act_ife: Only operate on Ethernet frames (CVE-2026-90083) - octeontx2-vf: fix workqueue and netdev race in probe/remove (CVE-2026-90084) - xsk: honor XDP_TX_METADATA in zero-copy path (CVE-2026-90086) - Bluetooth: do not leak an hci_conn when a second LE connect is rejected (CVE-2026-90087) - net: add getsockopt_iter callback to proto_ops - Bluetooth: L2CAP: convert to getsockopt_iter - Bluetooth: L2CAP: access chan->conn safely in get/setsockopt (CVE-2026-90093) - Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (CVE-2026-90097) - net/sched: account classifier filter allocations to memcg (CVE-2026-90099) - NFSv4.1: zero referring call lists before decoding (CVE-2026-90104) - vxlan: fix reading neigh ha (CVE-2026-90105) - net: bridge: arp/nd proxy: fix reading neigh ha (CVE-2026-90106) - ip6mr: do not clone dst in ip6mr_cache_report() (CVE-2026-90111) - ALSA: mtpav: shut down output timer before card teardown (CVE-2026-90116) - virtio_net: Fix resize of the RX ring (CVE-2026-90142) - dpll: fix NULL deref in dpll_device_ops() during teardown race (CVE-2026-90144) - bpf, xdp: move offload check into dev_xdp_install() - NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (CVE-2026-90149) - ksmbd: scope session state changes to bound connections (CVE-2026-90154) - ksmbd: detach blocked lock requests before freeing (CVE-2026-90155) - ksmbd: safely discard unregistered deferred locks (CVE-2026-90156) - erofs: fix interlaced ztailpacking pclusters (CVE-2026-90161) - ksmbd: defer publishing granted locks to prevent UAF/double-free race (CVE-2026-90162) - ksmbd: serialize oplock close with pending break ownership (CVE-2026-90167) - ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() (CVE-2026-90174) - bpf: Check pointer type for all atomic RMW paths (CVE-2026-90177) - apparmor: fix deadlock in complain-mode change_hat (CVE-2026-90179) - blk-cgroup: delay freeing policy data after rcu grace period - blk-iocost: clear delay state when freeing policy data (CVE-2026-90182) - blk-iolatency: clear delay state when freeing policy data (CVE-2026-90183) - ocfs2: validate DIO orphan slot during inode read (CVE-2026-90204) - ocfs2: validate orphan slot during inode read (CVE-2026-90205) - nvmet: fix max_qid race between configfs and controller allocation (CVE-2026-90206) - clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type (CVE-2026-90208) - bpf: Compare iterator types during state pruning (CVE-2026-90217) - apparmor: fix unconfined user namespace restriction forced stack (CVE-2026-90231) - amt: Don't support cross-netns setup. (CVE-2026-90232) - NFS: Return a delegation the client fails to record (CVE-2026-90234) - [amd64] iommu/vt-d: Flush context cache with correct SID when tearing down aliases (CVE-2026-90240) - bpf: Fix mmap_lock leak in irq_work path (CVE-2026-90247) - Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (CVE-2026-74533) - Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind (CVE-2026-90256) - btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (CVE-2026-90259) - btrfs: zoned: don't clobber the extent buffer when zeroing it out (CVE-2026-90260) - btrfs: check if root is readonly when setting posix acl (CVE-2026-90263) - btrfs: always wait for ordered extents to avoid OE races (CVE-2026-90264) - btrfs: defrag: fix deadlock between defrag and delalloc space reservation (CVE-2026-90265) - scsi: sd: Move the sd_config_discard() function definition - scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails (CVE-2026-90267) - coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable (CVE-2026-90273) - drm/amd/display: disable replay when crc source is enabled - drm/amd/display: Resize MST HDCP per-connector arrays to 32 (CVE-2026-90289) - bpf: Factor callchain_store function from __bpf_get_stack - bpf: Factor callchain_finalize function from __bpf_get_stack - bpf: Remove trace_in argument from __bpf_get_stack - bpf: Clear buf on error in __bpf_get_task_stack (CVE-2026-90300) - ocfs2/heartbeat: fix slot mapping rollback leaks on error paths - ocfs2: o2hb: quiesce negotiate handlers and timeout work (CVE-2026-90301) - thermal: hwmon: Remove hwmon class device along with its parent (CVE-2026-90311) - ocfs2: validate inline xattrs during inode block validation (CVE-2026-90321) - ublk: check import_ubuf() return value (CVE-2026-90324) - blk-cgroup: fix race between policy activation and blkg destruction (CVE-2026-90326) - HID: steam: Reject short reads (CVE-2026-90328) - HID: logitech-hidpp: Fix FF device cleanup on init failure (CVE-2026-90330) - tty: skip cdev_del() when no cdev is registered (CVE-2026-90335) - serial: core: clear freed pointers on uart_register_driver() failure (CVE-2026-90336) - serial: core: do fallible allocations before the console can be registered (CVE-2026-90337) - wifi: cfg80211: stop PMSR before P2P and NAN teardown (CVE-2026-90343) - wifi: brcmfmac: fix P2P action frame handling without device vif (CVE-2026-90345) - wifi: nl80211: check link is beaconing for color change - wifi: nl80211: clean up color-change beacon data on errors (CVE-2026-90346) - [arm64] ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry (CVE-2026-90347) - wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed (CVE-2026-90351) - bpf: Reject >8 byte return values on return-reading trampoline paths (CVE-2026-90359) - drm/msm: don't tear down KMS twice when KMS init fails (CVE-2026-90363) - wifi: mt76: cancel reset and rc work on device unregister (CVE-2026-90365) - wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER (CVE-2026-90367) - wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() (CVE-2026-90408) - [amd64] drm/i915: rename range_overflows_end() to range_end_overflows() - [amd64] drm/i915: document range_overflows() and range_end_overflows() macros - overflow: add range_overflows() and range_end_overflows() - drm/panthor: Add vm_bind region with kbo range overlap check (CVE-2026-90409) - RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (CVE-2026-90417) - PCI: Make pci_match_one_device() match on ID instead of device - PCI: Fix dyn_id add TOCTOU - PCI: Fix UAF when probe runs concurrent to dyn ID removal (CVE-2026-90421) - clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path (CVE-2026-90422) - iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path (CVE-2026-90424) - iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() (CVE-2026-90427) - scsi: ufs: core: Convert string descriptor format macros to enum - scsi: ufs: core: Validate string descriptors (CVE-2026-92480) - pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (CVE-2026-92482) - bpf: Fix WARNING in bpf_tracing_link_release (CVE-2026-92485) - ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (CVE-2026-92503) - bpf: Zero queue and stack outputs on lock failure (CVE-2026-92520) - drm/sched: Use struct for drm_sched_init() params - drm/msm: Only fini scheduler after successful init (CVE-2026-93058) - firmware: arm_scmi: Fix SCMI device destroy lifetimes (CVE-2026-93081) - fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() (CVE-2026-93100) - RDMA/rvt: Return NULL after port allocation failure (CVE-2026-93104) - esp: do not unref managed frag pages in esp_ssg_unref() (CVE-2026-93105) - platform/x86: asus-wmi: fix resource leaks on probe failure (CVE-2026-93116) - usb: gadget: uac: validate rate list length before storing (CVE-2026-93122) - bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max (CVE-2026-93125) - [amd64] platform/x86: dell-wmi-base: Fix handling of ultra performance key (CVE-2026-93129) - bpf: Reject writes through untrusted BTF pointers (CVE-2026-93144) - time/namespace: Validate nanosecond field in proc_timens_set_offset() (CVE-2026-93146) - bpf: Reject MEM_ALLOC BTF accesses past object bounds (CVE-2026-93148) - dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (CVE-2026-93168) - drm/amd/display: Fix dangling pointer in CRTC reset function (CVE-2026-93175) - drm/amd/display: Fix dangling pointer in plane reset function (CVE-2026-93176) - mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() (CVE-2026-93216) - nfsd: convert nfsd_net boolean flags to unsigned long flags word (CVE-2026-93221) - mm/hugetlb: refactor code around vmemmap_walk - mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier (CVE-2026-93230) - ACPI: bus: Introduce acpi_bus_get_primary_device() (CVE-2026-93251) - powerpc/xive: add error return value to xive_smp_probe() - powerpc/xive: propagate IPI init errors to prevent use-after-free (CVE-2026-93260) - remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 (CVE-2026-93272) - ksmbd: remove redundant DACL check in smb_check_perm_dacl - ksmbd: fix maximum allowed access checks (CVE-2026-93282) - drm/amdkfd: fix SMI event cross-process information leak (CVE-2026-97422) - drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support - drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq (CVE-2026-97424) - wifi: iwlwifi: simplify nested if checks - wifi: iwlwifi: mvm: fix P2P-Device binding handling (CVE-2026-97432) - RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (CVE-2026-97477) - virt: acrn: Remove unused list 'acrn_irqfd_clients' - virt: acrn: Fix irqfd use-after-free during eventfd shutdown (CVE-2026-97478) - PM: sleep: core: Synchronize runtime PM status of parents and children - PM: sleep: core: Restrict power.set_active propagation - PM: Rearrange documentation related to __pm_runtime_disable() - PM: Block enabling of runtime PM during system suspend - PM: runtime: Introduce pm_runtime_blocked() - PM: sleep: Use DPM_FLAG_SMART_SUSPEND conditionally - PM: sleep: Fix bit masking operation - driver core: Add device_link_test() for testing device link flags - driver core: Avoid warning when removing a device while its supplier is unbinding (CVE-2026-97479) - serial: 8250: invert serial8250_register_8250_port() CIR condition - tty: serial: 8250: protect against NULL uart->port.dev in register (CVE-2026-97480) - drm/amdgpu: Remove unused amdgpu_i2c functions - drm/amdgpu/atombios: drop empty function - drm/amdgpu: rework i2c init and fini - drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493) - gpiolib: make value setters have return values - gpiolib: wrap gpio_chip::set() - gpiolib: rework the wrapper around gpio_chip::set_multiple() - gpiolib: introduce gpio_chip setters that return values - pinctrl: mediatek: paris: don't double-check the GPIO number - pinctrl: mediatek: paris: use new GPIO line value setter callbacks - pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction (CVE-2026-97501) - genirq/proc: Switch to lock guards - genirq: Consistently use '%u' format specifier for unsigned int variables - genirq/proc: Size interrupt directory names for 10-digit interrupt numbers (CVE-2026-97503) - media: chips-media: wave5: Release m2m_ctx after Instance Removed from List (CVE-2026-97513) - i3c: master: svc: Fix npcm845 FIFO empty issue - i3c: master: svc: Fix npcm845 invalid slvstart event - i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 (CVE-2026-97515) - hwmon: (asus_rog_ryujin) Rely on subsystem locking - hwmon: (asus_rog_ryujin) Add per-device configuration - hwmon: (asus_rog_ryujin) Validate HID report lengths (CVE-2026-97538) - smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() (CVE-2026-97554) - smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid (CVE-2026-97561) - drm/amdgpu: skip the VMID 0 flush for VRAM (CVE-2026-97928) - [amd64] perf/x86/intel: Prevent drain_pebs() reentry (CVE-2026-97960) - net/mlx5e: Move representor vnic reporter to eswitch devlink port (CVE-2026-97962) - Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() (CVE-2026-97975) - vhost: invalidate vring access on IOTLB transitions (CVE-2026-97988) - vduse: validate virtqueue alignment (CVE-2026-97989) - virtio_ring: fix stale descriptor flags after a failed packed add (CVE-2026-97997) - [amd64] iommu/amd: Do not reallocate GA log buffers on resume (CVE-2026-98003) - bpf: mark a NULL call argument precise (CVE-2026-98019) - tracing: Fix subbuf resize races with trace_pipe_raw readers (CVE-2026-98032) - bpf: Preserve inner map identity in callback frames (CVE-2026-98033) - bpf: Mark NULL kptr stores precise (CVE-2026-98034) - bpf: Keep refcount_acquire nullable for borrowed RCU kptrs (CVE-2026-98038) - bpf: Don't infer non-NULL from a pointer with an unbounded offset (CVE-2026-98043) - bpf: Reject legacy packet loads from callbacks (CVE-2026-98044) - bpf: Check ancestor frames for rbtree callbacks (CVE-2026-98047) - bpf: don't rewrite bpf_fastcall patterns entered by a jump (CVE-2026-98048) - bpf: zero extend the result of an arena 32-bit cmpxchg (CVE-2026-98049) - [amd64] ASoC: Intel: avs: Refactor and fix init_config access (CVE-2026-98053) - bpf: Mark syscall helpers as sleepable (CVE-2026-98058) - bpf: Mark signal tracepoint siginfo arguments as scalar (CVE-2026-98062) - erofs: disable LZ4 rolling decompression for now (CVE-2026-98067) - net: rename netns_local to netns_immutable - net: plumb extack in __dev_change_net_namespace() - net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). (CVE-2026-98073) - btrfs: zstd: fix lost wakeup when waiting for a workspace (CVE-2026-98079) - bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks (CVE-2026-98084) - bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge (CVE-2026-98085) - ipv6: mcast: use rcu_assign_pointer() for __rcu list updates (CVE-2026-98099) - smb/client: invalidate fscache for fallocate range operations (CVE-2026-98124) - net: stmmac: fix dma mapping leak in stmmac_tso_xmit() (CVE-2026-98131) - bpf: check_cond_jmp_op(): properly infer if register is null (CVE-2026-98134) - printk: Don't WARN on kthread_run failure. (CVE-2026-98147) - drm/gud: validate GUD_ROTATION_0 is present in supported rotations (CVE-2026-98148) - drm/virtio: Use drm_gem_plane_helper_prepare_fb() - drm/virtio: Add a helper to map and note the dma addrs and lengths - drm/virtio: use the DMA API for resource backing on Xen (CVE-2026-98156) - functionfs: fix the open/removal races (CVE-2025-71074) - ACPI: platform: Use acpi_bus_get_primary_device() (CVE-2026-100072) - [amd64] KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT (CVE-2026-46032) - greybus: raw: fix use-after-free if write is called after disconnect (CVE-2026-53024) - firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor - firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation (CVE-2026-68400) - pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI (CVE-2026-72009) - cxl/region: Resolve region deletion races (CVE-2026-74272) - bpf: Remove migrate_{disable|enable} in bpf_obj_free_fields() - bpf: Clear rb node linkage when freeing bpf_rb_root (CVE-2026-74344) - ocfs2: validate external xattr entries when reading metadata (CVE-2026-90320) - dm-integrity: replace forgeable discard filler with a keyed sector marker (CVE-2026-90333) - [amd64] perf/x86/intel/uncore: Fix uncore_box ref/unref ordering (CVE-2026-93181) - i3c: master: Fix recursive locking during device registration (CVE-2026-93202) - xfs: remove unused trace event xfs_dqreclaim_dirty - ublk: fix dead loop when canceling io command - riscv: uaccess: Only restore the CSR_STATUS SUM bit - [s390x] kvm: Initialize uninitialized flags variable - [s390x] KVM: s390: wrapper for KVM_BUG - [s390x] KVM: s390: move pv gmap functions into kvm - [s390x] KVM: s390: use __kvm_faultin_pfn() - [s390x] KVM: s390: move gmap_shadow_pgt_lookup() into kvm - [s390x] KVM: s390: pv: fix race when making a page secure - [s390x] KVM: s390: Fix FOLL_*/FAULT_FLAG_* confusion - [s390x] kvm: Mask extra bits from program interrupt code - scsi: ufs: qcom : Fix NULL pointer dereference in ufs_qcom_setup_clocks - accel/ivpu: Fix race condition when mapping dmabuf - [amd64] KVM: SEV: Drop FOLL_WRITE for encrypted region registration - net: Fix wild-memory-access in __register_pernet_operations() when CONFIG_NET_NS=n. - mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi(). - media: verisilicon: Fix kernel panic due to __initconst misuse - soc/tegra: pmc: Document tegra_pmc.syscore field - soc/tegra: pmc: Add kerneldoc for wake-up variables - i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring - ceph: do not skip the first folio of the next object in writeback - ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error - ceph: introduce ceph_submit_write() method - ceph: always call ceph_shift_unused_folios_left() - spi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback - sched/psi: Create the psimon kthread outside of cgroup_mutex - ocfs2: use correct endian in ocfs2_dinode_has_extents - netfs: release readahead folios on iterator preparation failure - netfs: Fix folio state after ENOMEM whilst under writeback iteration - net: do not acquire dev->tx_global_lock in netdev_watchdog_up() - [s390x] zcrypt: Fix memory leak with CCA cards used as accelerator - EDAC/igen6: Fix the flood of invalid error reports - netfilter: ctnetlink: do not expose expectation DEAD flag - EDAC/igen6: Fix NULL pointer dereference - Revert "esp: do not unref managed frag pages in esp_ssg_unref()" - mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback - PM: sleep: Unblock runtime PM when device prepare fails - soundwire: intel_auxdevice: Fix system suspend/resume handling - gpiolib: Allow to use setters with return value for output-only gpios - gpiolib: initialize return value in gpiochip_set_multiple() - i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845 - i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk - i3c: master: svc: Fix i3c_master_get_free_addr return check - tracing: Fix ring_buffer_read_page_size() kernel-doc - tracing: Fix comment in tracing_buffers_splice_read() - dm-integrity: fix buffer overflow with keyed discard - bpf, sockmap: Account for receive queue in FIONREAD without a verdict program - wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses" (Closes: #1151097) - [s390x] uv: Don't return 0 from make_hva_secure() if the operation was not successful - drm/panfrost: Fix scheduler workqueue bug - ksmbd: fix heap out-of-bounds write in krb5_authenticate() - [amd64] KVM: x86: Use active memslots for the per-vCPU MMIO cache https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.115 - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup - rose: disconnect orphaned STATE_2 sockets when device is gone - rose: release netdev ref and destroy orphaned incoming sockets - rose: clear neighbour pointer in rose_kill_by_device() - rose: don't free fd-owned sockets when reaping in the heartbeat - rose: keep the route needed for routing loop detection - rose: guard rose_transmit_link() against a NULL neighbour - rose: use timer_shutdown_sync() for t0timer teardown - rose: don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3 - rose: hold a reference on incoming sockets queued for accept() - ax25: bound REJ-driven fast retransmits with the existing N2 counter - rose: purge rose_neigh->queue on final teardown - mptcp: move the OoO check back into __mptcp_try_fallback() - fat: stop reading directory entries past the end-of-directory marker - [arm64,armhf] soc/tegra: fuse: Add missing newline to APBMISC error message - power: supply: Fix maintenance charge table kernel-doc - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value - Drivers: hv: Avoid infinite retry loop in init_vp_index() - [amd64] x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() - Drivers: hv: Don't reset VMBus connection state on error/exit paths (CVE-2026-99216) - pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13 - tools/power turbostat: Fix fd_perf leak on reset - tools/power turbostat: Fix add_counter issue if > 24 counters. - power: supply: generic-adc-battery: Fix temperature IIO channel conversion - pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12 - drm/vc4: hdmi: Move packet RAM enable to PM runtime (CVE-2026-99214) - vsock: treat TCP_CLOSING as once-established (CVE-2026-99213) - net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure (CVE-2026-99212) - [amd64] ASoC: Intel: avs: Reset the stream unless it is already prepared - [armhf] ASoC: stm32: spdifrx: fix synchronization state check - regcache: Add ->populate() callback to separate from ->init() - regcache: Do not overwrite error code when finalizing cache after error - regmap: Drop map lock during cache init and exit - netlink: reset skb headers before unicast and multicast filtering (CVE-2026-99211) - [arm64,armhf] spi: tegra114: assert CS GPIO for every transfer in a message - scsi: st: Save the visited block for the partition the drive is in - scsi: target: iscsi: Fix race in discovery auth updates (CVE-2026-99206) - ocfs2/dlm: Protect the recovery list during debugfs reads (CVE-2026-99204) - pipe: preserve existing fasync readers on writer setup failure (CVE-2026-99203) - tracing: probes: error if BTF is required but unavailable - scsi: libsas: Fix SMP IO deadlock during HA resume (CVE-2026-99202) - netlink: avoid hashing the network namespace pointer (CVE-2026-99201) - net: bcmgenet: unshare the skb before writing the control block (CVE-2026-99192) - net/ipv6: Introduce payload_len helpers - calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() (CVE-2026-99191) - gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths (CVE-2026-99190) - gpio: mxc: use lock guards for the generic GPIO chip lock - gpio: mxc: fix both_edges bit operations - gpio: mxc: use BIT() macro - gpio: mxc: fix wakeup_pads bit operations - perf: Fix perf_pmu_migrate_context() leaving events behind (CVE-2026-99187) - printk: Postpone kthread startup - PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV (Closes: #1112238) - afs: free the super info after a grace period - autofs: ignore notification errors from a replaced pipe (CVE-2026-99181) - unicode: free the map after a grace period (CVE-2026-99180) - [amd64] x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context (CVE-2026-99178) - [amd64] KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry (CVE-2026-99176) - fsnotify: prevent mark additions during connector teardown (CVE-2026-99175) - pid_namespace: make zap_pid_ns_processes() freezable - eventfs: Free the eventfs_inode after an rcu grace period too (CVE-2026-99173) - namei: test for a negative dentry the way traverse_mounts() does - net/sched: fix use-after-free in __tcf_action_put() (CVE-2026-99167) - net: rds: fix uninitialized trans dereference in CM event handler (CVE-2026-99166) - pinctrl: amd: Clear S4 wake bits when firmware has _AEI - sctp: revalidate output stream after association connect wait (CVE-2026-99165) - tools: gpio: fix building from the top level with O= - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields (CVE-2026-99163) - i2c: qcom-cci: Fix HALT_ACK reset request being dropped - perf: Update cgroup time when rotating multiplexed events - ring-buffer: Do not show buffer_meta for CPUs without a buffer (CVE-2026-99160) - ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() (CVE-2026-99159) - ring-buffer: Fix false warning in ring_buffer_map_get_reader() (CVE-2026-99158) - scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies (CVE-2026-99157) - scsi: xen/scsifront: Check for a NULL shadow entry on a backend response (CVE-2026-99155) - scsi: libiscsi: Reject a negative task index from parse_pdu_itt (CVE-2026-99154) - scsi: libiscsi: Validate the ITT reflected in a Reject PDU (CVE-2026-99153) - scsi: libiscsi: Validate the task named by a management response (CVE-2026-99152) - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr (CVE-2026-99150) - drm/exec: don't immediately add prelocked obj to array of locked objs (CVE-2026-99147) - tracing: Fix the shift out of bounds in the log2 histogram modifier - tracing: Take trace_types_lock when dropping the buffer_meta reference - tracing: Check operator stack capacity before pushing (CVE-2026-99142) - tracing: Do not initialize tracefs work if tracing is disabled - tracing: Fix hist trigger timestamps for buffered events (CVE-2026-99140) - wifi: p54: validate firmware record lengths (CVE-2026-99100) - tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) (CVE-2026-99139) - tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) (CVE-2026-99138) - cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children - dm cache: fix demotion stats in passthrough mode - dm cache: fix issue with background work locking - dm-crypt: fix a tiny race condition in crypt_dec_pending (CVE-2026-99136) - dm-ebs: fix incorrect device offset check in ebs_ctr() - dm-integrity: fix infinite loop on discard with large tag size (CVE-2026-99135) - dm-integrity: require stable writes for internal hash modes - mac802154: fix data race and NULL deref on local->assoc_dev (CVE-2026-99134) - net/iucv: fix the recvmsg window update (CVE-2026-99133) - xfs: fix capability check in xfs (CVE-2026-99131) - workqueue: Use raise_softirq() to trigger softirq in irq_work handler - tipc: protect node reset trace dump with node lock - sctp: validate chunk length in the inqueue parser (CVE-2026-99128) - page_pool: keep frag_offset aligned for odd-sized requests (CVE-2026-99127) - [s390x] ctcm: Prevent XID null dereference (CVE-2026-99126) - [s390x] pci: Fix leak of uninitialized kernel data in SCLP report (CVE-2026-99124) - ipv4: avoid divide by zero in fib_rebalance (CVE-2026-99121) - drm/amdgpu: Fix VCE 3 ring align_mask - mm, madvise: fix potential workingset node list_lru leaks (Closes: #1151281) - mm/huge_memory: initialise workingset state before folio split - [s390x] Revert "s390/mm: Add missing secure storage access fixups for donated memory" - netfilter: nft_byteorder: remove multi-register support - mm/huge_memory: bypass THP tuneables for huge pfnmap mappings - [amd64] KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots - net: bridge: mcast: don't truncate the port group walk on teardown (CVE-2026-99117) - ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION (CVE-2026-99115) - ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION (CVE-2026-99114) - ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in (CVE-2026-99113) - net/sched: cls_flower: validate mask pointer after nla_next() (CVE-2026-99112) - smb: client: fix heap overflow in cifs_do_set_acl() (CVE-2026-99110) - smb: client: fix multiuser mount with krb5 - scsi: st: Fix use-after-free race between st_remove() and st_open() (CVE-2026-99156) - perf: Track the perf mlock gift separately - eventfs: fix SRCU read lock leak in eventfs_iterate() - net: call getsockopt_iter if available - kernel/watch_queue: Use pipe_buf() to retrieve the pipe buffer - watch_queue: Fix note pool publication race in watch_queue_set_size() (CVE-2026-99179) - ntfs3: free the sbi after a grace period (CVE-2026-99171) - ext4: free the sbi after a grace period (CVE-2026-99174) - [amd64] ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture (CVE-2026-99182) - drm/xe: Bump LRU for external objects on exec and rebind - tracing: Keep the predicate limit separate from program capacity (CVE-2026-99143) - io_uring/cancel: don't spin on local work the task can't run (CVE-2026-99130) - virtio: set skb owner of virtio_transport_reset_no_sock() reply - vsock/virtio: validate packet source for connected sockets (CVE-2026-99123) - ipv4: udp: Create exceptions before socket matching (CVE-2026-99077) - workqueue: release pwq pools by pool type - workqueue: Fix unbound pool lifetime for pending pwqs (CVE-2026-99103) - i2c: viai2c-wmt: Replace dev_err() with dev_err_probe() in probe function - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() (CVE-2026-99161) - futex: Fix mm reuse handling for FUT_OFF_MMSHARED (CVE-2026-99169) - [amd64] drm/i915/dmc: Harden DMC firmware payload parsing (CVE-2026-99118) - tracing: Fix ignored return value of resize_buffer_duplicate_size() - drm/amdgpu: free the userptr ranges when a CS fails after parser_bos (CVE-2026-99106) - sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ (CVE-2026-99105) - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() - xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf (CVE-2026-99132) - rose: clear stale N(R)/N(S) before (re)transmitting a data frame - netrom: linearize and validate lengths in nr_rx_frame() - netrom: require full NET/ROM headers in nr_route_frame() - net: netrom: validate source address in nr_find_socket() - netrom: bound fragment reassembly in nr_queue_rx_frame() - ax25: fix OOB read after address header strip in ax25_rcv() - ax25: check frame length in ax25_decode() and ax25_rx_iframe() - net: ax25: fix integer overflow in ax25_rx_fragment() - netrom: use a single lock for the node and neighbour lists - netrom: look up and update routes in one critical section - netrom: fix reference count leak in nr_rt_device_down - netrom: clear nr_neigh->ax25 under the routing lock in nr_link_failed() - netrom: fix nr_node leak when nr_del_node() removes the last route - rose: clear through routes when a neighbour is removed from the tables - rose: restart the link of a neighbour created over a live AX.25 connection - ax25: serialise the transmission of I frames on a connection - rose: process received frames and send with the socket locked - ax25: don't create two connections for the same link in ax25_send_frame() - ax25: read the connection's ax25_dev only once when walking ax25_list - ax25: wait for ax25_send_frame() before detaching the connections of a device - ax25: don't accept frames on a device that is going down - ax25: send a private copy of each I frame - rose: clear the circuits of a neighbour that restarts the link - ax25: send unacknowledged I frames again when a link is re-established - rose: bring up the link of the preferred route passed over by a connect request - ax25: don't free an incoming SABM skb left on the listener's queue - mm/pagewalk: fix stale walk->action escaping walk_pmd_range() - block: avoid potential deadlock on zone revalidation failure - Revert "srcu: Use irq_work to start GP in tiny SRCU" - net_sched: codel: fix stale state for empty flows in fq_codel - Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn - tracing: Reject incomplete event filter expressions - tracing: Save the event file instead of the compatible histogram - tracing: Unregister field variable histograms when the command fails - tracing: Fix 64-bit and signed histogram fields on 32-bit kernels - tracing/histograms: Verify event_call identity when updating synth_event refcount - io-wq: order the exit bit against worker creation task work - io_uring/waitid: own the request before clearing ->head - io_uring/cmd: don't leave list poison in ->hash_node - io_uring/wait: don't spin on a stuck overflow list - io_uring/io-wq: don't lose the signal that ends work - io_uring/io-wq: don't hide a link from cancellations - io_uring: don't flood a cancelling task with task_work - io_uring/io-wq: don't strand work when a worker exits - io_uring/io-wq: don't exit with a creation pending - io_uring/io-wq: let cancel find picked up hashed work - io_uring/poll: don't lose a cancel as io-wq arms poll - io_uring: don't lose a cancel as io-wq parks a request - io_uring/cancel: don't forget that the work was running - io_uring/cancel: recognize "no timeout" on 32-bit - io_uring/cancel: let CANCEL_ALL find parked requests - io_uring: wake ring pollers for local task_work - io_uring/wait: look at all CQ waiters on wake up - io_uring/poll: drop stale double poll entry on rearm - io_uring/timeout: don't skip over reached sequences - io_uring/timeout: keep repeat count on multishot update - io_uring/wait: no early -ETIME if min_wait finds work - io_uring/napi: make stale entries time out after 60s - io_uring/napi: don't busy poll past an expired timeout - io_uring/kbuf: handle index wrap in last buffer check - io_uring/sqpoll: let the thread sleep on disabled rings - io_uring: don't pass restart error codes to userspace - io_uring/net: don't retry recv on uncommitted buffers - io_uring/timeout: no ABS update of multishot timeouts - io_uring/timeout: don't end a linked timeout with 1 - io_uring: look up the file before queueing to io-wq - io_uring/poll: avoid retry wakeup loss when dropping ownership - io_uring/timeout: don't put a sequence target behind the last flush - io_uring/timeout: don't flush with the sequence behind the last flush - io_uring/timeout: don't lose a cancel as io-wq arms a timeout - io_uring/poll: don't loop on HUP with multiple references - io_uring/net: keep recv buffer select length within MAX_RW_COUNT - io_uring/wait: wake real-time waiters from hard interrupt context - io_uring/waitid: prevent cancel reference wrap - keys: Avoid the owner account dereference in named keyring lookup - keys: Check the authorization payload in process keyring searches - keys: Protect the type name while describing a key - keys: make keyring indexes independent of kernel addresses - keys: Protect the read method check against type removal - KEYS: Fix key_reject_and_link() race with keyring restriction - KEYS: trusted: Fix blob allocation size in tpm2_key_decode() - keys/trusted_keys: return immediately after TPM unseal failure - asymmetric_keys: reject trust keys without IDs - ftrace: Initialize modname and offset in print_rec() - coredump: hold RCU while releasing parked threads - signal: don't retarget shared signals in a dying thread group - signal: only SIGKILL and the freezers interrupt a coredumping task - ptrace: refuse to change the signal mask of a user worker - fork: release the files of a failed fork after sched_cancel_fork() - signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL - pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper . [ Salvatore Bonaccorso ] * net: skbuff: propagate shared-frag marker in skb_zerocopy() Checksums-Sha1: d0d8e5faa99b328f43d45a7d1c857b3687c3425b 290418 linux_6.12.115-1.dsc 02528e4e7d8126b880cec2c89e86447785289eaa 151676884 linux_6.12.115.orig.tar.xz 4bc10f6ef66d535fe4e80d9fa70d5bac722871ee 1975748 linux_6.12.115-1.debian.tar.xz 9506317fe7a88dc389cb5603b235861c5ff3c788 6025 linux_6.12.115-1_source.buildinfo Checksums-Sha256: 88cb3f116bba951bfc3786419d7eb720ff63dfe5978234ebe5db19f0b72fefb6 290418 linux_6.12.115-1.dsc eaccd6c987f438de08039859df5507600a31245bb041ca62f2ef3fd30bd2172d 151676884 linux_6.12.115.orig.tar.xz da0983b129749db052011c073cca26eaa71c6344a5e3e610d0611743e7fbf1cb 1975748 linux_6.12.115-1.debian.tar.xz 2c931abfb8d21629b836990d51355820f8b6d81e202582e6bfa7c979642b95c2 6025 linux_6.12.115-1_source.buildinfo Files: d46ae1ec2e35bbcc9785a669a5c9e965 290418 kernel optional linux_6.12.115-1.dsc 7d3010cfdb5536a721a6454314852c6b 151676884 kernel optional linux_6.12.115.orig.tar.xz f1e32176c3ccb5f43e0da05779cd7e59 1975748 kernel optional linux_6.12.115-1.debian.tar.xz 1b33191cb509647e251ed6004d7eb469 6025 kernel optional linux_6.12.115-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrmAOdfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89E8o0P/2iU8lF+/31Zz03v8XLtuTscX5bcH5PZ IVxOBGOd7LV3wqxERjF6x7gwhZcBCnYI/34UnaDLQaEv8IZiqLdteMIsxzv+BGKL TJq6JRVacrJc3mMQEY/K8I0/lwxLEmbaCgh6A2Cx1SkjeRB92R7InH8sNsBmChbg rBr9xNDgbCqf+GuFFj5aVt8FPubcUtkewlZA/wAvuZWE9u+irb96TussPz1gJXnX MDNX+5uBJvUDRWsSUu8O0eqUgk1gsZbYnWz4kk0iksDkes0OsM2mf/6xeelUehe8 GBG1ab77tvaMf1g2WsYiy4snt4ywbd6i1ebQ9Xu2BjuoRpmWs/T2x0TktcxS/F1g 9R6c2FYdxiQS3YmmTSdig1IDDG2HSsGYzJMIAmA6LpzR8tYkj5Vl3by55fA8KxeV thWN/xz0+AFSz6GWqGftgfHr/PGcsUFsk1PXFgLyI1R79D+ze9FoRWd9mkIqYlJQ o+9sBR7fqFumD3YMmFbAOeTppyepx5efb2kurORhlGqvsoqiRORHVDwb6VXIeVVE ufEYHrvmFseMevnkp9NdxSh8W9hxPd0qyWjc+H+s2ejxWi/Wt1ACuFZS4s1cHc/o ZRWI9LvopcONd8FYA8bxEn9Ol7sicvJSrIFkCWgsEJ+Z6LOS9ePrJAF6xYqGM3Rc /1FPFZcDwcWv =4qvr -----END PGP SIGNATURE-----
