{ "cves": [ "CVE-2024-58096", "CVE-2024-58097", "CVE-2025-21717", "CVE-2025-21882", "CVE-2025-37929", "CVE-2025-38431", "CVE-2025-39832", "CVE-2025-40082", "CVE-2025-68333", "CVE-2025-68351", "CVE-2025-68358", "CVE-2025-68365", "CVE-2025-68725", "CVE-2025-68737", "CVE-2025-68749", "CVE-2025-68823", "CVE-2025-71197", "CVE-2025-71200", "CVE-2025-71203", "CVE-2025-71204", "CVE-2025-71220", "CVE-2025-71222", "CVE-2025-71223", "CVE-2025-71224", "CVE-2025-71225", "CVE-2025-71229", "CVE-2025-71231", "CVE-2025-71232", "CVE-2025-71233", "CVE-2025-71234", "CVE-2025-71235", "CVE-2025-71236", "CVE-2025-71237", "CVE-2025-71238", "CVE-2026-23056", "CVE-2026-23057", "CVE-2026-23058", "CVE-2026-23059", "CVE-2026-23060", "CVE-2026-23061", "CVE-2026-23062", "CVE-2026-23063", "CVE-2026-23069", "CVE-2026-23070", "CVE-2026-23071", "CVE-2026-23072", "CVE-2026-23073", "CVE-2026-23074", "CVE-2026-23075", "CVE-2026-23076", "CVE-2026-23078", "CVE-2026-23080", "CVE-2026-23082", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23085", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23088", "CVE-2026-23089", "CVE-2026-23090", "CVE-2026-23091", "CVE-2026-23093", "CVE-2026-23094", "CVE-2026-23095", "CVE-2026-23096", "CVE-2026-23097", "CVE-2026-23098", "CVE-2026-23099", "CVE-2026-23100", "CVE-2026-23101", "CVE-2026-23103", "CVE-2026-23105", "CVE-2026-23107", "CVE-2026-23108", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23112", "CVE-2026-23113", "CVE-2026-23116", "CVE-2026-23118", "CVE-2026-23119", "CVE-2026-23120", "CVE-2026-23123", "CVE-2026-23124", "CVE-2026-23125", "CVE-2026-23126", "CVE-2026-23128", "CVE-2026-23129", "CVE-2026-23131", "CVE-2026-23133", "CVE-2026-23135", "CVE-2026-23146", "CVE-2026-23148", "CVE-2026-23150", "CVE-2026-23151", "CVE-2026-23154", "CVE-2026-23155", "CVE-2026-23156", "CVE-2026-23158", "CVE-2026-23159", "CVE-2026-23160", "CVE-2026-23161", "CVE-2026-23163", "CVE-2026-23164", "CVE-2026-23166", "CVE-2026-23167", "CVE-2026-23168", "CVE-2026-23169", "CVE-2026-23170", "CVE-2026-23172", "CVE-2026-23173", "CVE-2026-23176", "CVE-2026-23177", "CVE-2026-23178", "CVE-2026-23179", "CVE-2026-23180", "CVE-2026-23182", "CVE-2026-23187", "CVE-2026-23188", "CVE-2026-23189", "CVE-2026-23190", "CVE-2026-23191", "CVE-2026-23193", "CVE-2026-23198", "CVE-2026-23199", "CVE-2026-23200", "CVE-2026-23201", "CVE-2026-23202", "CVE-2026-23204", "CVE-2026-23205", "CVE-2026-23206", "CVE-2026-23209", "CVE-2026-23212", "CVE-2026-23213", "CVE-2026-23214", "CVE-2026-23215", "CVE-2026-23216", "CVE-2026-23219", "CVE-2026-23220", "CVE-2026-23221", "CVE-2026-23222", "CVE-2026-23223", "CVE-2026-23224", "CVE-2026-23228", "CVE-2026-23229", "CVE-2026-23230", "CVE-2026-23233", "CVE-2026-23234", "CVE-2026-23235", "CVE-2026-23236", "CVE-2026-23237" ], "cvss": 0.0, "database_specific": { "severity": "IMPORTANT" }, "description": "[6.12.0-200.74.27]\n- Revert 'uek-rpm: update kABI for FIPS regarding crypto_user' (Saeed Mirzamohammadi) [Orabug: 39033195] \n- Revert 'fips: remove crypto_user from the FIPS module' (Saeed Mirzamohammadi) [Orabug: 39033195] \n- Revert 'crypto_user: use FIPS algorithm list when FIPS module is enabled' (Saeed Mirzamohammadi) [Orabug: 39033195] \n- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240] \n- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822] \n- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822] \n- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822] \n- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822] \n- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822] \n- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822] \n- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822] \n- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822] \n- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822] \n- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822] \n- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822] \n- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822] \n- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822] \n- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822] \n- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822] \n- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822] \n- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822] \n- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]\n\n[6.12.0-200.74.26]\n- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]\n- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]\n- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]\n- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]\n- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]\n- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]\n- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]\n- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]\n- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]\n- Revert 'NFS: Avoid changing nlink when file removes and attribute updates race' (Samasth Norway Ananda) [Orabug: 38925844]\n- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]\n- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]\n- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]\n- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]\n- alloc_tag: avoid current-alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]\n- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]\n- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]\n- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]\n- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]\n- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]\n- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]\n- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]\n- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]\n- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]\n- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]\n- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]\n- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]\n- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]\n- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]\n- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]\n- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]\n- LTS version: v6.12.74 (Jack Vogel)\n- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)\n- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)\n- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)\n- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)\n- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)\n- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)\n- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)\n- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)\n- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)\n- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)\n- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)\n- Revert 'wireguard: device: enable threaded NAPI' (Daniel Borkmann)\n- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)\n- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)\n- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)\n- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}\n- mm/hugetlb: fix copy_hugetlb_page_range() to use -pt_share_count (Jane Chu)\n- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)\n- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)\n- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)\n- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)\n- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)\n- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)\n- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)\n- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)\n- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)\n- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)\n- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)\n- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}\n- drm/tegra: hdmi: sor: Fix error: variable 'j' set but not used (Brahmajit Das)\n- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)\n- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)\n- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)\n- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)\n- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)\n- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)\n- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)\n- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)\n- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)\n- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)\n- bnxt_en: Change FW message timeout warning (Michael Chan)\n- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}\n- LTS version: v6.12.73 (Jack Vogel)\n- Revert 'driver core: enforce device_lock for driver_match_device()' (Greg Kroah-Hartman)\n- LTS version: v6.12.72 (Jack Vogel)\n- gpio: omap: do not register driver in probe() (Danilo Krummrich)\n- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}\n- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)\n- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}\n- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)\n- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)\n- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)\n- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)\n- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}\n- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}\n- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)\n- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}\n- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}\n- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)\n- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)\n- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}\n- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)\n- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)\n- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}\n- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)\n- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)\n- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)\n- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)\n- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}\n- LTS version: v6.12.71 (Jack Vogel)\n- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)\n- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)\n- LTS version: v6.12.70 (Jack Vogel)\n- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)\n- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)\n- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)\n- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)\n- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)\n- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}\n- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)\n- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)\n- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)\n- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}\n- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)\n- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}\n- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}\n- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)\n- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)\n- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)\n- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)\n- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)\n- net: gro: fix outer network offset (Paolo Abeni)\n- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)\n- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)\n- tipc: use kfree_sensitive() for session key material (Daniel Hodges)\n- net: don't touch dev-stats in BPF redirect paths (Jakub Kicinski)\n- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}\n- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}\n- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behun)\n- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)\n- net: sfp: pre-parse the module support (Russell King)\n- net: phy: add phy_interface_copy() (Russell King)\n- net: phy: add phy_interface_weight() (Russell King)\n- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)\n- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)\n- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)\n- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)\n- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)\n- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}\n- net: add skb_header_pointer_careful() helper (Eric Dumazet)\n- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}\n- platform/x86/intel/tpmi/plr: Make the file domainn/status writeable (Ricardo Neri)\n- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)\n- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)\n- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)\n- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)\n- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}\n- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)\n- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)\n- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}\n- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)\n- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}\n- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)\n- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)\n- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)\n- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)\n- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)\n- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}\n- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)\n- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)\n- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)\n- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)\n- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)\n- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)\n- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}\n- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceicao Alves)\n- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}\n- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)\n- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)\n- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)\n- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)\n- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matous Lansky)\n- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)\n- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)\n- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)\n- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)\n- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)\n- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)\n- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)\n- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)\n- smb/server: fix refcount leak in smb2_open() (Zhangguodong)\n- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}\n- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)\n- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)\n- block,bfq: fix aux stat accumulation destination (Shechenglong)\n- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)\n- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}\n- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}\n- tracing: Fix ftrace event field alignments (Steven Rostedt)\n- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}\n- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)\n- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)\n- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)\n- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)\n- ublk: fix deadlock when reading partition table (Ming Lei)\n- tools/power turbostat: fix GCC9 build regression (Todd Brandt)\n- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)\n- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)\n- Revert 'drm/amd: Check if ASPM is enabled from PCIe subsystem' (Bert Karwatzki)\n- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}\n- gve: Correct ethtool rx_dropped calculation (Max Yuan)\n- gve: Fix stats report corruption on queue count change (Debarghya Kundu)\n- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}\n- ARM: 9468/1: fix memset64() on big-endian (Thomas Weissschuh)\n- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)\n- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}\n- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}\n- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-domains (Xu Yang)\n- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)\n- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)\n- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)\n- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)\n- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}\n- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)\n- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)\n- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}\n- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}\n- LTS version: v6.12.69 (Jack Vogel)\n- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothore)\n- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)\n- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)\n- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)\n- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)\n- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)\n- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}\n- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)\n- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)\n- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)\n- net/sched: act_ife: convert comma to semicolon (Chen Ni)\n- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)\n- Revert 'drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)' (John Ogness)\n- wifi: ath11k: add srng-lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}\n- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)\n- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)\n- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)\n- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)\n- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)\n- rust: kbuild: support -Cjump-tables=n for Rust 1.93.0 (Miguel Ojeda)\n- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)\n- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)\n- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}\n- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)\n- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)\n- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)\n- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)\n- drm/imx/tve: fix probe device leak (Johan Hovold)\n- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)\n- scripts: generate_rust_analyzer: Add compiler_builtins - core dep (Tamir Duberstein)\n- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)\n- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Ozkan)\n- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}\n- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}\n- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}\n- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)\n- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)\n- selftests: mptcp: check no dup close events after error (Matthieu Baerts)\n- mptcp: only reset subflow errors when propagated (Matthieu Baerts)\n- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)\n- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}\n- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}\n- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)\n- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)\n- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)\n- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)\n- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)\n- rust: kbuild: give --config-path to rustfmt in .rsi target (Miguel Ojeda)\n- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)\n- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)\n- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)\n- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)\n- sched/deadline: Document dl_server (Peter Zijlstra)\n- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)\n- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)\n- bcache: use bio cloning for detached device requests (Shida Zhang)\n- bcache: fix improper use of bi_end_io (Shida Zhang)\n- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)\n- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)\n- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)\n- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)\n- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)\n- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)\n- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)\n- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)\n- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)\n- net: bridge: fix static key check (Martin Kaiser)\n- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)\n- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}\n- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)\n- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}\n- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)\n- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}\n- net: wwan: t7xx: fix potential skb-frags overflow in RX path (Kery Qi)\n- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)\n- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)\n- bonding: annotate data-races around slave-last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}\n- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)\n- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)\n- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)\n- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)\n- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}\n- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}\n- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)\n- LTS version: v6.12.68 (Jack Vogel)\n- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)\n- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)\n- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)\n- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)\n- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)\n- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)\n- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)\n- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)\n- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}\n- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}\n- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)\n- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)\n- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}\n- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}\n- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)\n- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)\n- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)\n- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)\n- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)\n- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}\n- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)\n- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)\n- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)\n- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}\n- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)\n- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)\n- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}\n- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)\n- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}\n- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}\n- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)\n- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}\n- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)\n- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)\n- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)\n- netrom: fix double-free in nr_route_frame() (Jeongjun Park)\n- uacce: ensure safe queue release with state management (Chenghai Huang)\n- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)\n- uacce: fix isolate sysfs check condition (Chenghai Huang)\n- uacce: fix cdev handling in the cleanup path (Wenkai Lin)\n- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)\n- mei: trace: treat reg parameter as string (Alexander Usyskin)\n- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}\n- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}\n- slimbus: core: fix device reference leak on report present (Johan Hovold)\n- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)\n- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)\n- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}\n- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}\n- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}\n- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)\n- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)\n- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}\n- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)\n- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)\n- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)\n- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}\n- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}\n- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}\n- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kubrich)\n- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)\n- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)\n- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)\n- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)\n- iio: accel: iis328dq: fix gain values (Markus Koeniger)\n- iio: accel: adxl380: fix handling of unavailable 'INT1' interrupt (Francesco Lavra)\n- of: platform: Use default match table for /firmware (Rob Herring)\n- of: fix reference count leak in of_alias_scan() (Weigang He)\n- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}\n- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)\n- tpm: Compare HMAC values in constant time (Eric Biggers)\n- x86: make page fault handling disable interrupts properly (Cedric Xing)\n- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}\n- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)\n- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}\n- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)\n- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}\n- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)\n- octeontx2-af: Fix error handling (Ratheesh Kannoth)\n- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)\n- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}\n- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)\n- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}\n- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramirez)\n- drm/nouveau: add missing DCB connector types (Alex Ramirez)\n- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristof)\n- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristof)\n- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)\n- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)\n- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)\n- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}\n- mISDN: annotate data-race around dev-work (Eric Dumazet)\n- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)\n- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)\n- be2net: fix data race in be_get_new_eqd (David Yang)\n- net: hns3: fix data race in hns3_fetch_stats (David Yang)\n- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)\n- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}\n- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)\n- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)\n- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}\n- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}\n- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)\n- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)\n- kconfig: fix static linking of nconf (Arusekk)\n- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}\n- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)\n- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}\n- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)\n- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)\n- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}\n- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)\n- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}\n- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}\n- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)\n- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)\n- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)\n- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)\n- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}\n- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)\n- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)\n- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)\n- Revert 'nfc/nci: Add the inconsistency check between the input data length and count' (Thadeu Lima de Souza Cascardo)\n- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)\n- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}\n- comedi: dmm32at: serialize use of paged registers (Ian Abbott)\n- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)\n- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)\n- crypto: authencesn - reject too-short AAD (assoclen8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}\n- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}\n- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}\n- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)\n- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}\n- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}\n- veth: fix data race in veth_get_ethtool_stats (David Yang)\n- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)\n- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)\n- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}\n- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)\n- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}\n- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}\n- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marliere)\n- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}\n- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}\n- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)\n- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}\n- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)\n- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)\n- ice: Fix incorrect timeout ice_release_res() (Ding Hui)\n- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)\n- ice: initialize ring_stats-syncp (Jacob Keller)\n- ata: libata: Print features also for ATAPI devices (Niklas Cassel)\n- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)\n- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)\n- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)\n- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)\n- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)\n- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)\n- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)\n- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)\n- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)\n- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)\n- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)\n- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)\n- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)\n- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)\n- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)\n- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)\n- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)", "id": "ELSA-2026-50160", "ovalId": "oval:com.oracle.elsa:def:202650160", "source": "oracle_linux", "title": "ELSA-2026-50160: Unbreakable Enterprise kernel security update (IMPORTANT)", "url": "https://linux.oracle.com/errata/ELSA-2026-50160.html" }