elsa-2026-50261

{
  "cves": [
    "CVE-2024-50043",
    "CVE-2024-53230",
    "CVE-2024-53231",
    "CVE-2024-58078",
    "CVE-2025-21720",
    "CVE-2025-21723",
    "CVE-2025-21724",
    "CVE-2025-21783",
    "CVE-2025-21808",
    "CVE-2025-21857",
    "CVE-2025-21867",
    "CVE-2025-21892",
    "CVE-2025-21997",
    "CVE-2025-22017",
    "CVE-2025-37873",
    "CVE-2025-37888",
    "CVE-2025-38015",
    "CVE-2025-38020",
    "CVE-2025-38109",
    "CVE-2025-38113",
    "CVE-2025-38246",
    "CVE-2025-38385",
    "CVE-2025-38455",
    "CVE-2025-38551",
    "CVE-2025-38735",
    "CVE-2025-39721",
    "CVE-2025-40051",
    "CVE-2025-40056",
    "CVE-2025-40129",
    "CVE-2025-40135",
    "CVE-2025-40157",
    "CVE-2025-40292",
    "CVE-2025-54518",
    "CVE-2025-68171",
    "CVE-2025-68259",
    "CVE-2025-68371",
    "CVE-2025-68741",
    "CVE-2025-68770",
    "CVE-2025-68775",
    "CVE-2025-68798",
    "CVE-2025-71148",
    "CVE-2026-22989",
    "CVE-2026-22994",
    "CVE-2026-23059",
    "CVE-2026-23173",
    "CVE-2026-23243",
    "CVE-2026-23296",
    "CVE-2026-23401",
    "CVE-2026-31411",
    "CVE-2026-31431",
    "CVE-2026-31628",
    "CVE-2026-43284"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "IMPORTANT"
  },
  "description": "[5.15.0-320.202.8.2]\n- xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman)  [Orabug: 39344515]  {CVE-2026-43284}\n- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344515]  {CVE-2026-43284}\n\n[5.15.0-320.202.8.1]\n- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39327141]  {CVE-2025-54518}\n\n[5.15.0-320.202.8]\n- iommu/arm-smmu-v3: Handle zeroed A4-2C HTTU override settings (Joao Martins)  [Orabug: 39186453]\n- iommu: Move IOMMU_DIRTY_NO_CLEAR define (Shameer Kolothum)  [Orabug: 39186453]\n- iommu/arm-smmu-v3: Enable HTTU for stage1 with io-pgtable mapping (Kunkun Jiang)  [Orabug: 39186453]\n- iommu/arm-smmu-v3: Add support for dirty tracking in domain alloc (Joao Martins)  [Orabug: 39186453]\n- iommu/io-pgtable-arm: Add read_and_clear_dirty() support (Shameer Kolothum)  [Orabug: 39186453]\n- iommu/arm-smmu-v3: Add feature detection for HTTU (Jean-Philippe Brucker)  [Orabug: 39186453]\n\n[5.15.0-320.202.7]\n- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu)  [Orabug: 39250686]\n- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39250686]\n- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39250686]\n- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39250686]\n- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39250686]\n- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39250686]\n- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39250686]  {CVE-2026-31431}\n- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39250686]\n- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39250686]\n- uek-rpm: Enable FWCTL for aarch64 (Dave Kleikamp)  [Orabug: 39252913]\n\n[5.15.0-320.202.6]\n- Revert 'rds: Drop rds conn in connect worker if not in down state.' (Vijayendra Suman) [Orabug: 39277795]\n- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp) [Orabug: 39109819]\n- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 39109819]\n- iommu/vt-d: Set variable intel_dirty_ops to static (Kunwu Chan) [Orabug: 39109819]\n- iommu/vt-d: Access/Dirty bit support for SS domains (Joao Martins) [Orabug: 39109819]\n- iommu/amd: reduce GA Log overflow printk noise (Alejandro Jimenez) [Orabug: 39209012]\n- iommu/amd: add reschedule points to GA Log draining (Alejandro Jimenez) [Orabug: 39209012]\n- iommu/amd: Rework GAInt handling in overflow case (Joao Martins) [Orabug: 39209012]\n- iommu/amd: Disable GAInt while GA Log is processed (Joao Martins) [Orabug: 39209012]\n- iommu/amd: Move helpers to update IOMMU features to amd_iommu.h (Alejandro Jimenez) [Orabug: 39209012]\n- iommu/amd: Increase GA Log buffer size to 8192 entries (Joao Martins) [Orabug: 39209012]\n- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241228,39273722] {CVE-2026-31628}\n\n[5.15.0-320.202.5]\n- Revert 'PCI: Enable ACS after configuring IOMMU for OF platforms' (Manivannan Sadhasivam) [Orabug: 39187371]\n- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847720] {CVE-2025-68775}\n- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002346]\n- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002346]\n- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002346]\n- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002346]\n- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002346]\n- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002346]\n- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002346]\n- ext4: make ext4_forced_shutdown() take struct super_block (Jan Kara) [Orabug: 39002346]\n- ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649062] {CVE-2025-40135}\n- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109773]\n- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930868] {CVE-2026-23059}\n- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887702] {CVE-2026-22994}\n- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887682] {CVE-2026-22989}\n- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970398] {CVE-2026-23173}\n- net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887601] {CVE-2025-71148}\n- scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798929] {CVE-2025-68741}\n- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847684] {CVE-2025-68770}\n- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847849] {CVE-2025-68798}\n- scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798848] {CVE-2025-68371}\n- KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773579] {CVE-2025-68259}\n- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae) [Orabug: 38773165] {CVE-2025-68171}\n- virtio-net: fix received length check in big packets (Bui Quang Minh) [Orabug: 38737152] {CVE-2025-40292}\n- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38641284] {CVE-2025-38113}\n- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo) [Orabug: 38649173] {CVE-2025-40157}\n- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu) [Orabug: 38649042] {CVE-2025-40129}\n- cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() (Jinjie Ruan) [Orabug: 38641275] {CVE-2024-53230}\n- cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() (Jinjie Ruan) [Orabug: 38641272] {CVE-2024-53231}\n- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592117] {CVE-2025-40056}\n- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401717] {CVE-2025-39721}\n- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592085] {CVE-2025-40051}\n- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324330] {CVE-2025-38551}\n- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401492] {CVE-2025-38735}\n- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254140] {CVE-2025-38455}\n- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253871] {CVE-2025-38385}\n- net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094809] {CVE-2025-38020}\n- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094794] {CVE-2025-38015}\n- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152903] {CVE-2025-38109}\n- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175054] {CVE-2025-38246}\n- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski) [Orabug: 37937451] {CVE-2025-37873}\n- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin) [Orabug: 37938078] {CVE-2025-37888}\n- nfsd: fix possible badness in FREE_STATEID (Olga Kornievskaia) [Orabug: 37989102] {CVE-2024-50043}\n- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski) [Orabug: 37828271] {CVE-2025-22017}\n\n[5.15.0-320.202.4]\n- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia) [Orabug: 37828202] {CVE-2025-21997}\n- RDMA/mlx5: Fix the recovery flow of the UMR QP (Yishai Hadas) [Orabug: 37766306] {CVE-2025-21892}\n- misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors (Vimal Agrawal) [Orabug: 37678552] {CVE-2024-58078}\n- net/sched: cls_api: fix error handling causing NULL dereference (Pierre Riteau) [Orabug: 37702083] {CVE-2025-21857}\n- bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (Shigeru Yoshida) [Orabug: 37766220] {CVE-2025-21867}\n- net: xdp: Disallow attaching device-bound programs in generic mode (Toke Hoiland-Jorgensen) [Orabug: 37650238] {CVE-2025-21808}\n- iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (Qasim Ijaz) [Orabug: 37649891] {CVE-2025-21724}\n- xfrm: delete intermediate secpath entry in packet offload mode (Alexandre Cassen) [Orabug: 37649866] {CVE-2025-21720}\n- gpiolib: Fix crash on error in gpiochip_get_ngpios() (Andy Shevchenko) [Orabug: 37650154] {CVE-2025-21783}\n- scsi: mpi3mr: Fix possible crash when setting up bsg fails (Guixin Liu) [Orabug: 37649886] {CVE-2025-21723}\n- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 38932706]\n- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768951]\n- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768951]\n- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768951]\n\n[5.15.0-320.202.3]\n- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915250]\n- ipv4: icmp: convert to dev_net_rcu() (Eric Dumazet) [Orabug: 38807392]\n- ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Eric Dumazet) [Orabug: 38807392]\n- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39151165,39159089] {CVE-2026-23401}\n\n[5.15.0-320.202.2]\n- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121645]\n- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065603]\n- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065603]\n- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065603]\n- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065603]\n- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065603]\n- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065603]\n- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098783]\n- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 38976650]\n- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 38976650,39130775] {CVE-2026-23296}\n- scsi: core: Move two statements (Bart Van Assche) [Orabug: 38976650]\n- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko) [Orabug: 39100354]\n- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089315]\n\n[5.15.0-320.202.1]\n- LTS version: v5.15.202 (Vijayendra Suman)\n- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)\n- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)\n- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)\n- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)\n- fbdev: ffb: fix corrupted video output on Sun FFB1 (Rene Rebe)\n- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He)\n- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)\n- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian)\n- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)\n- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)\n- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)\n- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)\n- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)\n- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu)\n- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)\n- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)\n- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)\n- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo)\n- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)\n- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement)\n- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)\n- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)\n- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)\n- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen)\n- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)\n- btrfs: continue trimming remaining devices on failure (Jinbaohong)\n- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)\n- kexec: derive purgatory entry from symbol (Li Chen)\n- ocfs2: fix reflink preserve cleanup issue (Heming Zhao)\n- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)\n- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)\n- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)\n- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)\n- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)\n- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)\n- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)\n- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang)\n- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)\n- xfs: fix remote xattr valuelblk check (Darrick J. Wong)\n- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong)\n- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong)\n- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo)\n- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)\n- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)\n- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)\n- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)\n- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)\n- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)\n- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)\n- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed)\n- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)\n- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)\n- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang)\n- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)\n- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)\n- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)\n- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)\n- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)\n- media: i2c: ov5647: Correct pixel array offset (David Plowman)\n- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)\n- media: ccs: Avoid possible division by zero (Sakari Ailus)\n- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal)\n- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal)\n- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)\n- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li)\n- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li)\n- media: radio-keene: fix memory leak in error path (Shaurya Rane)\n- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Gunther Noack)\n- HID: prodikeys: Check presence of pm-input_ep82 (Gunther Noack)\n- HID: magicmouse: Do not crash on missing msc-input (Gunther Noack)\n- HID: hid-pl: handle probe errors (Oliver Neukum)\n- arm64: Disable branch profiling for all arm64 code (Breno Leitao)\n- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)\n- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)\n- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)\n- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers)\n- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)\n- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han)\n- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian)\n- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)\n- net: consume xmit errors of GSO frames (Jakub Kicinski)\n- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo)\n- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)\n- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)\n- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)\n- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)\n- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz)\n- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)\n- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)\n- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)\n- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)\n- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)\n- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)\n- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Palsson)\n- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo)\n- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen)\n- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)\n- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)\n- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)\n- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai)\n- drm/radeon: Add HAINAN clock adjustment (Decce6)\n- drm/amdgpu: Add HAINAN clock adjustment (Decce6)\n- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)\n- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)\n- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)\n- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weissschuh)\n- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)\n- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov)\n- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)\n- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)\n- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)\n- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)\n- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)\n- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)\n- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)\n- Revert 'mfd: da9052-spi: Change read-mask to write-mask' (Marcus Folkesson)\n- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)\n- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)\n- binder: don't use %pK through printk (Thomas Weissschuh)\n- fix it87_wdt early reboot by reporting running timer (Rene Rebe)\n- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)\n- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)\n- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)\n- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)\n- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)\n- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)\n- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)\n- mailbox: sprd: clear delivery flag before handling TX done (Otto Pfluger)\n- remoteproc: mediatek: Break lock dependency to prepare_lock (Tzung-Bi Shih)\n- mailbox: sprd: mask interrupts that are not handled (Otto Pfluger)\n- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)\n- scsi: buslogic: Reduce stack usage (Arnd Bergmann)\n- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)\n- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)\n- myri10ge: avoid uninitialized variable use (Arnd Bergmann)\n- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)\n- PCI: Add ACS quirk for Qualcomm Hamoa  Glymur (Krishna Chaitanya Chundru)\n- PCI: Enable ACS after configuring IOMMU for OF platforms (Manivannan Sadhasivam)\n- PCI: Fix pci_slot_lock () device locking (Keith Busch)\n- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)\n- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)\n- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)\n- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)\n- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)\n- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)\n- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)\n- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sorensen)\n- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)\n- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)\n- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)\n- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)\n- net: usb: r8152: fix transmit queue timeout (Mingj Ye)\n- openrisc: define arch-specific version of nop() (Brian Masney)\n- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal)\n- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)\n- ext4: mark group extend fast-commit ineligible (Li Chen)\n- ext4: mark group add fast-commit ineligible (Li Chen)\n- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)\n- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)\n- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek)\n- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)\n- dm: remove fake timeout to avoid leak request (Ding Hui)\n- jfs: nlink overflow in jfs_rename (Jori Koolstra)\n- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)\n- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (Rene Rebe)\n- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)\n- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)\n- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)\n- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)\n- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)\n- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)\n- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)\n- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)\n- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weissschuh)\n- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weissschuh)\n- drm: Account property blob allocations to memcg (Xiao Kan)\n- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)\n- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)\n- media: solo6x10: Check for out of bounds chip_id (Kees Cook)\n- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek)\n- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)\n- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)\n- ASoC: wm8962: Add WM8962_ADC_MONOMIX to '3D Coefficients' mask (Sebastian Krzyszkowiak)\n- media: omap3isp: set initial format (Hans Verkuil)\n- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)\n- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)\n- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)\n- spi: stm32: fix Overrun issue at  8bpw (Deepak Kumar)\n- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)\n- parisc: Prevent interrupts during reboot (Helge Deller)\n- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)\n- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi)\n- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)\n- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)\n- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)\n- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Soderlund)\n- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)\n- sparc: don't reference obsolete termio struct for TC* constants (Sam James)\n- sparc: Synchronize user stack on fork and clone (Andreas Larsson)\n- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)\n- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)\n- s390/perf: Disable register readout on sampling events (Thomas Richter)\n- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)\n- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li)\n- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab)\n- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab)\n- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab)\n- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)\n- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)\n- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang)\n- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)\n- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)\n- gfs2: fiemap page fault fix (Andreas Gruenbacher)\n- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)\n- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)\n- hfsplus: pretend special inodes as regular files (Tetsuo Handa)\n- audit: add missing syscalls to read class (Jeffrey Bencteux)\n- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)\n- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)\n- libperf build: Always place libperf includes first (Ian Rogers)\n- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)\n- perf callchain: Fix srcline printing with inlines (Ian Rogers)\n- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)\n- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)\n- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)\n- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)\n- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)\n- ext4: don't cache extent during splitting extent (Zhang Yi)\n- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)\n- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)\n- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)\n- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)\n- apparmor: fix rlimit for posix cpu timers (John Johansen)\n- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)\n- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)\n- bpftool: Fix truncated netlink dumps (Jakub Kicinski)\n- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)\n- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)\n- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)\n- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)\n- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)\n- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)\n- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)\n- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)\n- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)\n- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)\n- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabas Czeman)\n- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)\n- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)\n- pinctrl: qcom: Extract chip specific LPASS LPI code (Srinivasa Rao Mandadapu)\n- pinctrl: qcom: Update lpi pin group custiom functions with framework generic functions (Srinivasa Rao Mandadapu)\n- pinctrl: qcom: Update macro name to LPI specific (Srinivasa Rao Mandadapu)\n- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)\n- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)\n- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)\n- usb: bdc: fix sleep during atomic (Justin Chen)\n- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)\n- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)\n- Revert 'mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms' (Greg Kroah-Hartman)\n- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)\n- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)\n- serial: SH_SCI: improve 'DMA support' prompt (Randy Dunlap)\n- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)\n- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)\n- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)\n- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)\n- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)\n- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)\n- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabas Czeman)\n- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)\n- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)\n- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)\n- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)\n- nvdimm: virtio_pmem: serialize flush requests (Li Chen)\n- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)\n- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)\n- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)\n- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)\n- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)\n- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)\n- svcrdma: Increase the per-transport rw_ctx count (Chuck Lever)\n- svcrdma: Clean up comment in svc_rdma_accept() (Chuck Lever)\n- svcrdma: Remove queue-shortening warnings (Chuck Lever)\n- RDMA/core: Fix a couple of obvious typos in comments (Chuck Lever)\n- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)\n- crypto: ccp - Add an S4 restore flow (Mario Limonciello)\n- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)\n- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)\n- RDMA/rtrs-srv: fix SG mapping (Roman Pen)\n- RDMA/rtrs-srv: Correct the checking of ib_map_mr_sg (Guoqing Jiang)\n- RDMA/rtrs-srv: Refactor the handling of failure case in map_cont_bufs (Guoqing Jiang)\n- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)\n- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)\n- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)\n- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)\n- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)\n- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)\n- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)\n- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)\n- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)\n- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)\n- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)\n- power: supply: ab8500: Use core battery parser (Linus Walleij)\n- power: supply: ab8500_bmdata: Use standard phandle (Linus Walleij)\n- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)\n- IB/cache: update gid cache on client reregister event (Etienne Aujames)\n- RDMA/rtrs: server: remove dead code (Lihonggang)\n- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)\n- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)\n- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188477] {CVE-2026-31411}\n- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)\n- net: hns3: fix double free issue for tx spare buffer (Jian Shen)\n- net: hns3: add max order judgement for tx spare buffer (Hao Chen)\n- net: hns3: fix ethtool tx copybreak buf size indicating not aligned issue (Hao Chen)\n- net: hns3: remove the way to set tx spare buf via module parameter (Hao Chen)\n- net: hns3: add support to set/get tx copybreak buf size via ethtool for hns3 driver (Hao Chen)\n- ethtool: add support to set/get tx copybreak buf size via ethtool (Hao Chen)\n- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)\n- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)\n- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)\n- timers: Replace in_irq() with in_hardirq() (Ye Xingchen)\n- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)\n- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)\n- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)\n- PCI: Initialize RCB from pci_configure_device() (Hakon Bugge)\n- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)\n- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)\n- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)\n- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)\n- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)\n- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jorg Wedekind)\n- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)\n- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)\n- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)\n- PCI/portdrv: Fix potential resource leak (Uwe Kleine-Konig)\n- PCI: Do not attempt to set ExtTag for VFs (Hakon Bugge)\n- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)\n- spi: tools: Add include folder to .gitignore (Francesco Lavra)\n- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)\n- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)\n- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)\n- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)\n- regulator: core: move supply check earlier in set_machine_constraints() (Andre Draszik)\n- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)\n- smack: /smack/doi: accept previously used values (Konstantin Andreev)\n- smack: /smack/doi must be  0 (Konstantin Andreev)\n- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)\n- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)\n- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)\n- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)\n- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)\n- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)\n- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)\n- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)\n- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)\n- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)\n- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete 'power-gpios' property (Chen-Yu Tsai)\n- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)\n- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)\n- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)\n- arm64: dts: qcom: sdm630: correct QFPROM byte offsets (Krzysztof Kozlowski)\n- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)\n- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)\n- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)\n- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)\n- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)\n- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)\n- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)\n- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)\n- crypto: hisilicon/trng - modifying the order of header files (Chenghai Huang)\n- hrtimer: Fix trace oddity (Thomas Gleixner)\n- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)\n- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)\n- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weissschuh)\n- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)\n- libbpf: Fix dumping big-endian bitfields (Ilya Leoshkevich)\n- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)\n- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)\n- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)\n- iomap: fix submission side handling of completion side errors (Christoph Hellwig)\n- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)\n- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)\n- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)\n- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)\n- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)\n- gfs2: Add metapath_dibh helper (Andreas Gruenbacher)\nfor 'init_fs' (Ben Dooks)\n- i3c: remove i2c board info from i2c_dev_desc (Jamie Iles)\n- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)\n- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)\n- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103109] {CVE-2026-23243}\n- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)",
  "id": "ELSA-2026-50261",
  "ovalId": "oval:com.oracle.elsa:def:202650261",
  "source": "oracle_linux",
  "title": "ELSA-2026-50261: Unbreakable Enterprise kernel security update (IMPORTANT)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-50261.html"
}