ELSA-2026-500398

Опубликовано: 16 окт. 2026

Источник: oracle-oval

Платформа: Oracle Linux 8

Платформа: Oracle Linux 9

Описание

ELSA-2026-500398: Unbreakable Enterprise kernel security update (IMPORTANT)

[5.15.0-325.221.6.4]

ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40167661] {CVE-2026-98432}
ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40167656] {CVE-2026-99999}
netfilter: nfnetlink_queue: unbreak SCTP traffic (Antonio Ojea) [Orabug: 40167656]

[5.15.0-325.221.6.3]

exec: Cleanup POSIX timers right after de_thread() (Hyunwoo Kim) [Orabug: 40157515] {CVE-2026-98260}

[5.15.0-325.221.6.2]

eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner) [Orabug: 39784995] {CVE-2026-46242}
eventpoll: move epi_fget() up (Christian Brauner) [Orabug: 39784995]
eventpoll: rename ep_remove_safe() back to ep_remove() (Christian Brauner) [Orabug: 39784995]
eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Christian Brauner) [Orabug: 39784995]
eventpoll: kill __ep_remove() (Christian Brauner) [Orabug: 39784995]
eventpoll: split __ep_remove() (Christian Brauner) [Orabug: 39784995]
eventpoll: use hlist_is_singular_node() in __ep_remove() (Christian Brauner) [Orabug: 39784995]
eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 39784995]
file: add fput() cleanup helper (Christian Brauner) [Orabug: 39784995]
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation (Gunther Noack) [Orabug: 40021203] {CVE-2026-89560}
ppp_synctty: ensure a writeable skb header (Qingfang Deng) [Orabug: 40079220] {CVE-2026-97964}
netfilter: nfnetlink_log: cope with concurrent instance destruction (Florian Westphal) [Orabug: 40079360] {CVE-2026-97998}
vxlan: reject dynamic fdb entries that reference a nexthop id (Seungwon Bae) [Orabug: 40079448] {CVE-2026-98023}
ipvs: fix reversed sequence option serialization (Kyle Zeng) [Orabug: 40079626] {CVE-2026-98078}
ipv6: sr: restore network header before routing and forwarding (Eric Dumazet) [Orabug: 40079700] {CVE-2026-98096}
hsr: broadcast netlink notifications in the device's net namespace (Maoyi Xie) [Orabug: 40073495] {CVE-2026-97419}
fs/ntfs3: validate index entry key bounds (ZhengYuan Huang) [Orabug: 40073603] {CVE-2026-97438}

[5.15.0-325.221.6.1]

x86/kexec: Add EFI config table identity mapping for kexec kernel (Tao Liu) [Orabug: 40127851]
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (Sean Christopherson) [Orabug: 40127747] {CVE-2026-80726}

[5.15.0-325.221.6]

scsi: qla2xxx: Preserve PURLS head on reject (Vijayendra Suman) [Orabug: 40088703]
net: Account VLAN RPS drops (Vijayendra Suman) [Orabug: 40088694]
net: tun: set drop reason for truncated raw TUN packets (Vijayendra Suman) [Orabug: 40088685]
IB/mlx4: delete allocated id_map_entry while sending REJ (Praveen Kumar Kannoju) [Orabug: 40002252]
scsi: target: iblock: Allow iblock devices to be shared (Mike Christie) [Orabug: 39226785]
scsi: target: core: Fix complete_type use (Mike Christie) [Orabug: 39226785]
scsi: vhost-scsi: Report direction completion support (Mike Christie) [Orabug: 39226785]
scsi: target: Allow userspace to set the completion type (Mike Christie) [Orabug: 39226785]
scsi: target: Use driver completion preference by default (Mike Christie) [Orabug: 39226785]
scsi: target: Add support for completing commands from backend context (Mike Christie) [Orabug: 39226785]
scsi: target: Move LUN stats to per-CPU (Mike Christie) [Orabug: 39226785]
scsi: target: Create and use macro helpers for per-CPU stats (Mike Christie) [Orabug: 39226785]
scsi: target: Fix LUN/device R/W and total command stats (Mike Christie) [Orabug: 39226785]
scsi: target: Move delayed/ordered tracking to per CPU (Mike Christie) [Orabug: 39226785]
scsi: target: Fix ordered CMD_T_SENT handling (Mike Christie) [Orabug: 39226785]
scsi: target: Move I/O path stats to per CPU (Mike Christie) [Orabug: 39226785]
KVM: x86: Reset last_steal on vCPU pid change (Dongli Zhang) [Orabug: 39592756]
bpftool: remove duplicate free_btf_vmlinux() definition (Suraj Jitindar Singh) [Orabug: 40083890]
Revert 'bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls' (Vijayendra Suman) [Orabug: 40084576]
LTS version: v5.15.221 (Vijayendra Suman)
clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled (Bjorn Andersson)
nvmet-rdma: fix queue leak when connect backlog is exceeded (Xixin Liu) [Orabug: 40109663] {CVE-2026-98152}
kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c (Catalin Marinas)
kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings (Catalin Marinas)
Bluetooth: L2CAP: Fix send LE flow credits in ACL link (Zhang Chen)
ALSA: control: Fix unannotated kfree() cleanup (Takashi Iwai)
HID: fix an error code in hid_check_device_match() (Dan Carpenter)
clk: qcom: Drop mmcx gdsc supply for dispcc and videocc (Abel Vesa)
nvme: target: rdma: fix ndev refcount leak on queue connect (Xu Wang) [Orabug: 40109645] {CVE-2026-64321}
net/sched: sch_htb: limit htb_classify inner-class filter hops (Jamal Hadi Salim) [Orabug: 40041294] {CVE-2026-90053}
tcp: fix corruption of urgent data on multi-segment retransmit (Jiayuan Chen) [Orabug: 40041302] {CVE-2026-90054}
usb: atm: usbatm: fix invalid ci_range initialization (Deepanshu Kartikey) [Orabug: 40041309] {CVE-2026-90055}
net: fec: only stop PTP if it was initialized (Bui Duc Phuc)
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup (Jamal Hadi Salim) [Orabug: 40041332] {CVE-2026-90058}
net: stmmac: selftests: Account for the UC filter list for filtering tests (Maxime Chevallier)
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering (Maxime Chevallier)
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering (Maxime Chevallier)
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering (Maxime Chevallier)
net: stmmac: selftests: Check multiple MMC counters (Maxime Chevallier)
selftests/arm64: Treat KSM merge_across_nodes as optional (Usama Anjum)
selftests/arm64: Print missing MTE TAP headers (Usama Anjum)
selftests: arm64: add hugetlb mte tests (Yang Shi) [Orabug: 38006900,38177800]
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() (Pablo Neira Ayuso)
netfilter: xt_HL: add pr_fmt and checkentry validation (Marino Dzalto)
netfilter: xt_cgroup: Make it independent from net_cls (Michal Koutny)
netfilter: nf_tables: move hardware offload step after building the chain blob (Pablo Neira Ayuso) [Orabug: 40041352] {CVE-2026-90062}
net: stmmac: selftests: Pass the IP proto mask in the TC selftest (Maxime Chevallier)
net: ethernet: sun4i-emac: Fix IRQ error handling (Bui Duc Phuc)
libceph: validate banner payload length (Aleksandr Nogikh) [Orabug: 40041367] {CVE-2026-90067}
ASoC: dapm: Fix off-by-one check on the second enum channel (Hyeongjun An) [Orabug: 40041370] {CVE-2026-90068}
apparmor: policy_int make sure list heads are initialized before fail path (John Johansen)
apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init (Thorsten Blum)
tpm: st33zp24: Validate locality read result (Ruoyu Wang)
tpm: st33zp24: Return zero on status read failure (Ruoyu Wang) [Orabug: 40041376] {CVE-2026-90070}
net/sched: sch_teql: restore skb->dev on the slave failure path (Victor Nogueira) [Orabug: 40043380] {CVE-2026-90071}
net/sched: sfq: clamp quantum to avoid signed overflow soft lockup (Jamal Hadi Salim) [Orabug: 40041382] {CVE-2026-90072}
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow (Jamal Hadi Salim) [Orabug: 40041386] {CVE-2026-90073}
net/sched: fq_pie: clamp default quantum to avoid signed overflow (Jamal Hadi Salim)
net/sched: sch_codel: clamp default mtu to avoid disabling CoDel (Jamal Hadi Salim)
net/sched: fq_codel: clamp default quantum and mtu (Jamal Hadi Salim) [Orabug: 40041393] {CVE-2026-90075}
net_sched: export pfifo_fast prio2band[] (Eric Dumazet)
net_sched: sch_fq: change how @inactive is tracked (Eric Dumazet)
net_sched: sch_fq: struct sched_data reorg (Eric Dumazet)
net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict() (Jiapeng Chong)
net/sched: act_skbmod: fix length calculations and avoid invalid header warnings (Eric Dumazet) [Orabug: 40041404] {CVE-2026-90078}
cifs: fix clearing stats for fastest execution of each smb2 command (Frank Sorenson)
octeontx2-af: Fix TL3/TL2 link config ENA clearing (Naveen Mamindlapalli)
net: qualcomm: rmnet: restore skb->dev on deaggregated frames (Xiang Mei)
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (Cen Zhang) [Orabug: 40033100] {CVE-2026-89789}
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (Hyunwoo Kim) [Orabug: 40041441] {CVE-2026-90088}
Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (Chris Lu)
scsi: qla2xxx: Fix an loop timeout test (Dan Carpenter)
NFSv4/pnfs: key the data server cache on the NFS version (Junrui Luo) [Orabug: 40041480] {CVE-2026-90102}
nfs: move the nfs4_data_server_cache into struct nfs_net (Jeff Layton)
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (Junrui Luo) [Orabug: 40041487] {CVE-2026-90103}
net/smc: free pending qentry in smc_llc_flow_stop() before memset (Mahanta Jambigi)
net: ipa: balance runtime PM reference on remove error (Ruoyu Wang)
net: ipa: Convert to platform remove callback returning void (Uwe Kleine-Konig)
net: ipa: report when the driver has been removed (Alex Elder)
forcedeth: stop the tx_timeout register dump past the requested window (Marek Czernohous)
net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (Fan Ye)
net: bridge: Reject descending VLAN tunnel ranges (Ruoyu Wang) [Orabug: 40041549] {CVE-2026-90114}
RDMA/ucma: Allow path records to exactly fit the output buffer (Serhat Kumral)
ALSA: control: Use automatic cleanup of kfree() (Takashi Iwai)
prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator (Bradley Morgan)
rtc: pcf8563: fix clock provider leak on unbind (Yi Ding) [Orabug: 40041589] {CVE-2026-90126}
vdpa/mlx5: fix wrong list iterated in add_direct_chain error path (Li Rongqing) [Orabug: 40041595] {CVE-2026-90128}
virtio_balloon: disable indirect descriptors (Michael S. Tsirkin)
i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (Jian-Ming Liao)
i3c: mipi-i3c-hci: Refactor PIO register initialization (Adrian Hunter)
i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (Adrian Hunter)
i3c: mipi-i3c-hci: Quieten initialization messages (Adrian Hunter)
i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 (Jarkko Nikula)
i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (Jarkko Nikula)
bonding: initialize err for empty target lists (Ruoyu Wang)
vsock: use sock_error() to consume sk_err after a failed connect (Nguyen Dinh Phi)
platform/x86: dell-wmi-sysman: Fix instance ID bounds (Hyeongjun An)
8139cp: fix Rx and Tx not being disabled in cp_suspend (Karl Mehltretter)
ALSA: hda: Fix connection list comparison in proc output (Xu Rao)
fs/ntfs3: validate ef->size covers the record's name and value (Weiming Shi)
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() (Konstantin Komarov)
cuse: wait for pending RCU callbacks on module exit (Baokun Li) [Orabug: 40041629] {CVE-2026-90140}
net: bridge: vlan: fix inverted default vlan notification (Nikolay Aleksandrov)
ipvs: fix integer overflow in ftp helper port/address parsing (Joas Antonio Dos Santos) [Orabug: 40041632] {CVE-2026-90141}
net: hsr: Use full string description when opening HSR network device (Lukasz Majewski)
hsr: Use a single struct for self_node. (Sebastian Andrzej Siewior)
pppox: drain queued packets on channel handoff (Qingfang Deng)
net: kcm: Hold RCU read lock while running BPF parser (Junseo Lim)
NFSv4: remove callback IDR entry on client allocation failure (Ruoyu Wang) [Orabug: 40041663] {CVE-2026-90151}
nfs: refactor pNFS functions using clear_and_wake_up_bit (Arnaud Bonnet)
nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper (Arnaud Bonnet)
bpf: Reject negative optlen in cgroup getsockopt hook (Junseo Lim) [Orabug: 40041688] {CVE-2026-90157}
lwt_bpf: Restore reserved headroom after xmit program (Junseo Lim) [Orabug: 40041697] {CVE-2026-90160}
smb/server: preserve error status in smb2_handle_negotiate() (Zhangguodong)
hwmon: (emc1403) Add support for EMC1442 (Delphine Cc Chiu)
mailbox: rockchip: disable pclk on probe failure and unbind (Linmao Li)
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() (Arnaldo Carvalho de Melo)
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() (Arnaldo Carvalho de Melo)
crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (Zhushuai Yin)
bpf: Fix pending_pos walk on 32-bit ring position wrap (Israel Tellez Garcia)
tracing: Have trace_event_update_all() only handle module that is loading (Steven Rostedt)
tracing: Remove 'attribute()' from the type field of event format (Masami Hiramatsu)
ALSA: core: Fix use-after-free in snd_card_do_free() (Aleksandr Nogikh) [Orabug: 40041815] {CVE-2026-90198}
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Chandrakanth Patil) [Orabug: 40041829] {CVE-2026-90202}
Squashfs: check block offset is not negative (Phillip Lougher) [Orabug: 40041835] {CVE-2026-90203}
ocfs2: fix circular locking dependency in ocfs2_init_acl() (Krystian Kaniewski) [Orabug: 40072807] {CVE-2026-93252}
bpftool: Fix double close in map dump (Yuan Chen)
x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported (Bijan Tabatabai)
clocksource/drivers/armada: Unwind timer clock on init failure (Yuho Choi)
clocksource/drivers/clps711x: Do not unmap clocksource MMIO (Guangshuo Li)
s390/debug: Fix deadlock during unregister (Peter Oberparleiter)
xenbus: Unregister reboot notifier on init failure (Yuho Choi)
power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (Henrik Grimler)
power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (Henrik Grimler)
power: supply: bq27xxx: bq27520g4: fix REG_TTES address (Henrik Grimler)
power: supply: bd99954: Drop bad register fields (Matti Vaittinen)
spi: img-spfi: don't disable runtime PM on DMA deferred probe (Felix Gu)
selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM (Vineet Gupta)
selftests/bpf: Add description for running vmtest on RV64 (Pu Lehui)
selftests/bpf: Support local rootfs image for vmtest (Pu Lehui)
selftests/bpf: Limit URLS parsing logic to actual scope in vmtest (Pu Lehui)
selftests/bpf: Fix vmtest.sh getopts optstring (Daniel Xu)
bpf/docs: Update list of architectures supported. (Kp Singh)
selfetests/bpf: Adapt vmtest.sh to s390 libbpf CI changes (Ilya Leoshkevich)
selfetests/bpf: Update vmtest.sh defaults (Yucong Sun)
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC (Ran Hongyun)
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (Rosen Penev)
ubi: Fix rollback for explicit UBI device numbers (Yuho Choi) [Orabug: 40041884] {CVE-2026-90216}
ubi: fastmap: Add module parameter to control reserving filling pool PEBs (Zhihao Cheng)
ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs (Zhihao Cheng)
ubi: fastmap: Wait until there are enough free PEBs before filling pools (Zhihao Cheng)
ubi: Simplify bool conversion (Yang Li)
ubi: fastmap: Add fastmap control support for module parameter (Zhaolong Wang)
ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl (Zhihao Cheng)
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs (Zhihao Cheng)
UBI: Preserve torture flag when rescheduling failed erasures (Zhihao Cheng)
ubi: Replace erase_block() with sync_erase() (Zhihao Cheng)
ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap (Zhihao Cheng)
ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash (Zhihao Cheng)
ubi: fastmap: Fix missed ec updating after erasing old fastmap data block (Zhihao Cheng)
ubi: fastmap: Use the bitmap API to allocate bitmaps (Christophe Jaillet)
ubi: Fix repeated words in comments (Jilin Yuan)
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (Liangcheng Wang)
ASoC: pxa: Use devm_clk_get_optional() for extclk clock (Bui Duc Phuc)
RDMA/cma: Fix WARNING in res_to_rt (Zhu Yanjun) [Orabug: 40041894] {CVE-2026-90218}
RDMA/cxgb4: Free debugfs on registration failure (Fan Wu) [Orabug: 40041898] {CVE-2026-90219}
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (Guangshuo Li)
nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (Yun Zhou)
nfc: digital: Do not dump a NULL response in command completion (Linmao Li)
nfc: pn533: hold a reference to the request skb during send_frame (Yinhao Hu)
nfc: llcp: bound SNL TLV parsing to the skb and add length checks (Doruk Tan Ozturk)
nfc: nci: fix double completion race in nci_data_exchange_complete (Zhenghang Xiao)
nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (Breno Leitao)
nfc: llcp: avoid userspace overflow on invalid optlen (Breno Leitao)
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (Guixin Liu) [Orabug: 40041940] {CVE-2026-90228}
spi: sprd-adi: Fix probe succeeding without registering the controller (Babanpreet Singh)
powerpc/configs: enable CONFIG_RAS to fix EDAC support (Michael Walle)
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (Weiming Shi) [Orabug: 40033069] {CVE-2026-89784}
m68k: Fix backtraces for non-running tasks (Karl Mehltretter)
iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes)
fbdev: kyro: Validate overlay viewport coordinates (Danila Chernetsov)
perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads (Ian Rogers)
perf synthetic-events: Fix uninitialized pthread_join (Ian Rogers)
perf stat: Fix evsel_list leak in cmd_stat (Ian Rogers)
perf stat: Clear screen only if output file is a tty (Namhyung Kim)
ARM: dts: helios4: add SATA regulator supplies (Rosen Penev)
ARM: dts: helios4: add vcc-supply to GPIO expander (Rosen Penev)
ARM: dts: helios4: add vcc-supply to EEPROM (Rosen Penev)
arm64: dts: turris-mox: fix usb3 phys (Tomas Macholda)
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss (Victor Nogueira) [Orabug: 40042005] {CVE-2026-90248}
iio: light: gp2ap002: re-enable irq if runtime suspend fails (Nikhil Gautam)
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes (Nikhil Gautam)
Bluetooth: MSFT: validate evt_prefix_len against the response length (Ali Ahmet Memis)
Bluetooth: virtio_bt: avoid OOB read of build info string (Hyeongjun An)
scsi: sd: Fix sd_done() sense handling condition (Yang Xiuwei)
perf trace-event: Fix integer truncation in do_read() and skip() (Tanushree Shah)
Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (Zijun Hu)
sched/fair: Check CPU capacity before comparing group types during load balance (Ricardo Neri)
regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (Kamal Wadhwa)
coresight: etm4x: fix underflow for usage of (nrseqstate - 1) (Levi Yun) [Orabug: 40042071] {CVE-2026-90274}
coresight: Change syncfreq to be a u8 (James Clark)
coresight: etm4x: Cleanup TRCIDR5 register accesses (James Clark)
coresight: etm4x: Cleanup TRCIDR4 register accesses (James Clark)
coresight: etm4x: Cleanup TRCIDR3 register accesses (James Clark)
coresight: etm4x: Cleanup TRCIDR2 register accesses (James Clark)
coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() (Levi Yun)
phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (Loic Poulain)
soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (Linkai Gong)
hugetlbfs: release subpool on fill_super failure (Chenyichong) [Orabug: 40042091] {CVE-2026-90283}
pinctrl: rockchip: Reset the pin count when recalculating SoC data (Simon Glass)
firmware_loader: do not queue completed sysfs fallback requests (Mukesh Ojha) [Orabug: 40042095] {CVE-2026-90284}
firmware_loader: Check fw_state_is_done in loading_store (Russ Weight)
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path (Manish Rangankar) [Orabug: 40042099] {CVE-2026-90285}
drm/amdgpu/gfx6: Use PFP on the compute queues too (Timur Kristof)
drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (Timur Kristof)
perf trace-event: Fix buffer overflow in read_string() (Tanushree Shah)
phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (Gerald Loacker)
ext4: fix spurious message about orphan cleanup on RO fs (Jan Kara)
drm/amdgpu/gfx6: Fixup emit_cntxcntl() (Timur Kristof)
mfd: iqs62x: Reject zero-length firmware records (Pengpeng Hou)
mfd: rave-sp: validate received frame payload lengths (Pengpeng Hou)
arm64: hibernate: Restore DAIF state on error (Vladimir Murzin) [Orabug: 40042117] {CVE-2026-90290}
arm64: hibernate: mask DAIF before restoring hibernated kernel (Ada Couprie Diaz) [Orabug: 40072826] {CVE-2026-93256}
RDMA/siw: Fix use-after-free in siw_accept() (Shuangpeng Bai)
RDMA/siw: Introduce siw_free_cm_id (Guoqing Jiang)
IB/isert: post the full-feature receive buffers after session registration (Yehyeong Lee) [Orabug: 40042126] {CVE-2026-90293}
IB/isert: delay the final Login Response until the session is registered (Yehyeong Lee) [Orabug: 40042130] {CVE-2026-90294}
cpufreq: imx6q: fix out-of-bounds write when probed more than once (Karl Mehltretter)
cpufreq: imx6q: fix devres accumulation across driver rebind (Karl Mehltretter)
drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (Jernej Skrabec)
drm/sun4i: dw-hdmi: Drop TCON TOP port reference (Jernej Skrabec)
drm/sun4i: tcon: Drop remote endpoint reference (Jernej Skrabec)
drm/sun4i: crtc: Propagate layer initialization error (Jernej Skrabec)
drm/sun4i: tcon: Drop TCON TOP device reference (Jernej Skrabec)
bitfield: Add non-constant field_{prep,get}() helpers (Geert Uytterhoeven)
bitfield: Add less-checking _FIELD{GET,PREP}() (Geert Uytterhoeven)
of: property: use unsigned int return on of_graph_get_endpoint_count() (Kuninori Morimoto)
of: property: add missing kerneldoc for of_graph_get_endpoint_count() (Kuninori Morimoto)
drm/sun4i: vi scaler: Fix coefficient selection (Jernej Skrabec)
ocfs2: synchronize heartbeat callbacks with o2net teardown (Cen Zhang) [Orabug: 40042163] {CVE-2026-90302}
ocfs2: use bitmap API in fill_node_map (Joseph Qi)
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults (Yuanbin Xie)
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (Yehyeong Lee) [Orabug: 40042182] {CVE-2026-90307}
scripts/tags.sh: Prevent binary files appearing in cscope.files (Sergei Litvin)
scripts/tags.sh: improve compiled sources generation (Jialu Xu)
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() (Mukesh Ojha) [Orabug: 40042202] {CVE-2026-90314}
remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() (Mukesh Ojha)
remoteproc: Move resource table data structure to its own header (Mukesh Ojha)
PCI/sysfs: Add static PCI resource attribute macros (Krzysztof Wilczynski)
drm/omap: dsi: Do not copy isr table (Andreas Kemnade) [Orabug: 40042212] {CVE-2026-90316}
fat: release buffer head after rebuilding parent (Chenyichong) [Orabug: 40042220] {CVE-2026-90318}
rapidio: clear mport->net when rio_add_net() fails (Guangshuo Li)
pps-gpio: remove dead capture_clear code (Calvin Owens)
pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler (Michael Byczkowski)
pps: clients: gpio: Bypass edge's direction check when not needed (Bastien Curutchet)
pps: don't try to wait for negative timeouts in PPS_FETCH (Calvin Owens)
lib/string: fix memchr_inv() for large ranges (Bradley Morgan)
block/kyber-iosched: flush per-cpu latency buckets over possible CPUs (Tao Cui)
block/blk-iocost: collect per-cpu latency stats over possible CPUs (Tao Cui)
block/blk-stat: drain per-cpu callback stats over possible CPUs (Tao Cui)
phonet: pep: do not write beyond optlen in getsockopt (Breno Leitao) [Orabug: 40042250] {CVE-2026-90327}
iio: light: tsl2583: return zero in write_raw() on success (Sang-Heon Jeon)
iio: light: isl29028: return zero in write_raw() on success (Sang-Heon Jeon)
iio: light: tsl2772: fix ALS calibscale readback (Yuanshen Cao)
perf intel-bts: Fix off-by-one in auxtrace_info minimum size check (Arnaldo Carvalho de Melo)
perf intel-pt: Fix off-by-one in auxtrace_info minimum size check (Arnaldo Carvalho de Melo)
perf auxtrace: Fix queue grow overflow and old array leak (Arnaldo Carvalho de Melo)
perf thread-stack: Fix heap buffer overflow on branch stack wrap copy (Arnaldo Carvalho de Melo)
HID: lg4ff: validate report length before fixed offsets (Jiancheng Huang)
HID: i2c-hid: Fix '(null)' output when reading report descriptor fails (Ai Chao)
HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (Hans de Goede)
HID: synchronize input before cleaning up a failed probe (Yousef Alhouseen) [Orabug: 40042260] {CVE-2026-90329}
HID: ensure timely release of driver-allocated resources (Dmitry Torokhov)
HID: split apart hid_device_probe to make logic more apparent (Dmitry Torokhov)
tty: clear cdev pointer after cdev_add() failure (Karl Mehltretter) [Orabug: 40042274] {CVE-2026-90334}
serial: amba-pl011: unprepare console clock on unregister (Karl Mehltretter)
MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL (Thomas Bogendoerfer)
powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass (Gou Hao)
firmware: coreboot: Validate table bounds (Laxman Acharya Padhya)
firmware: google: Add bounds checks in coreboot_table_populate() (Titouan Ameline de Cadeville)
wifi: mac80211: skip unused probe response countdown offsets (Catherine)
wifi: zd1211rw: reject secondary interfaces to prevent conflicts (Slawomir Stepien)
wifi: mac80211: send TWT teardown to peer after setup TX failure (Catherine)
iommu/arm-smmu-v3: Convert to use atomic poll timeout (Pranjal Shrivastava)
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (Linghui Wu)
perf machine: Check snprintf truncation for guest kallsyms path (Arnaldo Carvalho de Melo)
perf machine: Free scandir entries in guest kernel map creation (Arnaldo Carvalho de Melo)
perf machine: Reset errno before strtol in guest kernel map creation (Arnaldo Carvalho de Melo)
perf machine: Don't abort guest map creation on first inaccessible dir (Arnaldo Carvalho de Melo)
perf machine: Check snprintf truncation in machines__findnew() (Arnaldo Carvalho de Melo)
perf machine: Use snprintf() for guestmount path construction (Arnaldo Carvalho de Melo)
perf machine: Guard against NULL strlist in machines__findnew() (Arnaldo Carvalho de Melo)
regulator: core: use system_freezable_wq for init complete work (Joy Zou) [Orabug: 40042349] {CVE-2026-90360}
wifi: ath11k: fix leak in ath11k_service_ready_ext_event() (Jeff Johnson) [Orabug: 40042353] {CVE-2026-90361}
drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (Konrad Dybcio) [Orabug: 40042356] {CVE-2026-90362}
perf: arm_spe: Make wakeup range check overflow safe (Leo Yan)
wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (Felix Fietkau)
wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (Felix Fietkau) [Orabug: 40042387] {CVE-2026-90372}
wifi: mt76: mt792x: Fix memory leak in SDIO TX path (Eason Lai)
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (Lucid Duck) [Orabug: 40042410] {CVE-2026-90382}
fanotify: report full event length for FIONREAD (Chenyichong)
misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (Abdun Nihaal)
locking/lockdep: Fix NULL pointer dereference in __lock_set_class() (Naveen Kumar Chaudhary)
i3c: master: Fix device_register() error path (Adrian Hunter)
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (Jakub Kicinski)
iommu/dma: Check atomic pool allocation result directly (Aneesh Kumar K V) [Orabug: 40042431] {CVE-2026-90388}
clk: qcom: Return expected ENOMEM error on dynamic allocation failure (Vladimir Zapolskiy)
lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone (Stanislav Kinsburskii)
bpf: Fix potential UAF in bpf_netns_link_update_prog (Pu Lehui) [Orabug: 40042447] {CVE-2026-90393}
power: supply: sc2731_charger: cancel work on remove (Hongyan Xu)
power: supply: sc2731_charger: Convert to platform remove callback returning void (Uwe Kleine-Konig)
power: supply: isp1704_charger: cancel work on remove (Hongyan Xu) [Orabug: 40042457] {CVE-2026-90395}
selftests/zram: fix kernel_gte() for POSIX sh (Cheng-Han Wu)
md/raid5-ppl: fix use-after-free in ppl_do_flush() (Sajal Gupta) [Orabug: 40072849] {CVE-2026-93262}
bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (Manivannan Sadhasivam)
wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (Abdun Nihaal) [Orabug: 40042478] {CVE-2026-90403}
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request (Guixin Liu) [Orabug: 40042499] {CVE-2026-90411}
IB/isert: reject login PDUs declaring more data than was received (Yehyeong Lee) [Orabug: 40042504] {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received (Yehyeong Lee) [Orabug: 40042508] {CVE-2026-90414}
RDMA/cxgb4: free STAG index when TPT entry write fails (Leon Romanovsky) [Orabug: 40042512] {CVE-2026-90415}
RDMA/mlx5: Send cong param changes to the resolved port mdev (Leon Romanovsky)
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs (Leon Romanovsky) [Orabug: 40042520] {CVE-2026-90416}
scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. (David Strahan)
nilfs2: prevent out-of-bounds read in super root block parsing (David Lee)
nilfs2: fix infinite loop in nilfs_clean_segments() (Joshua Crofts)
clk/x86: pmc_atom: add kasprintf return value check (Longlong Yan)
clk: palmas: Manage external-control prepare with devm (Myeonghun Pak)
clk: tegra: tegra124-emc: put EMC node on register failure (Guangshuo Li)
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix (Ondrej Jirman)
RDMA/efa: Fix PBL chunk length computation (Yonatan Nachum) [Orabug: 40072858] {CVE-2026-93264}
fs/ntfs3: reject restart table growth beyond U16_MAX entries (Weiming Shi)
staging: rtl8723bs: use kfree_sensitive() for key material (Ivy Lopez)
remoteproc: Prevent crash handling to race with rproc_del() (Bjorn Andersson) [Orabug: 40042566] {CVE-2026-90431}
remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() (Jingyi Wang)
remoteproc: Use unbounded workqueue for recovery work (Mukesh Ojha)
w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (Babanpreet Singh)
isofs: release zisofs block pointer buffer head (Chenyichong) [Orabug: 40042576] {CVE-2026-90434}
RDMA/mlx5: Fix integer overflow of user QP buffer size (Maher Sanalla) [Orabug: 40042580] {CVE-2026-90435}
crypto: keembay - publish OF module alias for OCS AES/SM4 (Can Peng)
crypto: keembay - Initialize completion before requesting IRQ (Linmao Li)
power: supply: sbs-battery: Use a per-device serial number buffer (Babanpreet Singh)
ARM: lpc32xx: only run SoC init on LPC32xx hardware (Karl Mehltretter)
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt (Fabio Estevam)
arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru (Rob Herring)
arm64: dts: rockchip: Add gru-scarlet-dumo board (Chen-Yu Tsai)
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init (Weiming Wu)
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet (Florian Westphal) [Orabug: 40079958] {CVE-2026-100070}
drm/tve200: add OF module alias for autoloading (Can Peng)
leds: pca9532: Fix phantom device registration on missing hardware (Cosmo Chou)
perf cs-etm: Avoid truncating AUX buffer sizes to int (Leo Yan)
perf cs-etm: Flush thread stacks after decoder reset (Leo Yan)
ARM: dts: allwinner: a10: Fix PMU interrupt (Andre Przywara)
ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() (Xiang Mei) [Orabug: 40033090] {CVE-2026-89787}
ext4: fix buffer_head leak in ext4_init_orphan_info (Guanghui Yang) [Orabug: 40042631] {CVE-2026-92494}
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (Jeff Johnson) [Orabug: 40042636] {CVE-2026-92496}
ath11k: add trace log support (Venkateswara Naralasetty)
wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (Jeff Johnson)
wifi: ath6kl: avoid buffer overreads in WMI event handlers (Jeff Johnson) [Orabug: 40042641] {CVE-2026-92498}
ext4: drain in-flight DIO before buffered write fallback (Baokun Li) [Orabug: 40042653] {CVE-2026-92501}
thermal: intel: int3400: clean up ODVP on probe failures (Pengpeng Hou) [Orabug: 40042661] {CVE-2026-92504}
thermal: int340x_thermal: Consolidate priv->data_vault checks (Rafael J. Wysocki)
iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() (Mukesh Ojha)
iommu/qcom: Remove sysfs device on probe failure path (Haoxiang Li)
iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe (Miaoqian Lin)
RDMA/core: Fix potential use after free in ib_free_cq() (Patrisious Haddad) [Orabug: 40042671] {CVE-2026-92508}
RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() (Mark Zhang)
RDMA/restrack: Fix typos in the comments (Kalesh Ap)
RDMA/srpt: Pass the mapped task attribute to target_init_cmd() (Leon Romanovsky)
ext4: skip extra isize expansion during mount to prevent deadlock (Yun Zhou) [Orabug: 40072874] {CVE-2026-93268}
ext4: fix out-of-bounds read in ext4_read_inline_dir() (Xiang Mei) [Orabug: 40033084] {CVE-2026-89786}
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (Chen Pei) [Orabug: 40042714] {CVE-2026-92521}
ACPI: processor: validate MADT IOAPIC entry bounds (Pengpeng Hou) [Orabug: 40042719] {CVE-2026-92522}
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() (Kemeng Shi) [Orabug: 40042729] {CVE-2026-92524}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (Zheng Tan) [Orabug: 40079981] {CVE-2026-100075}
RDMA/hfi1: Propagate sdma_txinit_ahg() errors (Danila Chernetsov) [Orabug: 40042739] {CVE-2026-93037}
arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe (Yan Jun)
ASoC: meson: Keep link pointers valid on realloc failure (Linmao Li) [Orabug: 40042746] {CVE-2026-93039}
dmaengine: dw-edma: Clear stale requests on termination (Koichiro Den)
dmaengine: dw-edma: Serialize channel state checks (Koichiro Den)
dmaengine: dw-edma: Serialize abort state updates (Koichiro Den)
driver core: soc: Unregister bus on early device registration failure (Yuho Choi)
driver core: soc: remove layering violation for the soc_bus (Greg Kroah-Hartman)
software node: Fix software_node_get_reference_args() with index -1 (Alban Bedel) [Orabug: 40042772] {CVE-2026-93046}
perf ui hists: Fix uninitialized stack memory free on pstack allocation failure (Ian Rogers)
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (Zhouminqiang) [Orabug: 40042782] {CVE-2026-93048}
mtd: mtdswap: Avoid freeing registered blktrans device twice (Ruoyu Wang) [Orabug: 40042803] {CVE-2026-93049}
vfio/pci: clear vdev->msi_perm after freeing it on init failure (Xiang Mei) [Orabug: 40033020] {CVE-2026-89777}
char: xilinx_hwicap: unregister class on init errors (Myeonghun Pak)
ppdev: prevent overflow when setting port timeout (Linmao Li)
misc: ad525x_dpot: use driver core groups for sysfs files (Pengpeng Hou) [Orabug: 40042818] {CVE-2026-93051}
misc: ad525x_dpot: Make ad_dpot_remove() return void (Uwe Kleine-Konig)
misc: rtsx: add missing write register handling (Gleb Markov)
misc: bcm-vk: Use acquire/release for msgq_inited (Gui-Dong Han)
speakup: keyhelp: guard letter_offsets possible out-of-range indexing (Pavel Zhigulin)
accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (Christophe Jaillet)
uio: Fix stale info pointer in failed registration path (Yuho Choi) [Orabug: 40042833] {CVE-2026-93054}
UDF symlink pathComponent header OOB read (David Lee) [Orabug: 40042841] {CVE-2026-93055}
tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (Karl Mehltretter)
usb: gadget: f_uac1_legacy: remove broken string configfs attributes (Xu Yang) [Orabug: 40042849] {CVE-2026-93056}
ACPI: processor: idle: Expand _LPI package sanity checks (Rafael J. Wysocki)
ACPI: move from strlcpy() with unused retval to strscpy() (Wolfram Sang)
crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (Thorsten Blum)
gpu: host1x: Avoid stack over-read in debug output helpers (Mikko Perttunen) [Orabug: 40042866] {CVE-2026-93061}
gpu: host1x: Fix offset calculation in trace_write_gather (Mikko Perttunen)
arm64: dts: qcom: sm8250: Add camcc DT node (Bryan O'Donoghue)
arm64: dts: qcom: sm8250: remove mmcx regulator (Dmitry Baryshkov)
arm64: dts: qcom: sm8250: Use QMP property to control load state (Sibi Sankar)
drm/bridge: tc358767: clamp the reported AUX read size to the request (Maoyi Xie) [Orabug: 40042884] {CVE-2026-93067}
remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (Uday Khare)
cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() (Zhongqiu Han)
cpufreq: intel_pstate: Fix setting minimum P-state at init time (Rafael J. Wysocki)
genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips() (Herve Codina)
irqdomain: Handle additional domain flags in irq_domain_instantiate() (Herve Codina)
irqdomain: Introduce irq_domain_instantiate() (Herve Codina)
irqdomain: Introduce irq_domain_free() (Herve Codina)
cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() (Dan Carpenter)
libnvdimm/labels: Bound the on-media label size before the shift (Bryam Vargas)
wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (Baochen Qiang) [Orabug: 40072894] {CVE-2026-93271}
hfsplus: validate thread record before delete key rebuild (Kyle Zeng)
rpmsg: glink: fix deadlock in endpoint destroy during driver detach (Vishnu Santhosh) [Orabug: 40043409] {CVE-2026-93098}
rpmsg: glink: remove duplicate code for rpmsg device remove (Srinivas Kandagatla)
rpmsg: glink: Remove the rpmsg dev in close_ack (Arun Kumar Neelakantam)
isofs: fix out-of-bounds page array access on empty zisofs block (Xiang Mei) [Orabug: 40033029] {CVE-2026-89778}
fs/isofs: replace kmap() with kmap_local_page() (Fabio M. De Francesco)
RDMA/hfi1: Initialize debugfs after probe completes (Leon Romanovsky)
RDMA/hfi1: Stop flushing the global IB workqueue (Leon Romanovsky)
RDMA/hfi1: Create workqueues before device initialization (Leon Romanovsky)
RDMA/hfi1: Remove redundant PCI device ID validation (Leon Romanovsky)
RDMA/hfi1: Free RX data on late probe failure (Leon Romanovsky) [Orabug: 40042983] {CVE-2026-93102}
RDMA/hfi1: Preserve unit 0 on allocation failure (Leon Romanovsky) [Orabug: 40042988] {CVE-2026-93103}
misc: rtsx_usb: avoid USB I/O in runtime autosuspend (Sean Rhodes)
pmdomain: bcm: bcm2835: handle genpd provider registration errors (Pengpeng Hou)
ALSA: hpi: Check transport errors during HPI6000 adapter initialization (Evgenii Burenchev)
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full (Xiang Mei) [Orabug: 40033063] {CVE-2026-89783}
hwrng: ks-sa - Fix runtime PM cleanup on registration failure (Yuho Choi)
hwrng: ks-sa - access private data via struct hwrng (Martin Kaiser)
RDMA/ipoib: Drain RCU callbacks during module teardown (Leon Romanovsky) [Orabug: 40043009] {CVE-2026-93108}
RDMA/mlx5: Drain RCU callbacks during module teardown (Leon Romanovsky) [Orabug: 40043015] {CVE-2026-93109}
RDMA/core: Wait for RCU callbacks before unloading ib_core (Leon Romanovsky) [Orabug: 40043022] {CVE-2026-93110}
RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage (Tetsuo Handa)
iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (Mert Seftali)
drm/panel: samsung-s6d16d0: Power off on prepare failure (Laxman Acharya Padhya)
usb: renesas_usbhs: Fix power-off ordering on unbind (Biju Das)
usb: mtu3: allow system suspend during active gadget connection (Fei Shao)
platform/surface: acpi-notify: Check ACPI companion before use (Linmao Li)
platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (Linmao Li)
usb: gadget: configfs: fix out-of-bounds read of qw_sign (Michael Bommarito) [Orabug: 40043062] {CVE-2026-93120}
hwspinlock: propagate errno when registering single lock (Wolfram Sang)
platform/x86: dell-wmi-base: Fix resource leak on module load failure (Armin Wolf) [Orabug: 40043089] {CVE-2026-93130}
platform/x86: dell-privacy: Fix race condition (Armin Wolf)
leds: pca9532: Fix inverted GPIO output polarity (Cosmo Chou)
iommu/amd: Fix false positive in SB IOAPIC IVRS validation (Wei Wang)
iommu/amd: Add support for Hygon family 18h model 4h IOAPIC (Fu Hao)
iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors (Wei Wang)
iommu/msm: Return -ENOMEM on memory allocation failure in probe (Vladimir Zapolskiy)
iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX (Akari Tsuyukusa)
efi: fix stale reference to efi_recover_from_page_fault() (Breno Leitao)
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux (Daniel Borkmann) [Orabug: 40043115] {CVE-2026-93138}
udf: Mark LVID buffer as uptodate before marking it dirty (Aleksandr Nogikh) [Orabug: 40043122] {CVE-2026-93140}
usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (Hongyan Xu)
clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() (Herman van Hazendonk) [Orabug: 40043147] {CVE-2026-93145}
clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
clk: qcom: gdsc: enable optional power domain support (Dmitry Baryshkov)
clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains (Herman van Hazendonk)
clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status (Herman van Hazendonk)
timekeeping: Account for monotonicity adjustment in ntp_error (David Woodhouse)
y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 (Thomas Weissschuh)
clocksource: Unregister subsystem on device registration failure (Yuho Choi)
selftests: timers: leap-a-day: Fix -w option and update usage comment (Jiangshan Yi)
irqchip/gic-v3-its: Fix memleak in its_probe_one() (Kemeng Shi)
selftests/bpf: Fix memory leak in msg_alloc_iov (Feng Yang)
selftests/bpf: Fix memory leak in msg_alloc_iov error path (Malaya Kumar Rout)
ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (Evgenii Burenchev)
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (Dawei Feng) [Orabug: 40079942] {CVE-2026-98160}
staging: fbtft: Use sysfs_emit_at() to print to sysfs file (Dan Carpenter)
greybus: audio: bound the topology section sizes against the fetched size (Bryam Vargas)
staging: sm750fb: gate dualview dataflow using g_dualview (Ahmet Sezgin Duran)
staging: greybus: audio: correct sscanf() return value check (Alexander A. Klimov)
PM: sleep: Fix off-by-one in wakelocks number limit check (Tuhaowen)
bus: ti-sysc: Fix /chosen node reference leak (Yuho Choi)
nvmet-rdma: fix response resource leak on queue teardown (Shin'Ichiro Kawasaki) [Orabug: 40043175] {CVE-2026-93151}
nvmet-rdma: factor out response resource cleanup (Shin'Ichiro Kawasaki)
nvmet-rdma: use sbitmap to replace rsp free list (Guixin Liu)
nvmet-rdma: avoid circular locking dependency on install_queue() (Hannes Reinecke)
crypto: sa2ul - stop probe if context pool creation fails (Pengpeng Hou)
crypto: sa2ul - Use the defined variable to clean code (Tang Bin)
crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (Lothar Rubusch)
crypto: atmel-ecc - reject hardware ECDH without a public key (Thorsten Blum)
crypto: atmel-ecc - clean up and improve ECDH comments (Thorsten Blum)
crypto: atmel-ecc - replace min_t with min (Thorsten Blum)
crypto: qat - clear AES key schedule from stack (Giovanni Cabiddu) [Orabug: 40043212] {CVE-2026-93161}
platform/chrome: sensorhub: Fix memory overread in ring handler (Tzung-Bi Shih) [Orabug: 40043224] {CVE-2026-93165}
selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check (Hisam Mehboob)
csky: Fix a4/a5 restoration in syscall trace path (Hanlin Song)
iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (Sanjay Chitroda)
soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (Srinivas Kandagatla)
dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (Vladimir Zapolskiy)
dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (Suraj Gupta)
dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (Vladimir Zapolskiy)
tools/bpf/bpftool: Reset vmlinux BTF after map commands (Chenyichong)
bpftool: Fix pretty print dump for maps without BTF loaded (Jiri Olsa)
bpftool: Use libbpf_get_error() to check error (Hengqi Chen)
bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls (Andrii Nakryiko)
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (Asad Kamal) [Orabug: 40043261] {CVE-2026-93177}
drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (Asad Kamal) [Orabug: 40043267] {CVE-2026-93178}
perf tests: Fix flakiness in BPF counters test on hybrid systems (Ian Rogers)
perf test: Fix perf stat --bpf-counters on hybrid machines (Namhyung Kim)
perf test: Use sqrtloop workload to test bperf event (Tengda Wu)
perf test stat_bpf_counter.sh: Stabilize the test results (Veronika Molnarova)
perf test bpf-counters: Add test for BPF event modifier (Ian Rogers)
perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test (Thomas Richter)
perf tests stat_bpf_counters: Fix usage of '==' to address shellcheck warning (Athira Rajeev)
media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (Sean Young)
media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (Sean Young)
pinctrl: bcm2835: Don't remove an unregistered GPIO chip (Daniel Mccarthy) [Orabug: 40072907] {CVE-2026-93274}
perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails (Zide Chen)
drm/lima: call drm_mm_init() with a valid allocation range (Henrik Grimler)
clk: imx: scu: drop redundant init.ops variable assignment (Brian Masney)
ARM: imx: fix device_node refcount leaks in imx7_src_init() (Weigang He)
ARM: imx: fix device_node refcount leak in imx_src_init() (Weigang He)
clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller (Min Zhang)
ASoC: rt700-sdw: always drain jack work on remove (Runyu Xiao) [Orabug: 40043295] {CVE-2026-93185}
clk: moxart: remove unused variables, fix refcount leak (Alexander A. Klimov)
media: cec-pin: Fix event FIFO ordering (Gui-Dong Han)
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (Weigang He)
HID: roccat: bound device-supplied profile index (Michael Bommarito) [Orabug: 40043302] {CVE-2026-93188}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (Philipp Weber) [Orabug: 40043306] {CVE-2026-93189}
smack: restrict smackfs/{direct,mapped} values to 0-255 (Konstantin Andreev)
smack: deduplicate smackfs/{direct,mapped} file_operations (Konstantin Andreev)
smack: simplify write handlers of sysfs entries (Dmitry Antipov)
smack: fix incorrect task context in smack_msg_queue_msgrcv (Konstantin Andreev)
Smack: fix W=1 build warnings (Casey Schaufler)
drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (Maxime Ripard)
bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann) [Orabug: 38649013] {CVE-2025-40123}
clk: meson: align gxbb_32k_clk_sel number of parents with actual count (Martin Blumenstingl) [Orabug: 40033896] {CVE-2026-89947}
firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON (Arnaldo Carvalho de Melo)
batman-adv: bla: avoid CRC corruption due to parallel claim add (Sven Eckelmann) [Orabug: 40043348] {CVE-2026-93203}
batman-adv: dat: atomically update mac addresses (Sven Eckelmann) [Orabug: 40043352] {CVE-2026-93204}
ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE (Sean Shen)
ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei) [Orabug: 37844228] {CVE-2025-22039}
net: hns3: don't auto enable misc vector (Jian Shen)
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (Jiayuan Chen) [Orabug: 39622004] {CVE-2026-53078}
bridge: mrp: reject zero test interval to avoid OOM panic (Xiang Mei)
net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844463] {CVE-2025-22103}
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices (Jie Wang)
ax25: fix use-after-free bugs caused by ax25_ds_del_timer (Duoming Zhou)
bpf: Guard stack limits against 32bit overflow (Andrei Matei) [Orabug: 37283390] {CVE-2023-52676}
x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Steve Wahl) [Orabug: 37206382] {CVE-2024-50017}
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() (Seongjae Park)
mm/damon/vaddr-kunit: check region count in three_regions test (Seongjae Park)
mm/damon/vaddr: drop last same folio access check optimization (Seongjae Park)
mm/damon/core-kunit: check region count before testing in split_at() (Seongjae Park)
xhci: fix lost bounce buffers on TDs spanning several ring segments (Arthur Gautier) [Orabug: 40034134] {CVE-2026-90015}
drm/nouveau: Use write-combined maps for coherent (Faith Ekstrand)
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (Sunil Khatri)
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (Thadeu Lima de Souza Cascardo) [Orabug: 40033274] {CVE-2026-89816}
drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (Kavan Smith)
drm/gud: validate TV mode names before creating enum property (Tao Yu) [Orabug: 40072729] {CVE-2026-93234}
drm/gud: NUL-terminate TV mode names read from the device (Deepanshu Kartikey) [Orabug: 40033282] {CVE-2026-89817}
drm/amd/display: avoid divide-by-zero in __is_lut_linear() (Harry Wentland) [Orabug: 40033294] {CVE-2026-89821}
drm/hibmc: Fix list of formats on the primary plane (Thomas Zimmermann)
drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (Xu Wang)
drm: fix race between partial drm_dev_register() failure and ioctl (Danilo Krummrich) [Orabug: 40033314] {CVE-2026-89823}
drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (Johan Hovold)
f2fs: fix i_size when pinned fallocate partially fails (Zhan Xusheng)
f2fs: return writeback error from collapse range (Wenjie Qi)
f2fs: reject overlapping move range after len expansion (Hao-Qun Huang)
f2fs: return symlink writeback errors (Wenjie Qi)
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (Nilesh Javali) [Orabug: 40033434] {CVE-2026-89843}
scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics (Nilesh Javali)
scsi: qla2xxx: Drop vport reference under lock in report ID acquisition (Nilesh Javali)
scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() (Nilesh Javali) [Orabug: 40033450] {CVE-2026-89845}
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (Nilesh Javali) [Orabug: 40033458] {CVE-2026-89846}
scsi: qla2xxx: Avoid double completion in async IOCB timeout (Nilesh Javali) [Orabug: 40033466] {CVE-2026-89847}
scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() (Nilesh Javali) [Orabug: 40072776] {CVE-2026-93242}
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (Nilesh Javali) [Orabug: 40033478] {CVE-2026-89849}
scsi: qla2xxx: Don't query firmware state while chip is down (Nilesh Javali) [Orabug: 40033484] {CVE-2026-89850}
scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (Nilesh Javali) [Orabug: 40033491] {CVE-2026-89851}
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() (Nilesh Javali) [Orabug: 40033498] {CVE-2026-89852}
scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (Nilesh Javali) [Orabug: 40033505] {CVE-2026-89853}
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (Nilesh Javali) [Orabug: 40033511] {CVE-2026-89854}
scsi: qla2xxx: Serialize flash version read in reset handler (Nilesh Javali) [Orabug: 40033520] {CVE-2026-89855}
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation (Nilesh Javali) [Orabug: 40033524] {CVE-2026-89856}
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() (Nilesh Javali) [Orabug: 40033533] {CVE-2026-89858}
scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() (Nilesh Javali)
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() (Nilesh Javali) [Orabug: 40033547] {CVE-2026-89861}
scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters (Nilesh Javali)
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (Nilesh Javali) [Orabug: 40033554] {CVE-2026-89863}
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers (Nilesh Javali) [Orabug: 40033558] {CVE-2026-89864}
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (Nilesh Javali) [Orabug: 40033562] {CVE-2026-89865}
media: vimc: fix pixel format lookup in enum_framesizes (Arash Golgol)
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (Uday Khare)
media: venus: fix payload size calculation in parse_raw_formats() (Mohammed El Kadiri)
media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (Mohammed El Kadiri)
media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (Biren Pandya) [Orabug: 40033584] {CVE-2026-89872}
media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (Ming Qian)
media: tda18250: fix possible integer overflow (Ilya Krutskih) [Orabug: 40033595] {CVE-2026-89876}
media: s2255: check firmware size before reading trailing marker (Huanglei) [Orabug: 40033610] {CVE-2026-89878}
media: s2255: bound JPEG frame size before copying into the buffer (Hyeongjun An) [Orabug: 40033615] {CVE-2026-89879}
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (Valery Borovsky) [Orabug: 40033620] {CVE-2026-89880}
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (Valery Borovsky) [Orabug: 40033627] {CVE-2026-89881}
media: rc: sunxi-cir: Unregister rc device on probe failure (Myeonghun Pak)
media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (Christian Hewitt)
media: i2c: ov7740: fix use-after-destroy in remove (Biren Pandya)
media: i2c: ov02a10: fix endpoint parsing use-after-free (Biren Pandya)
media: go7007: defer the ALSA v4l2 put until card release (Shuangpeng Bai) [Orabug: 40033656] {CVE-2026-89890}
media: em28xx: fix use-after-free of dev_next->devlist on disconnect (Jiangong Han) [Orabug: 40033663] {CVE-2026-89891}
media: em28xx: defer audio-only extension registration (Diego Fernando Mancera Gomez) [Orabug: 40033668] {CVE-2026-89892}
media: cx23885: cancel NetUP CI work before teardown (Fan Wu) [Orabug: 40033675] {CVE-2026-89893}
media: cx231xx: reject geometry changes while the VBI queue is busy (Bryam Vargas) [Orabug: 40033680] {CVE-2026-89894}
media: cobalt: Avoid freeing ALSA private data twice (Ruoyu Wang)
media: cedrus: fix memory leak in cedrus_init_ctrls() (Dawei Feng)
media: cec: Serialize exclusive follower delivery (Ruoyu Wang) [Orabug: 40033697] {CVE-2026-89897}
media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (Yi Ding)
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (Valery Borovsky)
KVM: s390: Restore sigset on error path (Christian Borntraeger)
KVM: s390: Zero initialize irq in reinject_machine_check (Christian Borntraeger)
KVM: s390: Free guest debug data on vcpu destroy (Christian Borntraeger)
KVM: s390: Fix old_data leak in guest debug error path (Christian Borntraeger)
KVM: s390: Fix memory leak in guest debug handling (Christian Borntraeger)
KVM: s390: Fix length check __import_wp_info() (Christian Borntraeger)
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (Carlos Lopez) [Orabug: 40033805] {CVE-2026-89927}
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (Yosry Ahmed) [Orabug: 40033822] {CVE-2026-89930}
KVM: nVMX: Always flush vpid02 on first use (Yosry Ahmed) [Orabug: 40033830] {CVE-2026-89932}
iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (Sanjay Chitroda)
iio: srf04: fix pm_runtime handling on probe error path (Cong Nguyen)
iio: light: gp2ap002: Disable regulators on resume failure (Laxman Acharya Padhya)
iio: light: cm32181: return zero after writing calibscale (Giorgi Tchankvetadze)
iio: gyro: mpu3050: fix sign of raw angular velocity readings (Cong Nguyen)
iio: dac: m62332: Fix regulator reference count imbalance (Erick Henrique)
iio: chemical: sgp30: Handle IAQ thread creation failure (Linmao Li)
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (Moksh Panicker)
ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (Xu Wang)
AsoC: intel: sst: fix PCI device reference leak on probe failure (Haoxiang Li)
ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (Haoxiang Li)
ASoC: cs35l34: drain threaded IRQ before runtime suspend (Runyu Xiao) [Orabug: 40033886] {CVE-2026-89945}
ASoC: cs35l33: drain threaded IRQ before runtime suspend (Runyu Xiao)
i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (Linkai Gong)
clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks (Stephan Gerhold)
clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk (Stephan Gerhold)
clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src (Stephan Gerhold)
clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src (Stephan Gerhold)
clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
batman-adv: bla: prevent CRC corruptions after claim flush (Sven Eckelmann)
batman-adv: bla: fix freeing of claims on meshif deletion (Sven Eckelmann) [Orabug: 40033901] {CVE-2026-89948}
batman-adv: dat: avoid unaligned fault in IP extraction (Sven Eckelmann)
batman-adv: fix stale receive device on merged fragments (Zhiling Zou) [Orabug: 40033914] {CVE-2026-89951}
mtd: rawnand: validate ONFI extended parameter page sections (Pengpeng Hou) [Orabug: 40033918] {CVE-2026-89952}
mtd: mtdoops: free page bitmap when the backing MTD is removed (Xu Rao) [Orabug: 40033922] {CVE-2026-89953}
mtd: afs: validate v2 image info bounds (Pengpeng Hou)
parisc: Fix alignment of asm statements in head.S (Helge Deller)
parisc: eisa: Fix infinite loop when parsing invalid IRQ value (Pei Xiao)
nvdimm/btt: reject an arena whose nfree is below the lane count (Bryam Vargas) [Orabug: 40033967] {CVE-2026-89965}
Revert 'irqchip/mbigen: Fix mbigen node address layout' (Caina)
nvmet-tcp: reject unsolicited H2CData PDUs (Shivam Kumar) [Orabug: 40033975] {CVE-2026-89968}
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU (Shivam Kumar) [Orabug: 40033979] {CVE-2026-89969}
nvme-tcp: check the data direction of a C2HData PDU (Yehyeong Lee) [Orabug: 40033995] {CVE-2026-89973}
ALSA: pcm: Fix race between non-atomic ops and trigger-start (Takashi Iwai) [Orabug: 40034012] {CVE-2026-89979}
ALSA: harmony: initialize locks before requesting IRQ (Runyu Xiao)
i2c: mux: Fix channel node leak on adapter add failure (Ahmad Byagowi) [Orabug: 40034022] {CVE-2026-89982}
i2c: core: fix debugfs UAF on adapter removal (Vasileios Almpanis) [Orabug: 40034027] {CVE-2026-89983}
perf/x86/intel: Fix kernel address leakages in LBR stack (Dapeng Mi) [Orabug: 40034032] {CVE-2026-89984}
Input: aiptek - switch to using dev_groups for driver-specific attributes (Dmitry Torokhov)
Input: aiptek - validate raw macro indices before updating state (Pengpeng Hou)
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() (Bradley Morgan) [Orabug: 40034048] {CVE-2026-89989}
ata: ahci: work around lost interrupts on Marvell 88SE61xx (Hajo Noerenberg)
block: flag zoned disks with GENHD_FL_NO_PART (Damien Le Moal)
dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (Koichiro Den)
dmaengine: dw-edma: Complete descriptors before pausing (Koichiro Den)
dm: fix resume-vs-remove race (Mikulas Patocka) [Orabug: 40034074] {CVE-2026-89997}
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (Ibrahim Hashimov) [Orabug: 40034087] {CVE-2026-89999}
HID: rmi: fix OOB access with undersized RMI reports (Wei Jie Law) [Orabug: 40034091] {CVE-2026-90000}
scsi: pm8001: Use rollback index when freeing MSI-X vectors (Runyu Xiao) [Orabug: 40034112] {CVE-2026-90007}
scsi: target: iscsi: Reserve a terminator byte for the login payload (Sujal Tuladhar) [Orabug: 40034119] {CVE-2026-90011}
thermal/drivers/qoriq: Disable clock on resume failure (Can Peng)
thermal/drivers/imx: Disable clock on runtime resume failure (Can Peng)
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (Muhammad Bilal) [Orabug: 40034145] {CVE-2026-90017}
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (Muhammad Bilal) [Orabug: 40034152] {CVE-2026-90018}
usb: gadget: fix null pointer dereference in usb_put_function_instance() (Jeffin Philip) [Orabug: 40034156] {CVE-2026-90019}
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (Lovekesh Solanki)
usb: typec: ucsi: displayport: Fix OOB altmode array index (Jameson Thies) [Orabug: 40034211] {CVE-2026-90025}
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (Andy Shevchenko)
usb-storage: ene_ub6250: fix race between scan work and probe (Liu Qi) [Orabug: 40034249] {CVE-2026-90031}
media: usbtv: keep device alive while ALSA card exists (Shuangpeng Bai) [Orabug: 40034260] {CVE-2026-90032}
clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset (Stephan Gerhold)
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (Hyeongjun An) [Orabug: 40034266] {CVE-2026-90033}
usb: image: mdc800: change kmalloc() to kzalloc() (Griffin Kroah-Hartman) [Orabug: 40034275] {CVE-2026-90034}
espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca) [Orabug: 38152844] {CVE-2025-38097}
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() (Petr Vaganov) [Orabug: 40021009] {CVE-2026-89515}
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions (Masami Hiramatsu)
tracing/mmiotrace: Remove reference to unused per CPU data pointer (Steven Rostedt)
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (Zack Rusin) [Orabug: 39982308] {CVE-2026-80888}
net: ntb_netdev: Fix TX busy and drop handling (Koichiro Den)
ALSA: seq: Fix port lock leak in deliver_to_subscribers() (Tzung-Bi Shih)
selinux: reject an unclaimed class value in security_get_classes() (Bryam Vargas) [Orabug: 39982374] {CVE-2026-80912}
selinux: avoid implicit conversions in services code (Christian Gottsche)
fsnotify: Fix stale object mask after concurrent mark updates (Youngjae Kwon) [Orabug: 40021348] {CVE-2026-89595}
entry: Fix seccomp bypass after ptrace with TSYNC (Jinjie Ruan) [Orabug: 40021399] {CVE-2026-89603}
openvswitch: Fix CT limit teardown use-after-free (Yuqi Xu) [Orabug: 40020919] {CVE-2026-89488}
net: openvswitch: fix kernel-doc warnings in internal headers (Ilya Maximets)
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() (Norbert Szetei) [Orabug: 40034343] {CVE-2026-90049}
net: skbuff: don't touch shared zerocopy state in skb_tx_error() (Norbert Szetei) [Orabug: 40020575] {CVE-2026-80977}
platform/chrome: sensorhub: Fix dropped timestamp events and log spam (Tzung-Bi Shih)
udf: Fix i_lenExtents truncation on 32-bit kernels (Zhan Xusheng)
timer: Keep debugobjects state consistent in migrate_timer_list() (Thomas Gleixner)
taskstats: fix cpumask parsing cutting off the last character (Bradley Morgan)
smack: fix cred UAF in smack_file_send_sigiotask() (Jann Horn)
signal: avoid shared siginfo namespace rewrites (Bradley Morgan) [Orabug: 40072687] {CVE-2026-93222}
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (Myeonghun Pak) [Orabug: 40020406] {CVE-2026-80930}
w1: ds28e17: reject an oversize length on an I2C block read (Maoyi Xie)
vsock/virtio: flush works in dependency order (Chengfeng Ye) [Orabug: 40020418] {CVE-2026-80932}
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (Runyu Xiao)
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (Abdun Nihaal) [Orabug: 40020441] {CVE-2026-80941}
wifi: rtl818x: initialize eeprom_93cx6 struct to zero (Stanislaw Gruszka)
wifi: mwifiex: Detach sync cmd buffer on interrupted wait (Fabio Estevam) [Orabug: 40020450] {CVE-2026-80944}
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (Abdun Nihaal) [Orabug: 40020473] {CVE-2026-80949}
i3c: master: svc: bound IBI payload to the requested max_payload_len (Maoyi Xie)
i3c: master: Fix info leak and UAF in device unregister path (Adrian Hunter)
dm-switch: use WRITE_ONCE() in switch_region_table_write() (Xu Wang)
dm-stats: fix a crash if allocation of per-cpu data fails (Mikulas Patocka) [Orabug: 40020503] {CVE-2026-80963}
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() (Nathan Chancellor)
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (Naman Jain)
ALSA: virmidi: Check card index validity at probe (Takashi Iwai) [Orabug: 40020510] {CVE-2026-80964}
ALSA: serial-u16550: Check card index validity at probe (Takashi Iwai) [Orabug: 40020518] {CVE-2026-80965}
ALSA: portman2x4: Check card index validity at probe (Takashi Iwai)
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (Runyu Xiao) [Orabug: 40020528] {CVE-2026-80967}
ALSA: mts64: Check card index validity at probe (Takashi Iwai)
ALSA: mpu401: Check card index validity at probe (Takashi Iwai) [Orabug: 40020541] {CVE-2026-80969}
ALSA: bcd2000: clear the URB pointers on disconnect (Baul Lee) [Orabug: 40020546] {CVE-2026-80971}
ALSA: aloop: Check card index validity at probe (Takashi Iwai) [Orabug: 40020553] {CVE-2026-80972}
ALSA: 6fire: bound the MIDI event length from the device (Baul Lee) [Orabug: 40020557] {CVE-2026-80973}
seg6: reset IP6CB after IPv6 decapsulation (Zhiling Zou) [Orabug: 40020568] {CVE-2026-80976}
net: cap advertised IP tunnel headroom (Zhiling Zou) [Orabug: 40020586] {CVE-2026-80978}
net/smc: fix socket refcount leak in smc_switch_conns() (Hidayath Khan)
net: ntb_netdev: Count packets dropped on RX refill failure (Koichiro Den)
net: ntb_netdev: Avoid double-accounting netif_rx() drops (Koichiro Den)
NTB: ntb_transport: Reject oversized TX buffers (Koichiro Den) [Orabug: 40020617] {CVE-2026-80987}
NTB: ntb_transport: Fail TX enqueue when the QP link is down (Koichiro Den) [Orabug: 40020622] {CVE-2026-80988}
NTB: ntb_transport: Recycle TX entries before client callbacks (Koichiro Den)
net: openvswitch: fix nf_connlabels leak in ovs_ct_init (Ruoyu Wang)
net: openvswitch: fix flow mask use-after-free on flow deletion (Ilya Maximets) [Orabug: 40020651] {CVE-2026-80994}
net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40020672,40035523] {CVE-2026-81000}
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (Fabio Porcedda)
slip: fix use-after-free in sl_sync() (Aleksandr Khromov) [Orabug: 40020676] {CVE-2026-81001}
xdp: fix zero-copy frame layout (Weiming Shi) [Orabug: 40020684] {CVE-2026-81002}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device (Alexandra Winter)
ipmi: si: Fix NULL pointer dereference after failed registration (Seiji Nishikawa) [Orabug: 40020693] {CVE-2026-81005}
ipmi: ipmb: validate write message length (Yousef Alhouseen)
interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (Kuan-Wei Chiu) [Orabug: 40020706] {CVE-2026-81008}
platform/chrome: sensorhub: Bound the EC-reported sensor number (Bryam Vargas) [Orabug: 40020728] {CVE-2026-81017}
mmc: via-sdmmc: stop card-detect handling on probe failure (Fan Wu) [Orabug: 40020746] {CVE-2026-89440}
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (Hyeongjun An) [Orabug: 40020760] {CVE-2026-89444}
iommu/vt-d: Fix no_iommu to disable platform opt-in (Kevin Tian)
PCI/proc: Use file_ns_capable() when checking config space read access (Krzysztof Wilczynski) [Orabug: 40072623] {CVE-2026-93206}
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (Krzysztof Wilczynski)
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (Krzysztof Wilczynski)
PCI: meson: Fix GPIO state while requesting PERST# (Ronald Claveau)
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (Mohamad Raizudeen)
s390/dasd: Propagate partial completion length across ERP recovery (Stefan Haberland)
s390/dasd: Guard sysfs discipline callbacks against unallocated private data (Stefan Haberland)
s390/dasd: Do not complete a failed ESE read as successful (Stefan Haberland)
power: supply: max17040: synchronize work cancellation on suspend (Jianing Li) [Orabug: 40020807] {CVE-2026-89461}
power: supply: ucs1002: fix use-after-free on remove (Fan Wu)
power: supply: twl4030_charger: cancel workers via devm (Maoyi Xie)
power: supply: lp8727: fix use-after-free in lp8727_release_irq() (Fan Wu) [Orabug: 40020838] {CVE-2026-89469}
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (Jameson Thies)
power: supply: cros_usbpd-charger: bound the EC-reported port count (Bryam Vargas)
power: supply: bq256xx: drain usb_work before freeing the charger (Fan Wu)
power: supply: bq24257: fix use-after-free on remove (Fan Wu)
sctp: fix stream->outcnt underflow on duplicate RECONF responses (Jun Yang) [Orabug: 40020865] {CVE-2026-89476}
sctp: distinguish sequence zero from wildcard in reconf lookup (Jun Yang)
sctp: fix NULL deref on untransmitted RECONF completion (Weiming Shi) [Orabug: 40020869] {CVE-2026-89477}
sctp: drop a chunk if its transport was removed (Hyunwoo Kim) [Orabug: 40020874] {CVE-2026-89478}
sctp: stop processing a packet once its association is deleted (Hyunwoo Kim) [Orabug: 40020879] {CVE-2026-89479}
nvme-tcp: reject a read that transferred too few bytes (Yehyeong Lee) [Orabug: 40020884] {CVE-2026-89480}
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (Yehyeong Lee) [Orabug: 40020895] {CVE-2026-89482}
nvme: zero the discard fallback page (Yehyeong Lee) [Orabug: 40020900] {CVE-2026-89483}
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path (Ewan D. Milne)
lockd: pin next file across nlm_inspect_file lock-drop (Michael Bommarito) [Orabug: 40020908] {CVE-2026-89485}
hwmon: (max6621) fix temperature clamp range (Cong Nguyen)
hwmon: (max6621) fix negative temperature offset and crit readings (Cong Nguyen)
openvswitch: only skb_tx_error() a packet we are about to drop (Norbert Szetei) [Orabug: 40020915] {CVE-2026-89487}
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall (Ali Ahmet Memis)
ocfs2: fix readdir position truncation on 32-bit kernels (Zhan Xusheng) [Orabug: 40020927] {CVE-2026-89490}
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure (Joseph Qi)
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item (Joseph Qi)
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (Joseph Qi) [Orabug: 40020931] {CVE-2026-89491}
ocfs2: validate rl_used against rl_count in refcount block validator (Ibrahim Hashimov) [Orabug: 40020941] {CVE-2026-89493}
ocfs2: validate lengths in dlm_mig_lockres_handler (Bryam Vargas) [Orabug: 40020946] {CVE-2026-89494}
ocfs2: bound namelen in dlm_migrate_request_handler (Bryam Vargas) [Orabug: 40020953] {CVE-2026-89495}
ocfs2: always run deallocs on copy-on-write completion (Dmitry Antipov) [Orabug: 40020958] {CVE-2026-89496}
orangefs: skip leading spaces before parsing client debug masks (Zhiling Zou)
orangefs: fix double-free of trailer_buf on readdir copy failure (Yifei Gao)
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (Xu Wang)
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (Xu Wang)
RDMA/ucma: Lock the handler in ucma_set_ib_path() (Norbert Szetei) [Orabug: 40020989] {CVE-2026-89508}
RDMA/cxgb4: Cancel reg_work before freeing device on remove (Fan Wu) [Orabug: 40020994] {CVE-2026-89510}
qede: Fix NULL pointer dereference in TPA fragment processing (Vaibhav Nagare) [Orabug: 40020998] {CVE-2026-89511}
remoteproc: scp: Fix device reference leak on failed lookup (Johan Hovold)
rpmsg: glink: smem: order FIFO read after availability check (Chunkai Deng)
staging: media: tegra-video: vi: fix probe failure on skipped last port (Hao-Qun Huang)
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (Doruk Tan Ozturk) [Orabug: 40021029] {CVE-2026-89524}
udf: reject VAT indexes equal to the entry count (David Lee) [Orabug: 40021035] {CVE-2026-89525}
svcrdma: Fix pcl_for_each_segment for empty chunks (Chris Mason) [Orabug: 40021067] {CVE-2026-89532}
svcrdma: Fix offset arithmetic in read_chunk_range (Chris Mason) [Orabug: 40021070] {CVE-2026-89533}
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (Chuck Lever) [Orabug: 40021086] {CVE-2026-89538}
sunrpc: init gssp_lock before publishing proc entry (Chris Mason) [Orabug: 40021094] {CVE-2026-89540}
SUNRPC: harden gss_unwrap_resp_priv length checks (Chris Mason) [Orabug: 40021099] {CVE-2026-89541}
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat (Chris Mason)
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (Chris Mason) [Orabug: 40021115] {CVE-2026-89542}
SUNRPC: always drain cache_cleaner before destroying a cache_detail (Jeff Layton) [Orabug: 40021154] {CVE-2026-89548}
sunrpc: route to a populated pool in svc_pool_for_cpu() (Jeff Layton) [Orabug: 40021159] {CVE-2026-89549}
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (Chris Mason) [Orabug: 40021168] {CVE-2026-89551}
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (Harshit Varu) [Orabug: 40021181] {CVE-2026-89554}
mpls: reload header after pskb_may_pull() (Qing Ming) [Orabug: 40021185] {CVE-2026-89555}
md: do overflow check for sb->bblog_shift in super_1_load() (Coly Li) [Orabug: 40021190] {CVE-2026-89557}
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (Bryam Vargas) [Orabug: 40021198] {CVE-2026-89559}
ipv6: use RCU iterator to dump route exceptions (Yuyang Huang) [Orabug: 40072700] {CVE-2026-93226}
ip6_gre: fix hardware header length for NBMA tunnels (Zhiling Zou) [Orabug: 40021214] {CVE-2026-89562}
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() (Zhiling Zou) [Orabug: 40021220] {CVE-2026-89563}
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (Valentin Kindschi)
Bluetooth: RFCOMM: serialize security confirmation handling (Chengfeng Ye) [Orabug: 40021245] {CVE-2026-89569}
Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (Gongwei Li)
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
cpufreq: schedutil: Fix rate limit overflow (Sh_Def)
dm array: reject an array block whose value size is not the caller's (Bryam Vargas) [Orabug: 40021260] {CVE-2026-89573}
dm raid1: reserve space for NUL-terminator in build_constructor_string() (Ilya Krutskih) [Orabug: 40021275] {CVE-2026-89575}
dm-era: fix shadowed superblock leak on take-snap failure (Liyouhong) [Orabug: 40021282] {CVE-2026-89576}
bnx2x: fix double free in bnx2x_init_firmware() error path (Jiangshan Yi) [Orabug: 40021303] {CVE-2026-89582}
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (Christoph Zwerschke)
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (Christoph Zwerschke)
auxdisplay: charlcd: cancel backlight work on registration failure (Hongyan Xu) [Orabug: 40021314] {CVE-2026-89585}
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (Niklas Cassel) [Orabug: 40021320] {CVE-2026-89586}
alpha: marvel: Fix lock ordering in init_io7_irqs() (Matt Turner)
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number (Matt Turner)
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() (Krzysztof Wilczynski)
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device (Ivaylo Dimitrov)
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (Ang Tien Sung)
forcedeth: fix off-by-one when saving/restoring non-PCI config space (Marek Czernohous) [Orabug: 40021354] {CVE-2026-89596}
fbdev: uvesafb: unregister connector callback on init failure (Myeonghun Pak)
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (Florian Fuchs)
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (Runyu Xiao)
fat: restore original value when fat_ent_write failed (Yemu Lu)
ecryptfs: show filename encryption options (Chenyichong)
ecryptfs: release message context on send failure (Chenyichong)
ecryptfs: reject too-small tag 70 packets (Chenyichong) [Orabug: 40021413] {CVE-2026-89606}
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet (Ji'An Zhou) [Orabug: 40021420] {CVE-2026-89607}
ecryptfs: pass packet set buffer size to parser (Chenyichong) [Orabug: 40021428] {CVE-2026-89608}
ecryptfs: hold msg ctx list lock when cleaning daemon queue (Chenyichong)
ecryptfs: fix tag 11 packet exact-fit size check (Chenyichong)
eCryptfs: bound the packet-length peek to the user buffer (Pengpeng Hou)
fs/ntfs3: bound page_lcns[] index by the log record (Konstantin Komarov)
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() (Samuel Page)
fs/ntfs3: validate dirty page table on log replay (Xiang Mei)
HID: mcp2221: validate report size in mcp2221_raw_event() (Jiangshan Yi)
HID: sensor: custom: Fix field sysfs group cleanup on failure (Haoxiang Li) [Orabug: 40021498] {CVE-2026-89626}
HID: roccat: free buffered reports when destroying device (Xu Rao) [Orabug: 40021502] {CVE-2026-89627}
HID: picolcd: clamp eeprom debugfs read to bytes actually received (Ibrahim Hashimov) [Orabug: 40021507] {CVE-2026-89628}
audit: avoid dropping live tree ref on fsnotify rule autoremove (Jeremy Jean) [Orabug: 40021557] {CVE-2026-89643}
ceph: bound xattr value length in __build_xattrs() (Michael Bommarito) [Orabug: 40021580] {CVE-2026-89649}
ceph: bound num_export_targets array for mds info v2/v3 (Michael Bommarito) [Orabug: 40021586] {CVE-2026-89650}
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode (Jeremy Jean) [Orabug: 40021598] {CVE-2026-89653}
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (Xiubo Li) [Orabug: 40021606] {CVE-2026-89655}
libceph: reject buckets with mismatched CRUSH ids (Jeremy Jean) [Orabug: 40021610] {CVE-2026-89656}
NFSD: Prevent lock owner use-after-free during client teardown (Chuck Lever) [Orabug: 40021632] {CVE-2026-89662}
nfsd: revoke copy-notify stateids before dropping their reference (Jeff Layton) [Orabug: 40021636] {CVE-2026-89663}
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE (Jeff Layton)
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (Robbie Ko) [Orabug: 40021644] {CVE-2026-89665}
nfsd: initialize copy-notify stateid before publishing it (Jeff Layton) [Orabug: 40021657] {CVE-2026-89669}
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (Jeff Layton) [Orabug: 40021672] {CVE-2026-89673}
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (Jeff Layton) [Orabug: 40021678] {CVE-2026-89674}
nfsd: fix version mismatch loops in nfsd_acl_init_request() (Jeff Layton)
nfsd: fix cpntf publish race in nfs4_init_cp_state (Chris Mason) [Orabug: 40021707] {CVE-2026-89684}
nfsd: check client ownership when cancelling a copy-notify stateid (Jeff Layton) [Orabug: 40021732] {CVE-2026-89694}
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (Jeff Layton) [Orabug: 40021741] {CVE-2026-89696}
nfsd: add filehandle match check to nfsd4_delegreturn() (Jeff Layton)
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (Jeff Layton) [Orabug: 40021745] {CVE-2026-89697}
nfsd: validate symlink target length in NFSv4 CREATE (Jeff Layton) [Orabug: 40021751] {CVE-2026-89699}
nfsd: sample writeback error cursor before async COPY loop (Chuck Lever) [Orabug: 40021767] {CVE-2026-89704}
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types (Jeff Layton)
nfsd: Reset write verifier when async COPY writeback fails (Chuck Lever) [Orabug: 40021772] {CVE-2026-89706}
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (Junrui Luo) [Orabug: 40021788] {CVE-2026-89710}
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check (Mike Snitzer) [Orabug: 40021791] {CVE-2026-89711}
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (Michael Bommarito) [Orabug: 40021796] {CVE-2026-89712}
NFSD: Fix off-by-one in DRC bucket pruning limit (Chuck Lever)
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies (Chuck Lever)
ubifs: fix out-of-bounds read in signature length check (Ibrahim Hashimov)
of: fix out-of-bounds read in of_alias_scan() stem parser (Abdurrahman Hussain) [Orabug: 40072646] {CVE-2026-93213}
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation (Ryusuke Konishi)
media: vicodec: fix out-of-bounds write in FWHT encoder (Junrui Luo)
media: cec: stm32: prevent out-of-bounds write on RX overflow (Weigang He)
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (Vincent Mailhol) [Orabug: 40021841] {CVE-2026-89726}
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (Xingrui Li) [Orabug: 40021848] {CVE-2026-89729}
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (Daisuke Matsuda)
usb: gadget: f_fs: Prevent deadlock during ep0 read loop (Neill Kapron)
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (Jeffin Philip)
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (Yun Zhou) [Orabug: 40072652] {CVE-2026-93214}
usb: gadget: snps_udc_plat: clean up PHY on probe deferral (Myeonghun Pak)
usb: gadget: u_audio: Fix use-after-free on sound card disconnect (Sonali Pradhan)
USB: phy: fsl-usb: fix missing static keywords (Johan Hovold)
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (Francesco Lavra)
staging: greybus: hid: fix SET_REPORT return value (Hao-Qun Huang)
Revert 'media: v4l2-dev: fix error handling in __video_register_device()' (Hans Verkuil) [Orabug: 40021886] {CVE-2026-89741}
rapidio: mport_cdev: fix use-after-free in dma_req_free() (James Kim)
powerpc/powermac: fix OF node refcount (Bartosz Golaszewski)
tracing: Fix crash passing ERR_PTR to kthread_stop() (Sh_Def) [Orabug: 40021906] {CVE-2026-89749}
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() (Kiryl Shutsemau)
tools/compiler: match glibc 2.42 definition of attribute_const (Joy H.J. Lee)
mm: memcg: stop reclaim when a limit update is superseded (Zhangguopeng) [Orabug: 40021914] {CVE-2026-89752}
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() (Breno Leitao) [Orabug: 40021918] {CVE-2026-89753}
include/linux/list.h: mark list_add and __list_add as __always_inline (Jordan R Abrahams-Whitehead)
timers/itimer: Zero-init old itimerval before copy to userspace (Jeremy Jean) [Orabug: 40021963] {CVE-2026-89765}
clocksource/drivers/timer-sun4i: Advertise a real minimum delta (Felix Yan) [Orabug: 40072669] {CVE-2026-93219}
alpha: don't leak hardware-fabricated FP exception bits to user space (Matt Turner)
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally (Matt Turner)
ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970446] {CVE-2026-23191}

[5.15.0-325.220.5]

octeontx2-pf: fix SQB pointer leak on init failure (Dawei Feng) [Orabug: 39951718]
batman-adv: Remove stale reason member from batadv_tp_vars (Vijayendra Suman) [Orabug: 39966037]
Revert 'octeontx2-pf: Fix leak of SQ timestamp buffer on teardown' (Vijayendra Suman) [Orabug: 39967930]
tcp: fix potential race in tcp_v6_syn_recv_sock() (Eric Dumazet) [Orabug: 39331624,40035386] {CVE-2026-43198}
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (Bjoern Doebel) [Orabug: 39886288,39886588,40035390] {CVE-2026-74268,CVE-2026-74378}
tcp: clear sock_ops cb flags before force-closing a child socket (Sechang Lim) [Orabug: 39886288,39886588,40035388] {CVE-2026-74268,CVE-2026-74378}
net: af_key: zero aligned sockaddr tail in PF_KEY exports (Zhengchuan Liang) [Orabug: 39331155,40035384] {CVE-2026-43088}
uek-rpm: clean up failed kernel installation (Sagar Sagar) [Orabug: 39735711]
vhost-scsi: use kvzalloc for vq array allocation (Dongli Zhang) [Orabug: 40015348]
x86/cpuid: move X86_FEATURE_NT_GOOD to word 2 (Aruna Ramakrishna) [Orabug: 39966615]
bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Alexei Starovoitov) [Orabug: 39965261]
net: Work around Marvell NIC TX stalls (Wengang Wang) [Orabug: 39766660]
uek: kabi: update x86_64 kABI files for new symbols (Saeed Mirzamohammadi) [Orabug: 39940294]
Revert 'net/mlx5: Add poll-eq API to be used by ULP's' (Praveen Kumar Kannoju) [Orabug: 39890590]

[5.15.0-325.220.4]

LTS version: v5.15.220 (Vijayendra Suman)
usb: usbfs: fix use-after-free of usb_device in usbdev_release() (Miguel Penaranda) [Orabug: 39982120] {CVE-2026-80824}
USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (Shuangpeng Bai)
USB: serial: spcp8x5: drop broken carrier detect support (Johan Hovold)
USB: serial: option: fix slab OOB read in interrupt URB callback (Jiale Yao) [Orabug: 39982131] {CVE-2026-80827}
ALSA: usb-audio: Complete cleanup after system-resume errors (Will Porter) [Orabug: 39982135] {CVE-2026-80828}
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (Marouane El Moufid) [Orabug: 39982139] {CVE-2026-80829}
usb: core: Strengthen error handling in hub_hub_status() (Griffin Kroah-Hartman)
usb: core: Add lock to usb_wakeup_notification() (Griffin Kroah-Hartman) [Orabug: 39982143] {CVE-2026-80830}
KVM: s390: vsie: zero stale crypto bits (Christian Borntraeger)
crypto: qce - Remove unsafe/deprecated algorithms (Bartosz Golaszewski)
crypto: mxs-dcp - fix source scatterlist length access (Thorsten Blum)
crypto: qce - fix CCM AAD buffer underallocation (Md Sadre Alam)
crypto: atmel-tdes - use scatterlist length before DMA mapping (Thorsten Blum)
mm/swap: reject swapon() on filesystem-level encrypted files (Eric Biggers)
ipv6: seg6: clear IPv4 control block on IPIP decapsulation (Kyle Zeng) [Orabug: 39982172] {CVE-2026-80840}
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (Norbert Szetei) [Orabug: 39982180] {CVE-2026-80842}
xfrm: fix xfrm_state_construct() auth-trunc leak (Zihan Xi) [Orabug: 39982183] {CVE-2026-80843}
xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 39982187,40035522] {CVE-2026-80844}
xfrm: drop ESP-in-TCP packets with no ingress device (Zhiling Zou)
xfrm: espintcp: fix UAF during close (Sabrina Dubroca)
usb: gadget: f_tcm: keep port count until LUN teardown completes (Shuangpeng Bai) [Orabug: 39982217] {CVE-2026-80854}
usb: usbtest: disable dynamic ID support (Aleksandr Nogikh)
fuse: fix invalidate lock leak on open O_TRUNC DAX failure (Baokun Li) [Orabug: 39982221] {CVE-2026-80855}
fuse: fix invalidate lock leak on setattr writeback failure (Baokun Li) [Orabug: 39982224] {CVE-2026-80856}
xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (Lucas De Marchi)
xhci: dbgtty: Fix unregister on tty_register_driver() failure (Lucas De Marchi) [Orabug: 40010372] {CVE-2026-80923}
accessibility: speakup: unregister tty ldisc on later init failures (Haoxiang Li)
fpga: dfl: fme: add error handling (Griffin Kroah-Hartman)
HID: input: read battery capacity from its actual report offset (Jose Villasenor Montfort)
HID: ft260: fix stack-use-after-return write in I2C read race (Raman Varabets)
HID: ft260: validate i2c input report length (Michael Zaidman)
HID: ft260: missed NACK from busy device (Michael Zaidman)
HID: ft260: wake up device from power saving mode (Michael Zaidman)
HID: ft260: skip unexpected HID input reports (Michael Zaidman)
HID: ft260: improve i2c large reads performance (Michael Zaidman)
HID: ft260: improve i2c write performance (Michael Zaidman)
HID: ft260: fix i2c probing for hwmon devices (Michael Zaidman)
nvmet-tcp: bound SGL data length before allocating command buffers (Ibrahim Hashimov) [Orabug: 39982006] {CVE-2026-80789}
nvme: rename CDR/MORE/DNR to NVME_STATUS_* (Weiwen Hu)
HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (Jose Villasenor Montfort) [Orabug: 39981987] {CVE-2026-80783}
nfc: nci: add data_len bound checks to activation parameter extractors (Bryam Vargas)
nilfs2: reject invalid block index in GC ioctl (Ryusuke Konishi)
nilfs2: correct return value kernel-doc descriptions for ioctl functions (Ryusuke Konishi)
ext4: propagate errors from fast commit range replay (Guanghui Yang)
kcov: fix data corruption and race conditions on PREEMPT_RT (Tetsuo Handa) [Orabug: 40010347] {CVE-2026-80916}
kcov: replace local_irq_save() with a local_lock_t (Sebastian Andrzej Siewior)
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (Eric Dumazet) [Orabug: 39885781] {CVE-2026-72323}
ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (Ji'An Zhou) [Orabug: 40017137] {CVE-2026-53242}
ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (Mehul Rao) [Orabug: 39343942] {CVE-2026-43437}
ASoC: tegra: Fix Master Volume Control (Jonathan Hunter)
ALSA: pcm: fix wait_time calculations (Oswald Buddenhagen)
Revert 'smb: client: use kvzalloc() for megabyte buffer in simple fallocate' (Sasha Levin)
Revert 'mtd: maps: vmu-flash: fix fault in unaligned fixup' (Sasha Levin) [Orabug: 39967936]
selinux: switch two allocations to use kzalloc_objs() (Stephen Smalley)
smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). (Kuniyuki Iwashima)
Revert 'PM: sleep: Use complete() in device_pm_sleep_init()' (Sasha Levin)
bpf: Fix use-after-free in offloaded map/prog info fill (Jiayuan Chen) [Orabug: 39622047] {CVE-2026-53089}
KVM: arm64: Prevent access to vCPU events before init (Oliver Upton) [Orabug: 38601896] {CVE-2025-40102}
can: j1939: make j1939_sk_bind() fail if device is no longer registered (Tetsuo Handa)
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (Tetsuo Handa)
can: j1939: implement NETDEV_UNREGISTER notification handler (Tetsuo Handa) [Orabug: 38494827] {CVE-2025-39925}
jfs: add check read-only before txBeginAnon() call (Vasiliy Kovalev)
jfs: add check read-only before truncation in jfs_truncate_nolock() (Vasiliy Kovalev)
bpf: Remove tst_run from lwt_seg6local_prog_ops. (Sebastian Andrzej Siewior) [Orabug: 37074553] {CVE-2024-46754}
ipvs: reload ip header after head reallocation (Florian Westphal) [Orabug: 39884703] {CVE-2026-68476}
io_uring/io-wq: fix worker accounting when canceling creation callbacks (Vishnu Razdan)
ext4: don't enable DAX on new encrypted files (Eric Biggers) [Orabug: 39982070] {CVE-2026-80806}
RDMA/rxe: Fix OOB in free_rd_atomic_resources() (Peiyang He) [Orabug: 39982237] {CVE-2026-80863}
LTS version: v5.15.219 (Vijayendra Suman)
inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39972531,39974835] {CVE-2026-80590}
LTS version: v5.15.218 (Vijayendra Suman)
Revert 'ALSA: aoa: Use guard() for mutex locks' (Sasha Levin)
HID: hyperv: validate initial device info bounds (Michael Bommarito) [Orabug: 39981945] {CVE-2026-80765}
HID: sensor: custom: Fix use-after-free in enable_sensor (Haoxiang Li) [Orabug: 39981954] {CVE-2026-80767}
HID: core: fix number/pointer type confusion on long items (Jann Horn) [Orabug: 40010353] {CVE-2026-80918}
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering (Oliver Hartkopp) [Orabug: 39982403] {CVE-2026-80889}
can: use skb hash instead of private variable in headroom (Oliver Hartkopp)
mptcp: pm: fix data race in add_addr timer callback (Luoqing)
mptcp: pm: ADD_ADDR rtx: free sk if last (Matthieu Baerts) [Orabug: 39460461] {CVE-2026-46170}
mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (Matthieu Baerts) [Orabug: 39460401] {CVE-2026-46158}
mptcp: pm: ADD_ADDR rtx: allow ID 0 (Matthieu Baerts)
Input: atkbd - skip deactivate for HONOR ZQC-P (Donglin Lyu)
Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard (Cryolitia Pukngae)
s390/vfio_ccw: Free all memory if cp_init() fails (Eric Farman)
iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847820] {CVE-2025-68794}
xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (Xiang Mei) [Orabug: 39839297] {CVE-2026-64581}
HID: core: fix OOB read of field->usage in hid_set_field() (Baul Lee) [Orabug: 39981979] {CVE-2026-80781}
HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (Lee Jones)
HID: magicmouse: do not keep a stale msc->input if no input is claimed (Jose Villasenor Montfort) [Orabug: 39981983] {CVE-2026-80782}
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses (Dawid WroBel)
mptcp: avoid combining some incoming suboptions (Matthieu Baerts) [Orabug: 39973016] {CVE-2026-80587}
s390/vfio_ccw: Implement a crw lock (Eric Farman)
s390/vfio_ccw: Selectively expand io_mutex (Eric Farman)
s390/vfio_ccw: Ensure index for read/write regions are within range (Eric Farman)
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations (Greg Kroah-Hartman) [Orabug: 39982002] {CVE-2026-80788}
nvmet-fc: fix invalid free in LS IOD error path (Honghui Jiang) [Orabug: 39982010] {CVE-2026-80790}
ipv6: fix use-after-free in ip6_finish_output2() (Luxiao Xu) [Orabug: 39982017] {CVE-2026-80792}
ipv4: reject undersized MTUs in ip_do_fragment() (Yong Wang) [Orabug: 39982021] {CVE-2026-80793}
drm/amdgpu: check ASPM on the dGPU host link (Yang Wang)
libceph: fix OOB read in decode_watchers() via missing bounds check (Pavitra Jha) [Orabug: 39972906] {CVE-2026-80557}
nfc: nci: free destination parameters when closing a connection (Linmao Li)
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (Samuel Page)
nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (Samuel Page)
nfc: st21nfca: validate ATR_REQ length against the received frame (Doruk Tan Ozturk)
nfc: pn533: purge fragmented skbs during cleanup (Xu Rao)
nfc: llcp: reject PDUs shorter than the LLCP header (Doruk Tan Ozturk)
nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (Muhammad Bilal)
nfc: llcp: bound the connect_sn TLV walk to the skb (Doruk Tan Ozturk)
nfc: microread: validate target discovery payload lengths (Pengpeng Hou)
nfc: fdp: bound the device-reported read length and fix an skb leak (Bryam Vargas)
nfc: digital: clamp SENSF_RES length to the destination buffer (Doruk Tan Ozturk)
xfs: bounds-check buffer log item's dirty bitmap (Ibrahim Hashimov) [Orabug: 39972835] {CVE-2026-80536}
s390/vfio_ccw: Cancel existing workqueues (Eric Farman)
inet: frags: publish queues before arming timer (Zhiling Zou) [Orabug: 39919187] {CVE-2026-74662}
packet: synchronize pressure clearing with ring reconfiguration (Zihan Xi) [Orabug: 39919201] {CVE-2026-74666}
net/sched: reject overly deep qdisc hierarchies (Zijie Huang) [Orabug: 39919191] {CVE-2026-74663}
packet: use consistent hard_header_len in TX_RING send path (Qihang) [Orabug: 39919209] {CVE-2026-74668}
packet: use consistent hard_header_len in non-ring send paths (Qihang) [Orabug: 39917533] {CVE-2026-74582}
serial: amba-pl011: synchronize DMA teardown (Fan Wu) [Orabug: 39973443] {CVE-2026-80737}
NTB: ntb_netdev: Preserve RX queue depth on allocation failure (Koichiro Den) [Orabug: 39919082] {CVE-2026-74626}
perf/core: Fix group leader use-after-free after sibling detach (Aditya Chillara) [Orabug: 39919114] {CVE-2026-74637}
perf: Fix dangling cgroup pointer in cpuctx (Levi Yun)
perf: Fix cgroup state vs ERROR (Peter Zijlstra)
perf/core: Fix child_total_time_enabled accounting bug at task exit (Levi Yun)
misc: fastrpc: Remove buffer from list prior to unmap operation (Ekansh Gupta)
misc: fastrpc: Rework fastrpc_req_munmap (Abel Vesa)
misc: fastrpc: separate fastrpc device from channel context (Srinivas Kandagatla)
mm/huge_memory: fix huge_zero_pfn race (Lorenzo Stoakes) [Orabug: 39919100] {CVE-2026-74632}
gpio: ml-ioh: use raw_spinlock_t for the register lock (Junjie Cao)
xfs: validate attr entry pointer before field access (Hongling Zeng) [Orabug: 39982067] {CVE-2026-80805}
ext4: clear error before retrying inode xattr space fallback (Guanghui Yang)
ext4: stop retrying saturated xattr cache entries (Matthias Goergens) [Orabug: 39982077] {CVE-2026-80808}
null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows (Rik van Riel)
ocfs2: fix missing metadata reservation for large xattrs (Ian Bridges) [Orabug: 39982081] {CVE-2026-80809}
ALSA: dummy: Check card index validity at probe (Takashi Iwai) [Orabug: 39982087] {CVE-2026-80812}
rndis_host: add overflow check in rndis_rx_fixup() (Griffin Kroah-Hartman) [Orabug: 39982092] {CVE-2026-80814}
Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (Ali Ahmet Memis) [Orabug: 39982102] {CVE-2026-80819}
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems (Steffen Persvold) [Orabug: 40010350] {CVE-2026-80917}

[5.15.0-325.217.3]

LTS version: v5.15.217 (Vijayendra Suman)
ring-buffer: Use current_context for safe per-CPU buffer swap (Tengda Wu) [Orabug: 39919010] {CVE-2026-74601}
ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (Steven Rostedt)
jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)
drm/virtio: Unlock reservations on dma_resv_reserve_fences() error (Dmitry Osipenko)
drm/vmwgfx: Reserve fence slots on buffer objects in cotables (Zack Rusin)
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() (Robert Mader)
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone (Christian Brauner) [Orabug: 39974107] {CVE-2026-74486}
net/x25: fix use-after-free of the socket by its timers (Baul Lee) [Orabug: 39919087] {CVE-2026-74628}
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (Siddharth Vadapalli)
af_packet: Don't send zero-byte data in tpacket_snd(). (Eric Dumazet) [Orabug: 39973457] {CVE-2026-80742}
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (Rosen Penev)
net: packet: fix wrong transport_header when sending VLAN-tagged frame (Wei Fang) [Orabug: 39982352] {CVE-2026-80906}
netfilter: ipset: fix list type element drift bug (Florian Westphal)
netfilter: flowtable: publish GC-visible tuple last (Jeremy Jean) [Orabug: 39972761] {CVE-2026-74746}
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path (Alexey Velichayshiy) [Orabug: 39973466] {CVE-2026-80744}
netfilter: ipset: fix refcount race between list:set GC and swap (Xiang Mei) [Orabug: 39972772] {CVE-2026-74748}
crypto: ccm - Set rfc4309 maxauthsize from child (Herbert Xu)
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 (Jonathan Hunter)
net: smc: fix splice entry lifetime imbalance in smc_rx_splice (Li Daming)
net/smc: rdma write inline if qp has sufficient inline space (Guangguan Wang)
net: atlantic: free stranded TX buffers on ring deinit (Yangyu Chen) [Orabug: 39919072] {CVE-2026-74623}
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet (Hyunjung Ko) [Orabug: 39919065] {CVE-2026-74621}
openvswitch: move key and ovs_cb update out of handle_fragments (Xin Long)
net: sched: use skb_ip_totlen and iph_totlen (Xin Long)
openvswitch: use skb_ip_totlen in conntrack (Xin Long)
net: add a couple of helpers for iph tot_len (Xin Long)
mm/ptdump: always stabilise against page table freeing using init_mm (Lorenzo Stoakes) [Orabug: 39919004] {CVE-2026-74599}
sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (Tejun Heo) [Orabug: 39918989] {CVE-2026-74594}
drm/amd/pm: fix torn gpu metrics reads (Yang Wang)
ice: wait for reset completion in ice_resume() (Aaron Ma)
jiffies: Define secs_to_jiffies() (Easwar Hariharan)
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (Marc Kleine-Budde)
i2c: iproc: reset bus after timeout if START_BUSY is stuck (Jonas Gorski)
i2c: bcm-iproc: remove printout on handled timeouts (Wolfram Sang)
i2c: imx: Fix slave registration race and error handling (Liem) [Orabug: 39973286] {CVE-2026-80678}
binfmt_misc: restore write access when removing an entry (Christian Brauner) [Orabug: 39886902] {CVE-2026-74487}
fs: don't block write during exec on pre-content watched files (Amir Goldstein)
fsnotify: opt-in for permission events at file open time (Amir Goldstein)
ice: fix memory leak in ice_lbtest_prepare_rings() (Dawei Feng)
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write (Ibrahim Hashimov) [Orabug: 39886847] {CVE-2026-74470}
scsi: scsi_debug: Rename zone type constants (Damien Le Moal)
scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() (Damien Le Moal)
scsi: sd: sd_zbc: Introduce struct zoned_disk_info (Bart Van Assche)
scsi: sd: sd_zbc: Use logical blocks as unit when querying zones (Damien Le Moal)
scsi: sd: sd_zbc: Improve source code documentation (Bart Van Assche)
net: pktgen: fix proc entry use-after-free (Chengfeng Ye) [Orabug: 39886875] {CVE-2026-74479}
net: pktgen: fix code style (WARNING: Block comments) (Peter Seiderer)
igc: remove napi_synchronize() in igc_down() (David Carlier) [Orabug: 39973387] {CVE-2026-80715}
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (Maoyi Xie) [Orabug: 39884956] {CVE-2026-72070}
ksmbd: reject repeated SMB2 NEGOTIATE requests (Namjae Jeon)
ksmbd: conn lock to serialize smb2 negotiate (Namjae Jeon)
mm/vmstat: fold stranded per-cpu node stats when a node comes online (Gregory Price)
ksmbd: validate minimum PDU size for transform requests (Namjae Jeon)
smb/server: fix minimum SMB2 PDU size (Chenxiaosong)
smb/server: fix minimum SMB1 PDU size (Chenxiaosong)
ksmbd: rename smb2_get_msg to smb_get_msg (Namjae Jeon)
super: fix emergency thaw deadlock on frozen block devices (Christian Brauner) [Orabug: 39859442] {CVE-2026-68132}
ftrace: Add global mutex to serialize trace_parser access (Tengda Wu) [Orabug: 39859492] {CVE-2026-68146}
net/sched: serialize qdisc_rtab_list against concurrent get/put (Aldo Ariel Panzardo) [Orabug: 39859462] {CVE-2026-68138}
ksmbd: defer destroy_previous_session() until after NTLM authentication (James Montgomery)
libceph: fix two unsafe bare decodes in decode_lockers() (Pavitra Jha) [Orabug: 39852162] {CVE-2026-68082}
ceph: fix hanging __ceph_get_caps() with stale mds_wanted (Max Kellermann) [Orabug: 39972807] {CVE-2026-80527}
ceph: print cluster fsid and client global_id in all debug logs (Xiubo Li)
ceph: rename _to_client() to _to_fs_client() (Xiubo Li)
libceph: add doutc and *_client debug macros support (Xiubo Li)
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (Xiang Mei) [Orabug: 39859534] {CVE-2026-68159}
libceph: Amend checking to fix make W=1 build breakage (Andy Shevchenko)
ceph: avoid fs reclaim while using current->journal_info (Max Kellermann) [Orabug: 39972810] {CVE-2026-80528}
sctp: avoid auth_enable sysctl UAF during netns teardown (Zhiling Zou) [Orabug: 39859549] {CVE-2026-68162}
mptcp: decrement subflows counter on failed passive join (Chenguang Zhao)
mptcp: fix subflow accounting on close (Paolo Abeni)
mptcp: cleanup MPJ subflow list handling (Paolo Abeni)
serial: sc16is7xx: implement gpio get_direction() callback (Hugo Villeneuve)
serial: sc16is7xx: fix regression with GPIO configuration (Hugo Villeneuve)
serial: sc16is7xx: remove obsolete out_thread label (Hugo Villeneuve)
serial: sc16is7xx: Fill in rs485_supported (Ilpo Jarvinen)
sc16is7xx: Properly resume TX after stop (Tomasz Mon)
wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 (Liangcheng Wang)
wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) (Gokul Sivakumar)
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (Jiangshan Yi) [Orabug: 39868565] {CVE-2026-68434}
serial: 8250_mid: Remove unneeded test for ->setup() presence (Andy Shevchenko)
wifi: brcmfmac: drain bus_reset work on device removal (Fan Wu) [Orabug: 39843565] {CVE-2026-64586}
ALSA: seq: close a re-opened queue timer in the destructor (Norbert Szetei) [Orabug: 39859660] {CVE-2026-68202}
media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (Mirela Rabulea) [Orabug: 39859672] {CVE-2026-68205}
media: v4l: async: Set owner for async sub-devices (Sakari Ailus)
wifi: ath6kl: fix use-after-free in aggr_reset_state() (Daniel Hodges) [Orabug: 39859648] {CVE-2026-68198}
media: imx219: Fix maximum frame length in lines (Sakari Ailus)
media: i2c: imx219: Rename VTS to FRM_LENGTH (Jai Luthra)
media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
media: i2c: imx219: Drop IMX219_VTS_* macros (Laurent Pinchart)
media: marvell-cam: fix missing pci_disable_device() on remove (Guangshuo Li)
drm/i915/hdcp: require monotonically increasing seq_num_v (Jani Nikula)
drm/i915/hdcp: check streams[] bounds before overflow (Jani Nikula) [Orabug: 39859828] {CVE-2026-68253}
drm/i915/vrr: require valid min/max vfreq for VRR (Jani Nikula) [Orabug: 39859832] {CVE-2026-68254}
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (David Carlier)
drm/virtio: bound EDID block reads to the response buffer (Bryam Vargas) [Orabug: 39859836] {CVE-2026-68255}
drm/virtio: Return proper error codes instead of -1 (Dmitry Osipenko)
drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (Timur Kristof)
drm/tegra: fbdev: Remove offset into framebuffer memory (Thomas Zimmermann)
drm/displayid: fix Tiled Display Topology ID size (Jani Nikula)
drm/virtio: use uninterruptible resv lock for plane updates (Deepanshu Kartikey) [Orabug: 39754773] {CVE-2026-64098}
dma-buf/drivers: make reserving a shared slot mandatory v4 (Christian Konig)
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (Ashutosh Desai) [Orabug: 39859888] {CVE-2026-68277}
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (Ashutosh Desai) [Orabug: 39859896] {CVE-2026-68279}
usb: gadget: f_tcm: synchronize delayed set_alt with teardown (Cen Zhang) [Orabug: 39860172] {CVE-2026-68367}
drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Ashutosh Desai) [Orabug: 39859892] {CVE-2026-68278}
fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (Reinette Chatre) [Orabug: 39884753] {CVE-2026-72015}
octeontx2-pf: fix SQB pointer leak on init failure (Dawei Feng) [Orabug: 39951718]
net: ipa: fix SMEM state handle leaks in SMP2P init (Haoxiang Li)
espintcp: use sk_msg_free_partial to fix partial send (Sabrina Dubroca)
bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() (Breno Leitao)
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c (Breno Leitao)
bootconfig: do not put quotes on cmdline items unless necessary (Rasmus Villemoes)
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (Bryam Vargas) [Orabug: 39884827] {CVE-2026-72035}
net/sched: taprio: avoid calling child->ops->dequeue(child) twice (Vladimir Oltean)
gpio: tegra: do not call pinctrl for GPIO direction (Runyu Xiao) [Orabug: 39884922] {CVE-2026-72063}
treewide: rename pinctrl_gpio_direction_output_new() (Bartosz Golaszewski)
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Junrui Luo) [Orabug: 39884855] {CVE-2026-72045}
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) [Orabug: 39884875] {CVE-2026-72051}
net: mana: Validate the packet length reported by the NIC (Dexuan Cui) [Orabug: 39884929] {CVE-2026-72065}
net/sched: act_ct: preserve tc_skb_cb across defragmentation (Zihan Xi) [Orabug: 39884899] {CVE-2026-72057}
net: ixp4xx_hss: fix duplicate HDLC netdev allocation (Haoxiang Li)
net: ipip: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) [Orabug: 39884883] {CVE-2026-72053}
net: Add helper function to parse netlink msg of ip_tunnel_encap (Liu Jian)
locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Thomas Gleixner)
mmc: vub300: fix use-after-free on probe failure (Guangshuo Li) [Orabug: 39884968] {CVE-2026-72073}
mmc: vub300: rename probe error labels (Johan Hovold)
mmc: vub300: fix use-after-free on disconnect (Johan Hovold)
Input: ims-pcu - fix firmware leak in async update (Dmitry Torokhov)
firmware_loader: introduce __free() cleanup hanler (Dmitry Torokhov)
dm-verity: make error counter atomic (Mikulas Patocka) [Orabug: 39885054] {CVE-2026-72096}
dm-integrity: don't increment hash_offset twice (Mikulas Patocka) [Orabug: 39885064] {CVE-2026-72099}
scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() (Abdun Nihaal) [Orabug: 39885038] {CVE-2026-72087}
ovl: use linked upper dentry in copy-up tmpfile (Souvik Banerjee)
bpf,fork: wipe ->bpf_storage before bailouts that access it (Jann Horn) [Orabug: 39885094] {CVE-2026-72110}
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect (Michael Bommarito) [Orabug: 39887152] {CVE-2026-74575}
thunderbolt: Remove XDomain from the bus without holding tb->lock (Mika Westerberg)
thunderbolt: Remove service debugfs entries during unregister (Mika Westerberg)
thunderbolt: Keep XDomain reference during the lifetime of a service (Mika Westerberg) [Orabug: 40073914] {CVE-2026-97509}
thunderbolt: Update property.c function documentation (Alan Borzeszkowski)
thunderbolt: Remove usage of the deprecated ida_simple_xx() API (Christophe Jaillet)
can: esd_usb: kill anchored URBs before freeing netdevs (Fan Wu) [Orabug: 39843561] {CVE-2026-64585}
can/esd_usb2: Rename esd_usb2.c to esd_usb.c (Frank Jungclaus)
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Vincent Jardin) [Orabug: 39885191] {CVE-2026-72142}
i2c: imx: separate atomic, dma and non-dma use case (Stefan Eichenberger)
ksmbd: fix integer overflow in set_file_allocation_info() (Ibrahim Hashimov)
tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (Jarkko Sakkinen) [Orabug: 39885221] {CVE-2026-72152}
smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Fredric Cover)
taskstats: retain dead thread stats in TGID queries (Yiyang Chen)
taskstats: fill_stats_for_tgid: use for_each_thread() (Oleg Nesterov)
dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (Frank Li)
dmaengine: dw-edma: Detach the private data and chip info structures (Frank Li)
dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip (Frank Li)
mtd: spi-nor: swp: Improve locking user experience (Miquel Raynal) [Orabug: 39885230] {CVE-2026-72155}
mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
net: thunderbolt: Fix frags[] overflow by bounding frame_count (Maoyi Xie)
mtd: maps: vmu-flash: fix fault in unaligned fixup (Florian Fuchs)
9p: skip nlink update in cacheless mode to fix WARN_ON (Breno Leitao) [Orabug: 39885290] {CVE-2026-72170}
ntfs3: validate split-point offset in indx_insert_into_buffer (Michael Bommarito)
fs/ntfs3: Undo critial modificatins to keep directory consistency (Konstantin Komarov)
fs/ntfs3: Make ntfs_update_mftmirr return void (Pavel Skripkin)
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (Tristan Madani) [Orabug: 39885551] {CVE-2026-72242}
lsm: infrastructure management of the sock security (Casey Schaufler)
lsm: use default hook return value in call_int_hook() (Ondrej Mosnacek)
remoteproc: qcom: Fix leak when custom dump_segments addition fails (Wasim Nazir)
remoteproc: qcom: pas: Adjust the phys addr wrt the mem region (Yogesh Lal)
remoteproc: qcom: fix sparse warnings (Mukesh Ojha)
remoteproc: qcom: replace kstrdup with kstrndup (Mukesh Ojha)
netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [Orabug: 39885581] {CVE-2026-72252}
netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal)
netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal)
netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal)
netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal)
netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal)
netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (Pablo Neira Ayuso) [Orabug: 39885585] {CVE-2026-72253}
netfilter: nf_conntrack_sip: remove net variable shadowing (Florian Westphal)
netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal)
netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal)
ASoC: mediatek: mt8192: Check runtime resume during probe (Cassio Gabriel)
ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (Tang Bin)
ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb (AngeloGioacchino Del Regno)
ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() (AngeloGioacchino Del Regno)
ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() (AngeloGioacchino Del Regno)
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (Haoze Xie) [Orabug: 39885591] {CVE-2026-72255}
ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
net: dst: add four helpers to annotate data-races around dst->dev (Eric Dumazet)
net: dst: annotate data-races around dst->output (Eric Dumazet)
net: dst: annotate data-races around dst->input (Eric Dumazet)
tcp: convert to dev_net_rcu() (Eric Dumazet)
ASoC: mediatek: mt8183: Check runtime resume during probe (Cassio Gabriel)
octeontx2-vf: clear stale mailbox IRQ state before request_irq() (Runyu Xiao)
octeontx2-pf: clear stale mailbox IRQ state before request_irq() (Runyu Xiao)
octeontx2: Annotate mmio regions as __iomem (Subbaraya Sundeep)
octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
VDUSE: avoid leaking information to userspace (Jason Wang) [Orabug: 39885723] {CVE-2026-72305}
vduse: take out allocations from vduse_dev_alloc_coherent (Eugenio Perez)
vduse: remove unused vaddr parameter of vduse_domain_free_coherent (Eugenio Perez)
vduse: Use fixed 4KB bounce pages for non-4KB page size (Sheng Zhao)
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (Xu Wang)
tipc: restrict socket queue dumps in enqueue tracepoints (Li Xiasong) [Orabug: 39885709] {CVE-2026-72299}
fbcon: Use correct type for vc_resize() return value (Jiacheng Yu)
fbcon: Rename struct fbcon_ops to struct fbcon_par (Thomas Zimmermann)
rxrpc: serialize kernel accept preallocation with socket teardown (Li Daming)
serial: max310x: implement gpio_chip::get_direction() (Tapio Reijonen)
serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) (Hugo Villeneuve)
ALSA: hda: Fix cached processing coefficient verbs (Xu Rao)
audit: fix recursive locking deadlock in audit_dupe_exe() (Ricardo Robaina) [Orabug: 39859311] {CVE-2026-68096}
audit: use 'unsigned int' instead of 'unsigned' (Ricardo Robaina)
audit: widen ino fields to u64 (Jeff Layton)
VFS/audit: introduce kern_path_parent() for audit (Neil Brown)
ALSA: hda: conexant: Remove mic bias threshold override (Zhang Heng)
Input: mms114 - reject an oversized device packet size (Bryam Vargas) [Orabug: 39785798] {CVE-2026-64270}
i2c: davinci: Unregister cpufreq notifier on probe failure (Haoxiang Li)
Input: mms114 - fix touch indexing for MMS134S and MMS136 (Dmitry Torokhov) [Orabug: 39785807] {CVE-2026-64272}
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (Sebastian Alba Vives)
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning (Mikhail Gavrilov)
udmabuf: Do not create malformed scatterlists (Jason Gunthorpe)
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (Matt Bobrowski) [Orabug: 39760896] {CVE-2026-64192}
iommu/amd: Don't split flush for amd_iommu_domain_flush_all() (Weinan Liu)
mm: do file ownership checks with the proper mount idmap (Pedro Falcato) [Orabug: 39785859] {CVE-2026-64294}
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (Xiang Mei)
xfs: check v5 superblock features early (Christoph Hellwig)
xfs: fix ilock leak on error in xfs_dq_get_next_id (Long Li) [Orabug: 39972825] {CVE-2026-80534}
drm/amdgpu: Fix UVD decode image min size calculation (David Rosca) [Orabug: 39972847] {CVE-2026-80540}
drm/amdgpu: Implement insert_end for VCE 3 (David Rosca)
drm/amdgpu: Reject UVD message with dimensions above 4096 (David Rosca) [Orabug: 39982361] {CVE-2026-80908}
drm/amdgpu: validate GEM_CREATE domain combinations (Candice Li) [Orabug: 39972852] {CVE-2026-80541}
drm/amdgpu: Reject UVD message with invalid number of h265 refs (David Rosca) [Orabug: 39982365] {CVE-2026-80909}
s390/vfio_ccw: Fix out of bounds check on CCW array (Eric Farman)
drm/radeon: fix autosuspend cleanup during teardown (Guangshuo Li)
mmc: sdhci: make tuning_err a signed int (Haibo Chen)
mmc: sdhci: unmap the bounce buffer before device release (Myeonghun Pak)
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (Zhan Xusheng)
libceph: tolerate addrvecs with multiple entries of the same type (Kefu Chai)
ceph: fix MDS random selection readiness predicate (Yiming Zhu)
libceph: Avoid using invalid osd indices from primary_temp (Raphael Zimmer) [Orabug: 39972915] {CVE-2026-80558}
Input: sur40 - fix V4L error path cleanup (Dmitry Torokhov)
Input: sur40 - fix input device registration ordering (Dmitry Torokhov)
openrisc: signal: do not restore privileged SR bits on sigreturn (Ali Ahmet Memis)
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() (Josh Poimboeuf)
libceph: fix multiple unsafe decodes in decode_locker() (Pavitra Jha) [Orabug: 39972927] {CVE-2026-80561}
crypto: qce - fix error path in devm_qce_register_algs (Thorsten Blum)
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (Dmitry Torokhov)
Input: synaptics-rmi4 - block s_input when F54 queue is busy (Dmitry Torokhov)
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (Bryam Vargas) [Orabug: 39972955] {CVE-2026-80569}
Input: synaptics-rmi4 - zero report size on F54 work error (Dmitry Torokhov) [Orabug: 39972960] {CVE-2026-80570}
powerpc/pseries: lparcfg - fix kbuf[] underflow (George Wilson)
Input: iforce - validate input packet lengths (Pengpeng Hou)
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (Zhefu Zhang)
Input: psxpad-spi - set driver data before use (Linmao Li)
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (Richard Davies) [Orabug: 39972975] {CVE-2026-80574}
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (Dmitry Torokhov) [Orabug: 39973486] {CVE-2026-80754}
powerpc/pseries: pci - logic bug (George Wilson)
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (Dawid WroBel)
ASoC: cs4265: sort the register default table (Peter Ujfalusi)
s390/qeth: validate user buffer length in SNMP and ARP query ioctls (Hidayath Khan)
mptcp: options: reset DSS fields in case of unexpected size (Matthieu Baerts) [Orabug: 39973013] {CVE-2026-80586}
selinux: do not cancel a policy conversion that never started (Bryam Vargas) [Orabug: 39973494] {CVE-2026-80756}
selinux: reject a class permission count below its inherited common (Bryam Vargas) [Orabug: 39973498] {CVE-2026-80757}
selinux: require every boolean value to be defined (Bryam Vargas) [Orabug: 39982381] {CVE-2026-80913}
ipvs: separate destination availability state (Yizhou Zhao)
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (Zhan Xusheng) [Orabug: 39918992] {CVE-2026-74595}
media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
media: mtk-vcodec: potential null pointer deference in SCP (Fullway Wang)
f2fs: fix UAF issue in f2fs_merge_page_bio() (Chao Yu)
LTS version: v5.15.216 (Vijayendra Suman)
thunderbolt: Bound the DROM dual link port number before indexing sw->ports (Bryam Vargas) [Orabug: 39918961] {CVE-2026-74585}
sctp: clear new_transport when removing a peer (Qing Ming) [Orabug: 39918965] {CVE-2026-74586}
sctp: fix use-after-free of cached ASCONF chunk (Yuxiang Yang) [Orabug: 39918969] {CVE-2026-74587}
sctp: keep chunk->transport in step with the list it is queued on (Baul Lee) [Orabug: 39918973] {CVE-2026-74588}
scsi: scsi_debug: Negate wrapped memcmp() result (Xu Rao)
bpf, sockmap: Fix sk_redir use-after-free in send verdict (Chengfeng Ye) [Orabug: 39918977] {CVE-2026-74589}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() (Zhiling Zou) [Orabug: 39918996] {CVE-2026-74597}
ipv6: fix Route Information option length validation (Yuejie Shi) [Orabug: 39919000] {CVE-2026-74598}
Revert 'thermal/drivers/hwmon: Cleanup coding style a bit' (Rafael J. Wysocki) [Orabug: 39919019] {CVE-2026-74604}
tipc: read le->link under the node lock in tipc_node_link_down() (Jun Yang) [Orabug: 39919032] {CVE-2026-74609}
vhost: reset the vring metadata cache on vring reconfiguration (Jun Yang) [Orabug: 39917525] {CVE-2026-74580}
vsock/virtio: avoid refilling the RX queue after teardown (Weiming Shi) [Orabug: 39919042] {CVE-2026-74613}
vsock/virtio: read virtqueues under worker locks (Weiming Shi) [Orabug: 39919046] {CVE-2026-74614}
vxlan: do not arm the ageing timer on a device that is down (Baul Lee) [Orabug: 39919049] {CVE-2026-74615}
xdp: reject clones that overrun skb_shared_info tailroom (Zhiling Zou) [Orabug: 39919053] {CVE-2026-74616}
net/sched: act_gact, act_police: range check the fallback control action (Hyunjung Ko) [Orabug: 39919061] {CVE-2026-74620}
net: atlantic: free RX pages of consumed but not refilled buffers (Yangyu Chen) [Orabug: 39919068] {CVE-2026-74622}
netfilter: bridge: release template ct on non-IP path (Zhiling Zou) [Orabug: 39919078] {CVE-2026-74625}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev (Kyle Zeng) [Orabug: 39919092] {CVE-2026-74630}
fbdev: bitblit: bound-check glyph index in bit_cursor() (Rik van Riel) [Orabug: 39919107] {CVE-2026-74635}
tracing: Fix race between update_event_fields and, event_define_fields (Michael Wu) [Orabug: 39919111] {CVE-2026-74636}
ALSA: usx2y: bound the hwdep mmap fault offset (Baul Lee) [Orabug: 39919124] {CVE-2026-74641}
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (Eddie Lin)
misc: fastrpc: fix channel ctx ref leak when session alloc fails (Anandu Krishnan E)
staging: rtl8723bs: validate monitor transmit frame lengths (Mariano Baragiola) [Orabug: 39919138] {CVE-2026-74648}
staging: rtl8723bs: fix missing shared-key auth challenge length check (Panagiotis Petrakopoulos) [Orabug: 39919142] {CVE-2026-74649}
staging: rtl8723bs: fix OOB read in WMM_param_handler() (Muhammad Bilal) [Orabug: 39919146] {CVE-2026-74650}
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (Muhammad Bilal) [Orabug: 39919150] {CVE-2026-74651}
serial: 8250_dma: Clear stale RX state on shutdown (Cunhao Lu) [Orabug: 39919159] {CVE-2026-74654}
ipv4: fix use-after-free in fib_nhc_update_mtu() (Chengfeng Ye) [Orabug: 39919165] {CVE-2026-74656}
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (Zihan Xi) [Orabug: 39919169] {CVE-2026-74657}
fscrypt: Replace mk_users keyring with simple list (Eric Biggers)
pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP (Claudiu Beznea)
futex: Prevent robust futex exit race some more (Keno Fischer) [Orabug: 39919174] {CVE-2026-74658}
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev (Luiz Augusto von Dentz)
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (Marco Elver) [Orabug: 39786570] {CVE-2026-64434}
Input: evdev - fix information leak in evdev_pass_values() (Dmitry Torokhov) [Orabug: 39919227] {CVE-2026-74673}
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (Joshua Rogers) [Orabug: 39919232] {CVE-2026-74675}
vt: add permission check for KDSKBMETA ioctl (Joshua Rogers) [Orabug: 39919236] {CVE-2026-74676}
net: bridge: mrp: fix uninitialised bytes on the wire (Baul Lee)
netfilter: ebt_nflog: pin the NFLOG backend (Chengfeng Ye) [Orabug: 39919181] {CVE-2026-74660}
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Qihang) [Orabug: 39973427] {CVE-2026-80731}
net: octeontx2-pf: Fix UB in shift operation (Sergey V. Frolov)
net: openvswitch: reallocate update replies for mismatched IDs (Zhiling Zou) [Orabug: 39919195] {CVE-2026-74664}
net/packet: reset the MAC header on the packet-socket transmit path (Doruk Tan Ozturk) [Orabug: 39919205] {CVE-2026-74667}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Kyle Zeng) [Orabug: 39919213] {CVE-2026-74669}
ipvs: properly update the overload flag on dest edit (Julian Anastasov)
ipvs: add totalconns for dest (Julian Anastasov)
ima: fix out-of-bounds read in xattr_verify() (Lincoln Wallace) [Orabug: 39919219] {CVE-2026-74671}
usb: gadget: f_ncm: Use unsigned int for ndp_index (Sonali Pradhan) [Orabug: 39919247] {CVE-2026-74679}
usb: cdnsp: fix incorrect endian conversions for APB timeout register (Pawel Laszczak)
thunderbolt: icm: Preserve USB4 proxy data-valid bit (Xu Rao)
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (Aleksandr Nogikh) [Orabug: 39919251] {CVE-2026-74680}
ALSA: usb-audio: fix OOB write on Type II inbound URBs (Baul Lee) [Orabug: 39919256] {CVE-2026-74682}
Input: evdev - sanitize event type index when fetching event masks (Dmitry Torokhov) [Orabug: 39919260] {CVE-2026-74683}
spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (Larisa Grigore)
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (Wilken Gottwalt)
tls: don't abort the connection on signal-interrupted sends (Maximilian Immanuel Brandtner)
sctp: clear control chunk transport if it is being removed (Xin Long) [Orabug: 39919275] {CVE-2026-74688}
ata: pata_sl82c105: fix bridge revision use-after-free (Hongyan Xu)
net: thunderbolt: Tear down DMA paths before stopping the rings (Fan Xinran)
net: qrtr: ns: Raise lookup limit to 128 (Lukasz Patron)
net/smc: fix TOCTOU race between smc_listen_out() and listener close (Sidraya Jayagond)
net: remove WARN_ON_ONCE() from sk_mc_loop() (Eric Dumazet) [Orabug: 39973435] {CVE-2026-80733}
net: prestera: validate firmware header length (Pengpeng Hou)
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (Henry Martin)
tcp: fix TFO max_qlen accounting across reuseport migration (Jiayuan Chen) [Orabug: 39919306] {CVE-2026-74696}
sctp: fix addip_serial increment on ASCONF_ACK allocation failure (Luoqing)
bnxt_en: Fix PTP PPS setting bug (Keegan Freyhof)
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption (Michael Chan) [Orabug: 39919309] {CVE-2026-74697}
bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (Michael Chan)
selftests/ftrace: refactor eprobes test to fix argument checks (Martin Kaiser)
selftests/ftrace: Add test case for GRP/ only input (Linyu Yuan)
net/openvswitch: check Ethernet header length in key_extract() (Cen Zhang) [Orabug: 39919320] {CVE-2026-74701}
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter (Toke Hoiland-Jorgensen) [Orabug: 39919330] {CVE-2026-74704}
udp: fix potential use-after-free in tunnel segmentation (Luoxuanqiang) [Orabug: 39919334] {CVE-2026-74705}
vhost/vdpa: reject overflowing PA map page counts on 32-bit (Yousef Alhouseen)
counter: microchip-tcb-capture: Fix DT channel validation (Babanpreet Singh)
net/mlx5: fw_tracer, return NULL on create error (Michael Guralnik) [Orabug: 39919359] {CVE-2026-74717}
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete (Jiawen Liu) ...

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

bpftool

5.15.0-325.221.6.4.el8uek

kernel-uek

5.15.0-325.221.6.4.el8uek

kernel-uek-container

5.15.0-325.221.6.4.el8uek

kernel-uek-container-debug

5.15.0-325.221.6.4.el8uek

kernel-uek-core

5.15.0-325.221.6.4.el8uek

kernel-uek-debug

5.15.0-325.221.6.4.el8uek

kernel-uek-debug-core

5.15.0-325.221.6.4.el8uek

kernel-uek-debug-devel

5.15.0-325.221.6.4.el8uek

kernel-uek-debug-modules

5.15.0-325.221.6.4.el8uek

kernel-uek-debug-modules-extra

5.15.0-325.221.6.4.el8uek

kernel-uek-devel

5.15.0-325.221.6.4.el8uek

kernel-uek-doc

5.15.0-325.221.6.4.el8uek

kernel-uek-modules

5.15.0-325.221.6.4.el8uek

kernel-uek-modules-extra

5.15.0-325.221.6.4.el8uek

Oracle Linux x86_64

bpftool

5.15.0-325.221.6.4.el8uek

kernel-uek

5.15.0-325.221.6.4.el8uek

kernel-uek-container

5.15.0-325.221.6.4.el8uek

kernel-uek-container-debug

5.15.0-325.221.6.4.el8uek

kernel-uek-core

5.15.0-325.221.6.4.el8uek

kernel-uek-debug

5.15.0-325.221.6.4.el8uek

kernel-uek-debug-core

5.15.0-325.221.6.4.el8uek

kernel-uek-debug-devel

5.15.0-325.221.6.4.el8uek

kernel-uek-debug-modules

5.15.0-325.221.6.4.el8uek

kernel-uek-debug-modules-extra

5.15.0-325.221.6.4.el8uek

kernel-uek-devel

5.15.0-325.221.6.4.el8uek

kernel-uek-doc

5.15.0-325.221.6.4.el8uek

kernel-uek-modules

5.15.0-325.221.6.4.el8uek

kernel-uek-modules-extra

5.15.0-325.221.6.4.el8uek

Oracle Linux 9

Oracle Linux aarch64

bpftool

5.15.0-325.221.6.4.el9uek

kernel-uek

5.15.0-325.221.6.4.el9uek

kernel-uek-container

5.15.0-325.221.6.4.el9uek

kernel-uek-container-debug

5.15.0-325.221.6.4.el9uek

kernel-uek-core

5.15.0-325.221.6.4.el9uek

kernel-uek-debug

5.15.0-325.221.6.4.el9uek

kernel-uek-debug-core

5.15.0-325.221.6.4.el9uek

kernel-uek-debug-devel

5.15.0-325.221.6.4.el9uek

kernel-uek-debug-modules

5.15.0-325.221.6.4.el9uek

kernel-uek-debug-modules-extra

5.15.0-325.221.6.4.el9uek

kernel-uek-devel

5.15.0-325.221.6.4.el9uek

kernel-uek-doc

5.15.0-325.221.6.4.el9uek

kernel-uek-modules

5.15.0-325.221.6.4.el9uek

kernel-uek-modules-extra

5.15.0-325.221.6.4.el9uek

kernel-uek64k

5.15.0-325.221.6.4.el9uek

kernel-uek64k-core

5.15.0-325.221.6.4.el9uek

kernel-uek64k-devel

5.15.0-325.221.6.4.el9uek

kernel-uek64k-modules

5.15.0-325.221.6.4.el9uek

kernel-uek64k-modules-extra

5.15.0-325.221.6.4.el9uek

Oracle Linux x86_64

bpftool

5.15.0-325.221.6.4.el9uek

kernel-uek

5.15.0-325.221.6.4.el9uek

kernel-uek-container

5.15.0-325.221.6.4.el9uek

kernel-uek-container-debug

5.15.0-325.221.6.4.el9uek

kernel-uek-core

5.15.0-325.221.6.4.el9uek

kernel-uek-debug

5.15.0-325.221.6.4.el9uek

kernel-uek-debug-core

5.15.0-325.221.6.4.el9uek

kernel-uek-debug-devel

5.15.0-325.221.6.4.el9uek

kernel-uek-debug-modules

5.15.0-325.221.6.4.el9uek

kernel-uek-debug-modules-extra

5.15.0-325.221.6.4.el9uek

kernel-uek-devel

5.15.0-325.221.6.4.el9uek

kernel-uek-doc

5.15.0-325.221.6.4.el9uek

kernel-uek-modules

5.15.0-325.221.6.4.el9uek

kernel-uek-modules-extra

5.15.0-325.221.6.4.el9uek

Связанные CVE

CVE-2026-98432

CVE-2026-99999

Ссылки на источники

Связанные уязвимости

ELSA-2026-500399

oracle-oval

11 дней назад

ELSA-2026-500399: Unbreakable Enterprise kernel security update (IMPORTANT)

ELSA-2026-500397

oracle-oval

11 дней назад

ELSA-2026-500397: Unbreakable Enterprise kernel security update (IMPORTANT)

CVE-2026-98432

CVSS3: 9.8

ubuntu

12 дней назад

[ipv4: free inet_opt and ireq_opt after an RCU grace period]

CVE-2026-98432

CVSS3: 5.9

redhat

12 дней назад

In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do no...

CVE-2026-98432

CVSS3: 9.8

nvd

11 дней назад