{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "linux-image-7.0.0-31-generic", "linux-main-modules-zfs-7.0.0-31-generic", "linux-modules-7.0.0-31-generic" ], "removed": [ "linux-image-7.0.0-30-generic", "linux-main-modules-zfs-7.0.0-30-generic", "linux-modules-7.0.0-30-generic" ], "diff": [ "libssh2-1t64", "linux-image-virtual", "openssh-client", "openssh-server", "openssh-sftp-server" ] } }, "diff": { "deb": [ { "name": "libssh2-1t64", "from_version": { "source_package_name": "libssh2", "source_package_version": "1.11.1-1ubuntu0.26.04.3", "version": "1.11.1-1ubuntu0.26.04.3" }, "to_version": { "source_package_name": "libssh2", "source_package_version": "1.11.1-1ubuntu0.26.04.4", "version": "1.11.1-1ubuntu0.26.04.4" }, "cves": [ { "cve": "CVE-2026-66032", "url": "https://ubuntu.com/security/CVE-2026-66032", "cve_description": "libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66033", "url": "https://ubuntu.com/security/CVE-2026-66033", "cve_description": "libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66035", "url": "https://ubuntu.com/security/CVE-2026-66035", "cve_description": "libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-66032", "url": "https://ubuntu.com/security/CVE-2026-66032", "cve_description": "libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66033", "url": "https://ubuntu.com/security/CVE-2026-66033", "cve_description": "libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66035", "url": "https://ubuntu.com/security/CVE-2026-66035", "cve_description": "libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: double-free vulnerability in sftp_open()", " - debian/patches/CVE-2026-66032.patch: Prevent dangling pointer by", " nullifying data in src/sftp.c.", " - CVE-2026-66032", " * SECURITY UPDATE: pre-authentication integer underflow vulnerability", " - debian/patches/CVE-2026-66033.patch: fix potential OOB read/write with", " AES-GCM in `ssh2_cipher_crypt()` in src/openssl.c.", " - CVE-2026-66033", " * SECURITY UPDATE: pre-authentication heap buffer overflow vulnerability", " - debian/patches/CVE-2026-66035.patch: transport: fix potential heap", " overflow on ETM decrypt in src/transport.c.", " - CVE-2026-66035", "" ], "package": "libssh2", "version": "1.11.1-1ubuntu0.26.04.4", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 02 Sep 2026 07:53:57 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-31.31", "" ], "package": "linux-meta", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:01:20 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-client", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.5", "version": "1:10.2p1-2ubuntu3.5" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.6", "version": "1:10.2p1-2ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.6", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:36:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.5", "version": "1:10.2p1-2ubuntu3.5" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.6", "version": "1:10.2p1-2ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.6", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:36:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-sftp-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.5", "version": "1:10.2p1-2ubuntu3.5" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.6", "version": "1:10.2p1-2ubuntu3.6" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.6", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:36:25 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "linux-image-7.0.0-31-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.0.0-30.30", "version": null }, "to_version": { "source_package_name": "linux-signed", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-31.31", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:01:30 +0200" } ], "notes": "linux-image-7.0.0-31-generic version '7.0.0-31.31' (source package linux-signed version '7.0.0-31.31') was added. linux-image-7.0.0-31-generic version '7.0.0-31.31' has the same source package name, linux-signed, as removed package linux-image-7.0.0-30-generic. As such we can use the source package version of the removed package, '7.0.0-30.30', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.0.0-31-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.0.0-30.30", "version": null }, "to_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.0.0-31.31+2", "version": "7.0.0-31.31+2" }, "cves": [], "launchpad_bugs_fixed": [ 1786013, 1786013, 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/2026.08.03)", "" ], "package": "linux-main-signed", "version": "7.0.0-31.31+2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1786013 ], "author": "Stefan Bader ", "date": "Mon, 17 Aug 2026 14:28:21 +0200" }, { "cves": [], "log": [ "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/2026.08.03)", "", " * Miscellaneous Ubuntu changes", " - [Packaging]: lmm: Add a symbol to use a local signed.tar.gz file", " - [Packaging]: lmm: Allow DKMS to be cross compiled", " - [Packaging]: lmm: Add a method to create unsigned packages", " - [Packaging]: lmm: Install DKMSs in ubuntu/dkms", " - [Packaging]: Update manifest file with new patches", " - Ubuntu-7.0.0-31.31", "" ], "package": "linux-main-signed", "version": "7.0.0-31.31+1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:12:29 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-31.31", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/2026.08.03)", "", " * Miscellaneous Ubuntu changes", " - [Packaging]: lmm: Add a symbol to use a local signed.tar.gz file", " - [Packaging]: lmm: Allow DKMS to be cross compiled", " - [Packaging]: lmm: Add a method to create unsigned packages", " - [Packaging]: lmm: Install DKMSs in ubuntu/dkms", " - [Packaging]: Update manifest file with new patches", "" ], "package": "linux-main-signed", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:12:14 +0200" } ], "notes": "linux-main-modules-zfs-7.0.0-31-generic version '7.0.0-31.31+2' (source package linux-main-signed version '7.0.0-31.31+2') was added. linux-main-modules-zfs-7.0.0-31-generic version '7.0.0-31.31+2' has the same source package name, linux-main-signed, as removed package linux-main-modules-zfs-7.0.0-30-generic. As such we can use the source package version of the removed package, '7.0.0-30.30', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-7.0.0-31-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-31.31", "version": "7.0.0-31.31" }, "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53361", "url": "https://ubuntu.com/security/CVE-2026-53361", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().", "cve_priority": "medium", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53362", "url": "https://ubuntu.com/security/CVE-2026-53362", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as \talloclen = fragheaderlen + transhdrlen; \tpagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53325", "url": "https://ubuntu.com/security/CVE-2026-53325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.", "cve_priority": "medium", "cve_public_date": "2026-06-29 06:16:00 UTC" }, { "cve": "CVE-2026-52938", "url": "https://ubuntu.com/security/CVE-2026-52938", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2025-10263", "url": "https://ubuntu.com/security/CVE-2025-10263", "cve_description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "cve_priority": "high", "cve_public_date": "2026-06-09 10:16:00 UTC" }, { "cve": "CVE-2026-46300", "url": "https://ubuntu.com/security/CVE-2026-46300", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.", "cve_priority": "high", "cve_public_date": "2026-05-23 12:17:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53131", "url": "https://ubuntu.com/security/CVE-2026-53131", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53175", "url": "https://ubuntu.com/security/CVE-2026-53175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53186", "url": "https://ubuntu.com/security/CVE-2026-53186", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53216", "url": "https://ubuntu.com/security/CVE-2026-53216", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53221", "url": "https://ubuntu.com/security/CVE-2026-53221", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53260", "url": "https://ubuntu.com/security/CVE-2026-53260", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)", "", " * Backport: \"firmware: arm_ffa: Respect firmware advertised RX/TX buffer", " size limits\" (LP: #2162012)", " - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits", "", " * Backlight regression (LP: #2161309)", " - Revert \"drm/i915/backlight: Remove try_vesa_interface\"", "", " * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)", " - SAUCE: Reapply \"serial: 8250: Switch to nbcon console\"", " - SAUCE: Reapply \"serial: 8250: Revert \"drop lockdep annotation from", " serial8250_clear_IER()\"\"", " - Real-time patchset 7.0.1-rt2", "", " * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the", " A400 is on by remote controller . (LP: #2161385)", " - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3", "", " * Camera output is vague and color is abnormal (LP: #2156972)", " - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for", " overlapping ranges", "", " * [SRU] Fix incorrect boot_display reporting on multi-GPU systems", " (LP: #2161036)", " - x86/video: Only fall back to vga_default_device() without screen info", "", " * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)", " - perf/core: out-of-line and export perf_allow_cpu/tracepoint()", " - drm/xe: gate observation streams with perf_allow_cpu()", "", " * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)", " - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * The screen will show garbages by running glxgears fullscreen.", " (LP: #2158605)", " - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external", " dma-bufs", "", " * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec", " (LP: #2156313)", " - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B", "", " * TPM2 key creation commands time out on some Infineon modules", " (LP: #2158883)", " - tpm: restore timeout for key creation commands", "", " * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)", " - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7", " (LP: #2156867)", " - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio", " - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED", " - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11", "", " * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)", " - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2", " - wifi: iwlwifi: mvm: avoid oversized UATS command copy", "", " * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)", " - SAUCE: Revert \"wifi: mt76: mt7925: add rfkill_poll for hardware rfkill\"", "", " * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)", " - rust: str: use the \"kernel vertical\" imports style", " - rust: str: clean unused import for Rust >= 1.98", " - userfaultfd: gate must_wait writability check on pte_present()", " - device property: initialize the remaining fields of fwnode_handle in", " fwnode_init()", " - f2fs: fix potential deadlock in f2fs_balance_fs()", " - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()", " - f2fs: fix listxattr handling of corrupted xattr entries", " - net/sched: dualpi2: fix GSO backlog accounting", " - mm/khugepaged: write all dirty file folios when collapsing", " - slab: recognize @GFP parameter as optional in kernel-doc", " - perf trace beauty fcntl: Fix build with older kernel headers", " - KVM: x86: Move update_cr8_intercept() to lapic.c", " - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest", " mode", " - KVM: x86: Unconditionally recompute CR8 intercept on PPR update", " - ACPI: CPPC: Suppress UBSAN warning caused by field misuse", " - ACPI: NFIT: core: Fix possible NULL pointer dereference", " - platform/x86: intel-hid: Protect ACPI notify handler against recursion", " - LoongArch: Add PIO for early access before ACPI PCI root register", " - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0", " - rust: block: fix GenDisk cleanup paths", " - rust: doctest: fix incorrect pattern in replacement", " - rust: Kbuild: set frame-pointer llvm module flag for", " CONFIG_FRAME_POINTER", " - futex/requeue: Revert \"Prevent NULL pointer dereference in", " remove_waiter() on self-deadlock\"\"", " - perf/core: Detach event groups during remove_on_exec", " - rust: kasan: KASAN+RUST requires clang", " - fscrypt: Replace mk_users keyring with simple list", " - usb: gadget: function: rndis: add length check to response query", " - usb: gadget: function: rndis: add length check for header", " - iio: accel: bmc150: clamp the device-reported FIFO frame count", " - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", " - iio: adc: ad7380: select REGMAP", " - iio: adc: ad7768-1: Select GPIOLIB", " - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig", " - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless", " devices", " - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", " - iio: adc: lpc32xx: Initialize completion before requesting IRQ", " - iio: adc: spear: Initialize completion before requesting IRQ", " - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", " - iio: adc: ti-ads124s08: Return reset GPIO lookup errors", " - iio: backend: fix uninitialized data in debugfs", " - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", " - iio: common: st_sensors: honour channel endianness in read_axis_data", " - iio: core: fix uninitialized data in debugfs", " - iio: dac: ad3552r-hs: fix uninitialized data ni", " ad3552r_hs_write_data_source()", " - iio: event: Fix event FIFO reset race", " - iio: gyro: bmg160: bail out when bandwidth/filter is not in table", " - iio: gyro: bmg160: wait full startup time after mode change at probe", " - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ", " - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ", " - iio: imu: inv_icm42600: fix timestamp clock period by using lower value", " - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading", " - iio: imu: st_lsm6dsx: deselect shub page before reading whoami", " - iio: light: al3000a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: add missing REGMAP_I2C to Kconfig", " - iio: light: al3010: fix incorrect scale for the highest gain range", " - iio: light: al3010: read both ALS ADC registers again", " - iio: light: al3320a: add missing REGMAP_I2C to Kconfig", " - iio: light: al3320a: read both ALS ADC registers again", " - iio: light: gp2ap002: fix runtime PM leak on read error", " - iio: light: opt3001: fix missing state reset on timeout", " - iio: light: tsl2591: return actual error from probe IRQ failure", " - iio: light: veml6030: fix channel type when pushing events", " - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call", " - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer", " - iio: pressure: mpl115: fix runtime PM leak on read error", " - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths", " - iio: resolver: ad2s1210: notify trigger and clear state on fault read", " error", " - iio: temperature: Build mlx90635 with CONFIG_MLX90635", " - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check", " - iio: temperature: ltc2983: Fix reinit_completion() called after", " conversion start", " - iio: temperature: tmp006: use devm_iio_trigger_register", " - ALSA: usx2y: us144mkii: fix work UAF on disconnect", " - ALSA: virtio: Add missing 384 kHz PCM rate mapping", " - ALSA: virtio: Validate control metadata from the device", " - ALSA: ymfpci: check snd_ctl_new1() return value", " - ALSA: aoa: check snd_ctl_new1() return value", " - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input", " parser", " - ALSA: cmipci: check snd_ctl_new1() return value", " - ALSA: compress: Fix task creation error unwind", " - ALSA: es1938: check snd_ctl_new1() return value", " - ALSA: FCP: Add Focusrite ISA C8X support", " - ALSA: firewire: isight: bound the sample count to the packet payload", " - ALSA: gus: check snd_ctl_new1() return value", " - ALSA: hda/cs35l41: Fix firmware load work teardown", " - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini", " - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson", " - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW", " - ALSA: ice1712: check snd_ctl_new1() return value", " - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", " - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts", " anchor list on each resubmission", " - ALSA: usb-audio: avoid kobject path lookup in DualSense match", " - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()", " - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch", " put callbacks", " - ALSA: usb-audio: Roll back quirk control caches on write errors", " - ALSA: usb-audio: Update Babyface Pro control caches only after", " successful writes", " - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful", " writes", " - vfio/pci: Use a private flag to prevent power state change with VFs", " - vfio/pci: Latch disable_idle_d3 per device", " - vfio/pci: Release the VGA arbiter client on register_device() failure", " - vfio/pci: Fix racy bitfields and tighten struct layout", " - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", " - vfio: Remove device debugfs before releasing devres", " - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB", " - Bluetooth: btusb: fix use-after-free on registration failure", " - Bluetooth: btusb: fix use-after-free on marvell probe failure", " - Bluetooth: btusb: fix wakeup source leak on probe failure", " - binder: fix UAF in binder_thread_release()", " - binder: fix UAF in binder_free_transaction()", " - rust_binder: use a u64 stride when cleaning up the offsets array", " - rust_binder: reject context manager self-transaction", " - rust_binder: synchronize Rust Binder stats with freeze commands", " - rust_binder: clear freeze listener on node removal", " - usb: xhci: Fix sleep in atomic context in xhci_free_streams()", " - xhci: sideband: fix ring sg table pages leak", " - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", " - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000", " series", " - PCI: altera: Do not dispose parent IRQ mapping", " - PCI: altera: Fix resource leaks on probe failure", " - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining", " - PCI: host-common: Request bus reassignment when not probe-only", " - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling", " - PCI: mediatek: Fix IRQ domain leak when port fails to enable", " - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts", " - PCI/IOV: Skip VF Resizable BAR restore on read error", " - tcp: restore RCU grace period in tcp_ao_destroy_sock", " - mm/damon/ops-common: handle extreme intervals in damon_hot_score()", " - netfilter: ipset: fix race between dump and ip_set_list resize", " - virtio_pci: fix vq info pointer lookup via wrong index", " - virtio-mmio: fix device release warning on module unload", " - hwrng: virtio: clamp device-reported used.len at copy_data()", " - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", " - usb: dwc3: run gadget disconnect from sleepable suspend context", " - usb: misc: usbio: fix disconnect UAF in client teardown", " - 6lowpan: fix NHC entry use-after-free on error path", " - tipc: fix out-of-bounds read in broadcast Gap ACK blocks", " - staging: vme_user: bound slave read/write to the kern_buf size", " - smb: client: restrict implied bcc[0] exemption to responses without data", " area", " - staging: vme_user: fix location monitor leak in fake bridge", " - staging: vme_user: fix location monitor leak in tsi148 bridge", " - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe", " - staging: media: atomisp: reduce load_primary_binaries() stack usage", " - staging: media: ipu7: fix double-free and use-after-free in error paths", " - staging: rtl8723bs: fix heap buffer overflow in", " rtw_cfg80211_set_wpa_ie()", " - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", " - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", " - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", " - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and", " join_cmd_hdl()", " - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", " - staging: rtl8723bs: fix OOB write in HT_caps_handler()", " - crypto: amlogic - avoid double cleanup in meson_crypto_probe()", " - crypto: krb5 - filter out async aead implementations at alloc", " - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then", " SMB2_CANCEL", " - net: af_key: initialize alg_key_len for IPComp states", " - audit: Fix data races of skb_queue_len() readers on audit_queue", " - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", " - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", " - coresight: etb10: restore atomic_t for shared reading state", " - debugobjects: Plug race against a concurrent OOM disable", " - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", " - NTB: epf: Avoid calling pci_irq_vector() from hardirq context", " - gpio: eic-sprd: use raw_spinlock_t in the irq startup path", " - gpio: sch: use raw_spinlock_t in the irq startup path", " - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", " - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", " - io_uring/rw: preserve partial result for iopoll", " - netpoll: fix a use-after-free on shutdown path", " - ipv4: igmp: remove multicast group from hash table on device destruction", " - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", " - mfd: cros_ec: Delay dev_set_drvdata() until probe success", " - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", " - mm: shrinker: fix shrinker_info teardown race with expansion", " - mm: shrinker: fix NULL pointer dereference in debugfs", " - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless", " host", " - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent", " softlockup", " - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump", " - netfilter: handle unreadable frags", " - netfilter: ebtables: zero chainstack array", " - netfilter: ebtables: module names must be null-terminated", " - netfilter: ebtables: terminate table name before find_table_lock()", " - netfilter: flowtable: fix offloaded ct timeout never being extended", " - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", " - Bluetooth: bnep: pin L2CAP connection during netdev registration", " - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in", " nxp_recv_fw_req_v3()", " - Bluetooth: fix UAF in bt_accept_dequeue()", " - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", " - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled", " - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", " - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", " - Bluetooth: L2CAP: validate option length before reading conf opt value", " - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", " - smb: client: resolve SWN tcon from live registrations", " - smb/client: Fix error code in smb2_aead_req_alloc()", " - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", " - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", " - ksmbd: serialize QUERY_DIRECTORY requests per file", " - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock", " cancellation", " - ksmbd: require source read access for duplicate extents", " - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", " - ksmbd: run set info with opener credentials", " - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION", " - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION", " - ksmbd: use opener credentials for delete-on-close", " - ksmbd: use opener credentials for ADS I/O", " - smb: client: fix query directory replay double-free", " - smb: client: fix query_info() replay double-free", " - smb: client: fix double-free in SMB2_ioctl() replay", " - smb: client: fix change notify replay double-free", " - smb: client: fix double-free in SMB2_flush() replay", " - smb: client: fix double-free in SMB2_open() replay", " - smb: client: fix double-free in SMB2_close() replay", " - smb: client: Fix next buffer leak in receive_encrypted_standard()", " - smb: client: use unaligned reads in parse_posix_ctxt()", " - smb: client: harden POSIX SID length parsing", " - smb: client: fix atime clamp check in read completion", " - smb: client: mask server-provided mode to 07777 in modefromsid", " - writeback: fix race between cgroup_writeback_umount() and", " inode_switch_wbs()", " - OPP: of: Fix potential memory leak in opp_parse_supplies()", " - cpufreq: qcom-cpufreq-hw: Fix possible double free", " - firmware_loader: fix device reference leak in firmware_upload_register()", " - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()", " - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()", " - cpufreq: intel_pstate: Sync policy->cur during CPU offline", " - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", " - cpufreq: Fix hotplug-suspend race during reboot", " - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", " - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", " - time/jiffies: Register jiffies clocksource before usage", " - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog", " instances", " - s390: Revert support for DCACHE_WORD_ACCESS", " - [Config] Disable DCACHE_WORK_ACCESS for s390x", " - perf/arm-cmn: Fix DVM node events", " - X.509: Fix validation of ASN.1 certificate header", " - mm/slab: do not limit zeroing to orig_size when only red zoning is", " enabled", " - tools/mm/slabinfo: Fix trace disable logic inversion", " - tools/mm/slabinfo: fix total_objects attribute name", " - HID: hid-goodix-spi: validate report size to prevent stack buffer", " overflow", " - HID: uhid: convert to hid_safe_input_report()", " - HID: wacom: stop hardware after post-start probe failures", " - HID: pidff: Use correct effect type in effect update", " - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", " - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()", " - HID: letsketch: fix UAF on inrange_timer at driver unbind", " - HID: multitouch: fix out-of-bounds bit access on mt_io_flags", " - HID: appleir: fix UAF on pending key_up_timer in remove()", " - HID: lg-g15: cancel pending work on remove to fix a use-after-free", " - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte", " reads", " - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", " - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", " - media: mtk-jpeg: cancel workqueue on release for supported platforms", " only", " - serial: 8250_mid: Disable DMA for selected platforms", " - xfs: use null daddr for unset first bad log block", " - xfs: release dquot buffer after dqflush failure", " - xfs: fix unreachable BIGTIME check in dquot flush validation", " - xfs: fix pointer arithmetic error on 32-bit systems", " - xfs: fix exchmaps reservation limit check", " - xfs: fix memory leak in xfs_dqinode_metadir_create()", " - bpf: Reject fragmented frames in devmap", " - bpf: Restore sysctl new-value from 1 to 0", " - bpf: Validate BTF repeated field counts before expansion", " - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", " - usb: cdc_acm: Add quirk for Uniden BC125AT scanner", " - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", " - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub", " - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()", " - usb: free iso schedules on failed submit", " - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", " - usb: gadget: udc: Fix use-after-free in gadget_match_driver", " - usb: gadget: f_printer: take kref only for successful open", " - USB: idmouse: fix use-after-free on disconnect race", " - USB: ldusb: fix use-after-free on disconnect race", " - USB: iowarrior: fix use-after-free on disconnect", " - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD", " - USB: legousbtower: fix use-after-free on disconnect race", " - usb: sl811-hcd: disable controller wakeup on remove", " - USB: storage: include US_FL_NO_SAME in quirks mask", " - usb: misc: usbio: bound bulk IN response length to the received transfer", " - USB: misc: uss720: unregister parport on probe failure", " - usb: mtu3: unmap request DMA on queue failure", " - USB: serial: keyspan_pda: fix information leak", " - USB: serial: option: add Telit Cinterion FE990D50 compositions", " - USB: serial: digi_acceleport: fix broken rx after throttle", " - USB: serial: digi_acceleport: fix hard lockup on disconnect", " - USB: serial: digi_acceleport: fix write buffer corruption", " - USB: ulpi: fix memory leak on registration failure", " - USB: usb-storage: ene_ub6250: restore media-ready check", " - usbip: tools: support SuperSpeedPlus devices", " - usbip: vudc: fix NULL deref in vep_dequeue()", " - usb: typec: anx7411: use devm_pm_runtime_enable()", " - usb: typec: class: drop PD lookup reference", " - usb: typec: tcpm: Fix VDM type for Enter Mode commands", " - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", " - usb: typec: ucsi: Invert DisplayPort role assignment", " - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt", " mode", " - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", " - usb: typec: ucsi: cancel pending work on system suspend", " - usb: gadget: f_fs: Fix DMA fence leak", " - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", " - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when", " SNC enabled", " - ontext]", " - rust_binder: fix BINDER_GET_EXTENDED_ERROR", " - bpf: Support for hardening against JIT spraying", " - x86/bugs: Enable IBPB flush on BPF JIT allocation", " - bpf: Restrict JIT predictor flush to cBPF", " - bpf: Skip redundant IBPB in pack allocator", " - bpf: Prefer packs that won't trigger an IBPB flush on allocation", " - bpf: Prefer dirty packs for eBPF allocations", " - udf: validate free block extents against the partition length", " - udf: validate VAT header length against the VAT inode size", " - udf: validate sparing table length as an entry count, not a byte count", " - hwrng: jh7110 - fix refcount leak in starfive_trng_read()", " - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A", " - nvme: target: rdma: fix ndev refcount leak on queue connect", " - block: partitions: fix of_node refcount leak in of_partition()", " - dm-ioctl: report an error if a device has no table", " - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace", " disks", " - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", " - nvmet-auth: validate reply message payload bounds against transfer", " length", " - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC", " - btrfs: do not trim a device which is not writeable", " - partitions: aix: bound the pp_count scan to the ppe array", " - isofs: bound Rock Ridge symlink components to the SL record", " - crypto: af_alg - Remove zero-copy support from skcipher and aead", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps", " - crypto: caam - use print_hex_dump_devel to guard key hex dumps again", " - crypto: chacha20poly1305 - validate poly1305 template argument", " - crypto: crypto4xx - Remove insecure and unused rng_alg", " - crypto: ecc - Fix carry overflow in vli multiplication", " - crypto: hisi-trng - Remove crypto_rng interface", " - crypto: pcrypt - restore callback for non-parallel fallback", " - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()", " - crypto: loongson - Select CRYPTO_RNG", " - crypto: ccp - Do not initialize SNP for SEV ioctls", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", " - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", " - crypto: drbg - Fix returning success on failure in CTR_DRBG", " - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels", " - crypto: drbg - Fix the fips_enabled priority boost", " - crypto: qat - centralize bus master enable", " - crypto: qat - handle sysfs-triggered reset callbacks", " - crypto: qat - keep VFs enabled during reset", " - crypto: qat - notify fatal error before AER reset preparation", " - crypto: qat - protect service table iterations with service_lock", " - crypto: qat - skip restart for down devices", " - crypto: qat - validate RSA CRT component lengths", " - crypto: qat - factor out AER reset helpers", " - crypto: talitos - use dma_sync_single_for_cpu() before reading", " descriptor header", " - crypto: talitos - add chaining of arbitrary number of descriptor for the", " SEC1", " - crypto: talitos - move dma unmapping code in flush_channel() into a", " standalone dma_unmap_request() function", " - crypto: talitos - move dma mapping code in talitos_submit() into a", " standalone dma_map_request() function", " - crypto: talitos - move code in current_desc_hdr() into a standalone", " function", " - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove", " additional descriptor", " - crypto: talitos/hash - use descriptor chaining for SEC1 instead of", " workqueue", " - crypto: talitos/hash - drop workqueue mechanism for SEC1", " - crypto: talitos/hash - rename first_desc/last_desc to", " first_request/last_request", " - crypto: talitos/hash - remove useless wrapper", " - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation", " - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()", " - spi: fsl-lpspi: replace dmaengine_terminate_all() with", " dmaengine_terminate_sync()", " - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", " - x86/mm: Fix freeing of PMD-sized vmemmap pages", " - EDAC/i10nm: Don't fail probing if ADXL is missing", " - watchdog: apple: Add \"apple,t8103-wdt\" compatible", " - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", " - i2c: core: fix hang on adapter registration failure", " - perf/aux: Fix page UAF in map_range()", " - tracing: Prevent out-of-bounds read in glob matching", " - audit: fix potential integer overflow in audit_log_n_hex()", " - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", " - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule", " - module: decompress: check return value of module_extend_max_pages()", " - exfat: bound uniname advance in exfat_find_dir_entry()", " - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()", " - riscv: mm: Define DIRECT_MAP_PHYSMEM_END", " - riscv: mm: Unconditionally sfence.vma for spurious fault", " - mm: fix mmap errno value when MAP_DROPPABLE is not supported", " - selftests: mm: fix and speedup \"droppable\" test", " - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid", " PFN access", " - mm: do file ownership checks with the proper mount idmap", " - selftests/mm: pagemap_ioctl: use the correct page size for", " transact_test()", " - crypto: loongson - Remove broken and unused loongson-rng", " - iommu/vt-d: Avoid WARNING in sva unbind path", " - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()", " - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", " - iommufd: Fix data_len byte-count vs element-count mismatch", " - iommufd: Set veventq_depth upper bound", " - iommufd: Rewind header length in done if iommufd_veventq_fops_read()", " fails", " - iommufd: Reject invalid read count in iommufd_veventq_fops_read()", " - iommufd: Reject invalid read count in iommufd_fault_fops_read()", " - iommufd: Break the loop on failure in iommufd_fault_fops_read()", " - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()", " - iommufd: Set upper bounds on cache invalidation entry_num and entry_len", " - audit: fix removal of dangling executable rules", " - landlock: Set audit_net.sk for socket access checks", " - selftests/landlock: Filter dealloc records in audit_count_records()", " - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", " - LoongArch: KVM: Add missing slots_lock for device register/unregister", " - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", " - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs", " - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually", " supports", " - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are", " accelerated", " - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs", " - KVM: VMX: Handle bad values on proxied writes to LBR MSRs", " - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace", " exits", " - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", " - udmabuf: fix DMA direction mismatch in release_udmabuf()", " - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning", " - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", " - i2c: core: fix irq domain leak on adapter registration failure", " - i2c: core: fix NULL-deref on adapter registration failure", " - i2c: core: fix adapter probe deferral loop", " - i2c: core: fix adapter debugfs creation", " - i2c: core: fix adapter deregistration race", " - i2c: mpc: Fix timeout calculations", " - i2c: davinci: Unregister cpufreq notifier on probe failure", " - i2c: stm32f7: truncate clock period instead of rounding it", " - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", " - i2c: i801: fix hardware state machine corruption in error path", " - Input: synaptics-rmi4 - unregister function handlers on physical driver", " registration failure", " - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", " - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", " - Input: elan_i2c - prevent division by zero and arithmetic underflow", " - Input: goodix - clamp the device-reported contact count", " - Input: iforce - bound the device-reported force-feedback effect index", " - Input: mms114 - fix touch indexing for MMS134S and MMS136", " - Input: ads7846 - don't use scratch for tx_buf when clearing register", " - Input: touchwin - reset the packet index on every complete packet", " - Input: mms114 - reject an oversized device packet size", " - Input: gscps2 - advance receive buffer write index", " - Input: maplemouse - fix NULL pointer dereference in open()", " - Input: mms114 - fix multi-touch slot corruption", " - Input: maple_keyb - set driver data before registering input device", " - Input: maplemouse - set driver data before registering input device", " - Input: maplecontrol - set driver data before registering input device", " - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", " - RDMA/core: Fix broadcast address falsely detected as local", " - RDMA/siw: bound Read Response placement to the RREAD length", " - fuse: back uncached readdir buffers with pages", " - fuse: avoid 32-bit prune notification count wrap", " - fuse: fix device node leak in cuse_process_init_reply()", " - fuse: re-lock request before returning from fuse_ref_folio()", " - fuse: fix io-uring background queue dispatch on request completion", " - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", " - fuse-uring: fix EFAULT clobber in fuse_uring_commit", " - fuse-uring: fix data races on ring->ready", " - fuse-uring: fix moving cancelled entry to ent_in_userspace list", " - fuse-uring: end fuse_req on io-uring cancel task work", " - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", " - fuse-uring: Avoid queue->stopped races and set/read that value under", " lock", " - fuse-uring: make a fuse_req on SQE commit only findable after memcpy", " - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL", " deref", " - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction", " checks", " - timekeeping: Register default clocksource before taking tk_core.lock", " - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote", " netdev", " - smb: client: reject overlapping data areas in SMB2 responses", " - xfs: fix null pointer dereference in tracepoint", " - xfs: fail recovery on a committed log item with no regions", " - xfs: resample the data fork mapping after cycling ILOCK", " - xfs: don't wrap around quota ids in dqiterate", " - xfs: grab rtrmap btree when checking rgsuper", " - xfs: use the rt version of the cow staging checker", " - xfs: set xfarray killable sort correctly", " - xfs: handle non-inode owners for rtrmap record checking", " - xfs: clamp timestamp nanoseconds correctly", " - xfs: fully check the parent handle when it points to the rootdir", " - xfs: don't zap bmbt forks if they are MAXLEVELS tall", " - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner", " - xfs: write the rg superblock when fixing it", " - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging", " - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", " - rust: pci: use 'static lifetime for PCI BAR resource names", " - iio: adc: ad4062: add GPIOLIB dependency", " - iio: adc: nxp-sar-adc: Fix the delay calculation in", " nxp_sar_adc_wait_for()", " - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8", " - vfio/mlx5: Fix racy bitfields and tighten struct layout", " - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers", " - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95", " - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95", " - PCI: Skip Resizable BAR restore on read error", " - tracing: Fix NULL pointer dereference in func_set_flag()", " - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()", " - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),", " rtw_get_wapi_ie(), and rtw_get_wps_attr()", " - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", " - media: nxp: imx8-isi: Fix use-after-free on remove", " - netfilter: flowtable: IPIP tunnel hardware offload is not yet support", " - ksmbd: prevent path traversal bypass by restricting caseless retry", " - ksmbd: centralize ksmbd_conn final release to plug transport leak", " - ksmbd: track the connection owning a byte-range lock", " - ksmbd: validate NTLMv2 response before updating session key", " - smb/client: fix chown/chgrp with SMB3 POSIX Extensions", " - smb/server: do not require delete access for non-replacing links", " - proc: protect ptrace_may_access() with exec_update_lock (FD links)", " - proc: protect ptrace_may_access() with exec_update_lock (part 1)", " - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", " - xfs: pass back updated nb from xfs_growfs_compute_deltas", " - xfs: only log freed extents for the current RTG in zoned growfs", " - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap", " - bpf: Keep dynamic inner array lookups nullable", " - bpf: Allow LPM map access from sleepable BPF programs", " - USB: iowarrior: fix use-after-free on disconnect race", " - usb: typec: ps883x: Fix DP+USB3 configuration", " - usb: gadget: f_fs: initialize reset_work at allocation time", " - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile", " - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", " - crypto: atmel-sha204a - fail on hwrng registration error in probe path", " - btrfs: fix false IO failure after falling back to buffered write", " - btrfs: fix incorrect buffered IO fallback for append direct writes", " - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG", " - crypto: drbg - Fix ineffective sanity check", " - crypto: qat - fix restarting state leak on allocation failure", " - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name", " length", " - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION", " calls with invalid length", " - exfat: fix incorrect directory checksum after rename to shorter name", " - exfat: preserve benign secondary entries during rename and move", " - lib/test_hmm: use kvfree() to free kvcalloc() allocations", " - selftests/mm: fix ksft_process_madv.sh test category", " - nouveau/vmm: fix another SPT/LPT race", " - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is", " uninitialized", " - iommufd: Move vevent memory allocation outside spinlock", " - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()", " - selftests/landlock: Fix socket file descriptor leaks in audit helpers", " - selftests/landlock: Explicitly disable audit in teardowns", " - landlock: Account all audit data allocations to user space", " - selftests/landlock: Increase default audit socket timeout", " - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", " - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", " - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB", " - KVM: TDX: Account all non-transient page allocations for per-TD", " structures", " - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", " - Revert \"fuse: fix conversion of fuse_reverse_inval_entry() to", " start_removing()\"", " - fuse: do not use start_removing_noperm()", " - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY", " - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd", " - Upstream stable to v6.18.39, v7.1.4", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)", " - Revert \"PCI: qcom: Advertise Hotplug Slot Capability with no Command", " Completion support\"", " - batman-adv: tp_meter: keep unacked list in ascending ordered", " - batman-adv: tp_meter: initialize dup_acks explicitly", " - batman-adv: tp_meter: initialize dec_cwnd explicitly", " - batman-adv: tp_meter: avoid window underflow", " - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", " - batman-adv: tp_meter: fix fast recovery precondition", " - batman-adv: tp_meter: handle seqno wrap-around for fast recovery", " detection", " - batman-adv: tp_meter: add only finished tp_vars to lists", " - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE", " - batman-adv: prevent ELP transmission interval underflow", " - batman-adv: tp_meter: initialize last_recv_time during init", " - batman-adv: gw: don't deselect gateway with active hardif", " - batman-adv: ensure bcast is writable before modifying TTL", " - batman-adv: fix (m|b)cast csum after decrementing TTL", " - batman-adv: frag: ensure fragment is writable before modifying TTL", " - batman-adv: frag: avoid underflow of TTL", " - batman-adv: v: prevent OGM aggregation on disabled hardif", " - batman-adv: tp_meter: restrict number of unacked list entries", " - batman-adv: tp_meter: annotate last_recv_time access with", " READ/WRITE_ONCE", " - batman-adv: tp_meter: prevent parallel modifications of last_recv", " - batman-adv: tp_meter: handle overlapping packets", " - batman-adv: tt: don't merge change entries with different VIDs", " - batman-adv: tt: track roam count per VID", " - batman-adv: dat: prevent false sharing between VLANs", " - batman-adv: tvlv: enforce 2-byte alignment", " - batman-adv: tvlv: avoid race of cifsnotfound handler state", " - ipv4: account for fraggap on the paged allocation path", " - ntfs3: reject direct userspace writes to reserved $LX* xattrs", " - wifi: mt76: add wcid publish check in mt76_sta_add", " - mac802154: llsec: add skb_cow_data() before in-place crypto", " - net: skmsg: preserve sg.copy across SG transforms", " - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", " - apparmor: mediate the implicit connect of TCP fast open sendmsg", " - apparmor: fix use-after-free in rawdata dedup loop", " - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG", " share BAR", " - fbdev: fix use-after-free in store_modes()", " - kernel/fork: clear PF_BLOCK_TS in copy_process()", " - block: invalidate cached plug timestamp after task switch", " - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page", " - err.h: use __always_inline on all error pointer helpers", " - gcov: use atomic counter updates to fix concurrent access crashes", " - KEYS: fix overflow in keyctl_pkey_params_get_2()", " - keys: Pin request_key_auth payload in instantiate paths", " - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing", " - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S", " - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer", " - wifi: ath11k: fix warning when unbinding", " - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor", " - wifi: rtw88: increase TX report timeout to fix race condition", " - wifi: rtw88: usb: fix memory leaks on USB write failures", " - wifi: iwlwifi: mvm: fix race condition in PTP removal", " - wifi: iwlwifi: mld: fix race condition in PTP removal", " - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session", " handlers", " - f2fs: pass correct iostat type for single node writes", " - f2fs: validate orphan inode entry count", " - f2fs: validate compress cache inode only when enabled", " - f2fs: fix to round down start offset of fallocate for pin file", " - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()", " - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()", " - f2fs: keep atomic write retry from zeroing original data", " - block: Avoid mounting the bdev pseudo-filesystem in userspace", " - bpf: use kvfree() for replaced sysctl write buffer", " - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", " - exfat: fix potential use-after-free in exfat_find_dir_entry()", " - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping", " level", " - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with", " get_unaligned()", " - crypto: nx - fix nx_crypto_ctx_exit argument", " - gfs2: fix use-after-free in gfs2_qd_dealloc", " - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", " - hdlc_ppp: sync per-proto timers before freeing hdlc state", " - blk-cgroup: fix UAF in __blkcg_rstat_flush()", " - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done", " - LoongArch: Report dying CPU to RCU in stop_this_cpu()", " - pNFS: Fix use-after-free in pnfs_update_layout()", " - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup", " on remove", " - fpga: region: fix use-after-free in child_regions_with_firmware()", " - rpmsg: char: Fix use-after-free on probe error path", " - ocfs2: reject oversized group bitmap descriptors", " - 9p: avoid putting oldfid in p9_client_walk() error path", " - MIPS: smp: report dying CPU to RCU in stop_this_cpu()", " - KVM: x86: hyper-v: Bound the bank index when querying sparse banks", " - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", " - power: reset: linkstation-poweroff: fix use-after-free in the", " linkstation_poweroff_init()", " - riscv: mm: Extract helper mark_new_valid_map()", " - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()", " - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in", " fb_videomode_to_var", " - fbdev: modedb: fix a possible UAF in fb_find_mode()", " - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode", " - i2c: core: fix adapter registration race", " - NFSD: Fix SECINFO_NO_NAME decode error cleanup", " - nfsd: fix posix_acl leak on SETACL decode failure", " - nfsd: fix inverted cp_ttl check in async copy reaper", " - nfsd: check get_user() return when reading princhashlen", " - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race", " - nfsd: reset write verifier on deferred writeback errors", " - NFSv4/flexfiles: reject zero filehandle version count", " - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr", " - NFSv4: clear exception state on successful mkdir retry", " - NFS: Prevent resource leak in nfs_alloc_server()", " - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()", " - net/tcp-ao: fix use-after-free of key in del_async path", " - apparmor: advertise the tcp fast open fix is applied", " - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist", " - fscrypt: Fix key setup in edge case with multiple data unit sizes", " - wifi: rtl8xxxu: Detect the maximum supported channel width", " - f2fs: fix missing read bio submission on large folio error", " - f2fs: reject setattr size changes on large folio files", " - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", " - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", " - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", " - Revert \"f2fs: remove non-uptodate folio from the page cache in", " move_data_block\"", " - f2fs: read COW data with the original inode during atomic write", " - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path", " - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", " - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap", " - fbdev: omap2: fix use-after-free in omapfb_mmap", " - nfsd: release layout stid on setlease failure", " - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file", " - nfsd: fix dead ACL conflict guard in nfsd4_create", " - Upstream stable to v6.18.38, v7.1.3", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53361", " - af_unix: Set gc_in_progress to true in unix_gc().", "", " * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //", " CVE-2026-53362", " - ipv6: account for fraggap on the paged allocation path", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815)", " - io_uring/net: Avoid msghdr on op_connect/op_bind async data", " - arm64/entry: Fix arm64-specific rseq brokenness", " - lockd: fix TEST handling when not all permissions are available.", " - firmware: exynos-acpm: Count number of commands in acpm_xfer", " - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr", " - firmware: samsung: acpm: Fix cross-thread RX length corruption", " - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in", " polling", " - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator", " - fuse: re-lock request before replacing page cache folio", " - Revert \"NFSD: Defer sub-object cleanup in export put callbacks\"", " - RDMA/bnxt_re: zero shared page before exposing to userspace", " - i2c: stub: Reject I2C block transfers with invalid length", " - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", " - rose: fix dev_put() leak in rose_loopback_timer()", " - rose: hold loopback neighbour reference across timer callback", " - rose: fix race between loopback timer and module removal", " - rose: clear neighbour pointer after rose_neigh_put() in state machines", " - rose: guard rose_neigh_put() against NULL in timer expiry", " - rose: fix netdev double-hold in rose_rx_call_request()", " - rose: fix notifier unregistered too early in rose_exit()", " - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup", " - rose: disconnect orphaned STATE_2 sockets when device is gone", " - rose: fix netdev double-hold in rose_make_new()", " - rose: release netdev ref and destroy orphaned incoming sockets", " - rose: drop CALL_REQUEST in loopback timer when device is not running", " - rose: cancel neighbour timers in rose_neigh_put() before freeing", " - rose: clear neighbour pointer in rose_kill_by_device()", " - rose: don't free fd-owned sockets when reaping in the heartbeat", " - net: export netif_open for self_test usage", " - net: net_failover: Fix the deadlock in slave register", " - iio: light: veml6075: add bounds check to veml6075_it_ms index", " - iio: adc: ti-ads1298: add bounds check to pga_settings index", " - crypto: qat - remove unused character device and IOCTLs", " - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent", " vcs_write", " - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero", " - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails", " - drivers/base/memory: set mem->altmap after successful device", " registration", " - ksmbd: reject non-VALID session in compound request branch", " - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si", " - virtiofs: fix UAF on submount umount", " - Linux 7.0.14", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-53325", " - agp/amd64: Fix broken error propagation in agp_amd64_probe()", "", " * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //", " CVE-2026-52938", " - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003)", " - bpf: Free reuseport cBPF prog after RCU grace period.", " - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl", " - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer", " - ipv6: mcast: Fix use-after-free when processing MLD queries", " - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS", " - tee: optee: prevent use-after-free when the client exits before the", " supplicant", " - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE", " - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and", " reserve its pins", " - ARM: dts: microchip: sam9x7: fix GMAC clock configuration", " - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found", " - tee: fix tee_ioctl_object_invoke_arg padding", " - tee: qcomtee: add missing va_end in early return", " qcomtee_object_user_init()", " - s390/bug: Always emit format word in __BUG_ENTRY", " - ARM: dts: gemini: Fix partition offsets", " - erofs: fix use-after-free on sbi->sync_decompress", " - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares", " - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers", " - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id", " - ipvs: clear the svc scheduler ptr early on edit", " - netfilter: synproxy: add mutex to guard hook reference counting", " - netfilter: conntrack_irc: fix possible out-of-bounds read", " - netfilter: nft_ct: bail out on template ct in get eval", " - netfilter: bridge: make ebt_snat ARP rewrite writable", " - dm cache policy smq: check allocation under invalidate lock", " - net/sched: act_api: use RCU with deferred freeing for action lifecycle", " - 6lowpan: fix off-by-one in multicast context address compression", " - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", " - devlink: Release nested relation on devlink free", " - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c", " - wifi: mac80211: limit injected antenna index in", " ieee80211_parse_tx_radiotap", " - pcnet32: stop holding device spin lock during napi_complete_done", " - net: Annotate sk->sk_write_space() for UDP SOCKMAP.", " - hsr: Remove WARN_ONCE() in hsr_addr_is_self().", " - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", " - net: lan743x: permit VLAN-tagged packets up to configured MTU", " - net: fec: fix pinctrl default state restore order on resume", " - ipv6: anycast: insert aca into global hash under idev->lock", " - wifi: fix leak if split 6 GHz scanning fails", " - wifi: cfg80211: add support to handle incumbent signal detected event", " from mac80211/driver", " - wifi: nl80211: split out UHR operation information", " - wifi: cfg80211: enforce HE/EHT cap/oper consistency", " - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()", " - Bluetooth: MGMT: validate advertising TLV before type checks", " - Bluetooth: RFCOMM: validate skb length in MCC handlers", " - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()", " extension handling", " - Bluetooth: bnep: reject short frames before parsing", " - Bluetooth: fix memory leak in error path of hci_alloc_dev()", " - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync", " - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", " - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect", " - Bluetooth: MGMT: Fix backward compatibility with userspace", " - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()", " - octeontx2-pf: Fix NDC sync operation errors", " - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field", " - af_unix: Fix inq_len update problem in partial read", " - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options", " - ptp: vclock: Switch from RCU to SRCU", " - net: airoha: Fix use-after-free in metadata dst teardown", " - geneve: fix length used in GRO hint UDP checksum adjustment", " - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow", " - vxlan: vnifilter: send notification on VNI add", " - vxlan: vnifilter: fix spurious notification on VNI update", " - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", " - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr", " - bonding: annotate data-races arcound churn variables", " - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/", " - fwctl/bnxt_en: Refactor aux bus functions to be more generic", " - Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"", " - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic", " - drm/hyperv: During panic do VMBus unload after frame buffer is flushed", " - selftests: harness: fix pidfd leak in __wait_for_test", " - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()", " - regulator: mt6363: select CONFIG_IRQ_DOMAIN", " - hyperv: Clean up and fix the guest ID comment in hvgdk.h", " - VFS: fix possible failure to unlock in nfsd4_create_file()", " - crypto: s390 - add select CRYPTO_AEAD for aes", " - rseq: Fix using an uninitialized stack variable in", " rseq_exit_user_update()", " - time: Fix off-by-one in settimeofday() usec validation", " - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked", " streams", " - ALSA: seq: dummy: fix UMP event stack overread", " - x86/resctrl: Only check Intel systems for SNC", " - cpufreq/amd-pstate: drop stale @epp_cached kdoc", " - rtla: Fix parsing of multi-character short options", " - tools/rv: Ensure monitor name and desc are NUL-terminated", " - tools/rv: Fix substring match bug in monitor name search", " - tools/rv: Fix substring match when listing container monitors", " - tools/rv: Fix cleanup after failed trace setup", " - verification/rvgen: Fix options shared among commands", " - verification/rvgen: Fix ltl2k writing True as a literal", " - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI", " - riscv: cfi: reject unknown flags in PR_SET_CFI", " - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload", " - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments", " - dma-debug: fix physical address retrieval in", " debug_dma_sync_sg_for_device", " - xfrm: policy: fix use-after-free on inexact bin in", " xfrm_policy_bysel_ctx()", " - ice: fix missing priority callbacks for U.FL DPLL pins", " - idpf: fix mailbox capability for set device clock time", " - net: ena: PHC: Add missing barrier", " - bnge: fix context mem iteration", " - netlabel: validate unlabeled address and mask attribute lengths", " - gpio: mvebu: fix NULL pointer dereference in suspend/resume", " - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls", " - tcp: restrict SO_ATTACH_FILTER to priv users", " - net: add pskb_may_pull() to skb_gro_receive_list()", " - net/mlx4: avoid GCC 10 __bad_copy_from() false positive", " - net: ibm: emac: Fix use-after-free during device removal", " - netdev: fix double-free in netdev_nl_bind_rx_doit()", " - net: phy: clean the sfp upstream if phy probing fails", " - net: phy: remove phy ports upon probe failure", " - net: phy: Clean the phy_ports after unregistering the downstream SFP bus", " - net: phy: don't try to setup PHY-driven SFP cages when using genphy", " - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove", " - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list", " - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure", " - net/mlx5: Use effective affinity mask for IRQ selection", " - net: openvswitch: fix possible kfree_skb of ERR_PTR", " - r8152: handle the return value of usb_reset_device()", " - gpio: zynq: fix runtime PM leak on remove", " - gpio: rockchip: fix generic IRQ chip leak on remove", " - net: mctp: usb: fix race between urb completion and rx_retry", " cancellation", " - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission", " - esp: fix page frag reference leak on skb_to_sgvec failure", " - ASoC: SOF: amd: fix for ipc flags check", " - ip6_vti: set netns_immutable on the fallback device.", " - net: guard timestamp cmsgs to real error queue skbs", " - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic", " completion", " - tun: zero the whole vnet header in tun_put_user()", " - ptp: ocp: fix resource freeing order", " - rds: mark snapshot pages dirty in rds_info_getsockopt()", " - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX", " - netfilter: revalidate bridge ports", " - netfilter: nf_conntrack: destroy stale expectfn expectations on", " unregister", " - netfilter: x_tables: avoid leaking percpu counter pointers", " - netfilter: nf_log: validate MAC header was set before dumping it", " - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag", " - net: mvpp2: sync RX data at the hardware packet offset", " - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS", " - net: txgbe: initialize module info buffer", " - net: txgbe: distinguish module types by checking identifier", " - net: txgbe: initialize PHY interface to 0", " - ipv6: Fix a potential NPD in cleanup_prefix_route()", " - ASoC: SDCA: fix NULL pointer dereference in", " sdca_dev_unregister_functions", " - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting", " parked", " - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs", " - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time", " - drm/i915/edp: Check supported link rates DPCD read", " - drm/virtio: Fix driver removal with disabled KMS", " - drm/vc4: fix krealloc() memory leak", " - drm/colorop: Remove read-only comments from interpolation fields", " - drm/colorop: make lut(1/3)d_interpolation props correctly behave as", " mutable", " - drm/atomic: track individual colorop updates", " - drm/amd/display: use plane color_mgmt_changed to track colorop changes", " - drm/xe: fix refcount leak in xe_range_fence_insert()", " - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues", " - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", " - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories", " - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register", " - tee: shm: fix shm leak in register_shm_helper()", " - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend", " - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig", " - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()", " - mm/memory-failure: fix hugetlb_lock AA deadlock in", " get_huge_page_for_hwpoison", " - Revert \"drm/xe/nvls: Define GuC firmware for NVL-S\"", " - accel/ivpu: Add bounds check for firmware runtime memory", " - accel/ivpu: Add bounds checks for firmware log indices", " - firmware: stratix10-svc: Don't fail probe when async ops unsupported", " - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported", " - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in", " probe", " - accel/ivpu: Add buffer overflow check in MS get_info_ioctl", " - accel/ivpu: Fix signed integer truncation in IPC receive", " - tracing: Fix CFI violation in probestub being called by tprobes", " - tracing/probes: Point the error offset correctly for eprobe argument", " error", " - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask", " calculation", " - Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during", " suspend\"", " - rust: x86: support Rust >= 1.98.0 target spec", " - ARM: Do not select HAVE_RUST when KASAN is enabled", " - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES", " - rust: kasan/kbuild: fix rustc-option when cross-compiling", " - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation", " - cfi: Include uaccess.h for get_kernel_nofault()", " - mshv: add a missing padding field", " - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying", " - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free", " the SA", " - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX", " - KVM: arm64: Correctly identify executable PTEs at stage-2", " - KVM: arm64: Restore POR_EL0 access to host EL0", " - drm/i915/gem: Fix phys BO pread/pwrite with offset", " - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf", " - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init", " - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", " - xfrm: espintcp: do not reuse an in-progress partial send", " - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()", " - USB: serial: io_ti: fix heap overflow in get_manuf_info()", " - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", " - USB: serial: option: add usb-id for Dell Wireless DW5826e-m", " - USB: serial: kl5kusb105: fix bulk-out buffer overflow", " - ALSA: timer: Forcibly close timer instances at closing", " - ALSA: timer: Fix UAF at snd_timer_user_params()", " - io_uring/wait: fix min_timeout behavior", " - io_uring/kbuf: don't truncate end buffer for bundles", " - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries", " - drm/virtio: fix dma_fence refcount leak on error in", " virtio_gpu_dma_fence_wait()", " - drm/amd/display: Reject gpio_bitshift >= 32 in", " bios_parser_get_gpio_pin_info()", " - mm/huge_memory: update file PMD counter before folio_put()", " - mm/damon/ops-common: call folio_test_lru() after folio_get()", " - mm/huge_memory: update file PUD counter before folio_put()", " - RDMA/core: Validate the passed in fops for ib_get_ucaps()", " - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc", " - zram: fix use-after-free in zram_bvec_write_partial()", " - udp: clear skb->dev before running a sockmap verdict", " - ARM: socfpga: Fix OF node refcount leak in SMP setup", " - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O", " - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow", " - arm64: mm: call pagetable dtor when freeing hot-removed page tables", " - mptcp: fix missing wakeups in edge scenarios", " - mptcp: fix retransmission loop when csum is enabled", " - mptcp: close TOCTOU race while computing rcv_wnd", " - mptcp: allow subflow rcv wnd to shrink", " - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation", " - mptcp: check desc->count in read_sock", " - mptcp: sockopt: check timestamping ret value", " - mptcp: sockopt: set sockopt on all subflows", " - selftests: mptcp: add test for extra_subflows underflow on userspace PM", " - mptcp: add-addr: always drop other suboptions", " - xfs: fix error returns in CoW fork repair", " - xfs: fix rtgroup cleanup in CoW fork repair", " - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used", " - wifi: nl80211: reject oversized EMA RNR lists", " - vsock/vmci: fix sk_ack_backlog leak on failed handshake", " - timers/migration: Fix livelock in tmigr_handle_remote_up()", " - spi: qcom-geni: Fix cs_change handling on the last transfer", " - staging: rtl8723bs: fix buffer over-read in rtw_update_protection", " - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length", " subtraction", " - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write", " - bnxt_en: Fix NULL pointer dereference", " - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs", " - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()", " - hv: utils: handle and propagate errors in kvp_register", " - pidfd: refuse access to tasks that have started exiting harder", " - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()", " - accel/ethosu: fix IFM region index out-of-bounds in command stream", " parser", " - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85", " - accel/ethosu: fix arithmetic issues in dma_length()", " - accel/ethosu: reject DMA commands with uninitialized length", " - accel/ethosu: reject NPU_OP_RESIZE commands from userspace", " - fs/qnx6: fix pointer arithmetic in directory iteration", " - fuse: reject fuse_notify() pagecache ops on directories", " - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios", " - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on", " self-deadlock", " - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()", " - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM", " - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()", " - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter", " - i2c: tegra: Fix NOIRQ suspend/resume", " - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)", " - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard", " - iomap: avoid potential null folio->mapping deref during error reporting", " - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb", " - ipc/shm: serialize orphan cleanup with shm_nattch updates", " - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued", " - memcg: use round-robin victim selection in refill_stock", " - memory: atmel-ebi: Allow deferred probing", " - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context", " - misc: fastrpc: fix use-after-free race in fastrpc_map_create", " - misc: fastrpc: fix DMA address corruption due to find_vma misuse", " - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback", " - firmware: samsung: acpm: Fix mailbox channel leak on probe error", " - net/mlx5: Reorder completion before putting command entry in", " cmd_work_handler", " - net: airoha: Add NULL check for of_reserved_mem_lookup() in", " airoha_qdma_init_hfwd_queues()", " - net: bonding: fix NULL pointer dereference in bond_do_ioctl()", " - net: mv643xx: fix OF node refcount", " - net: phonet: free phonet_device after RCU grace period", " - net: rds: clear i_sends on setup unwind", " - net: sfp: initialize i2c_block_size at adapter configure time", " - nvmem: core: fix use-after-free bugs in error paths", " - nvmem: layouts: onie-tlv: fix hang on unknown types", " - octeontx2-af: fix memory leak in rvu_setup_hw_resources()", " - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32", " - mm/cma: fix reserved page leak on activation failure", " - mm/cma_debug: fix invalid accesses for inactive CMA areas", " - mm/damon/lru_sort: handle ctx allocation failure", " - mm/damon/reclaim: handle ctx allocation failure", " - mm/huge_memory: use correct flags for device private PMD entry", " - mm/hugetlb: avoid false positive lockdep assertion", " - mm/hugetlb: restore reservation on error in hugetlb folio copy paths", " - mm/list_lru: drain before clearing xarray entry on reparent", " - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard", " - mmc: core: Fix host controller programming for fixed driver type", " - mmc: dw_mmc-rockchip: Add missing private data for very old controllers", " - mmc: litex_mmc: Set mandatory idle clocks before CMD0", " - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC", " - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin", " EIC7700", " - mmc: sdhci: add signal voltage switch in sdhci_resume_host", " - pmdomain: imx: fix OF node refcount", " - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup", " source", " - rtase: Avoid sleeping in get_stats64()", " - rtase: Reset TX subqueue when clearing TX ring", " - sctp: diag: reject stale associations in dump_one path", " - sctp: stream: fully roll back denied add-stream state", " - thunderbolt: Reject zero-length property entries in validator", " - thunderbolt: Bound root directory content to block size", " - thunderbolt: Clamp XDomain response data copy to allocation size", " - thunderbolt: Validate XDomain request packet size before type cast", " - thunderbolt: Limit XDomain response copy to actual frame size", " - slimbus: qcom-ngd-ctrl: fix OF node refcount", " - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration", " - slimbus: qcom-ngd-ctrl: Fix probe error path ordering", " - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd", " - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller", " - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership", " - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD", " - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock", " - drm/gem: Try to fix change_handle ioctl, attempt 4", " - drm/i915: Fix color blob reference handling in intel_plane_state", " - drm/amdkfd: fix NULL dereference in get_queue_ids()", " - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on", " GFX11", " - drm/xe/display: fix oops in suspend/shutdown without display", " - drm/xe/multi_queue: skip submit when primary queue is suspended", " - drm/xe: Clear pending_disable before signaling suspend fence", " - drm/v3d: Wait for pending L2T flush before cleaning caches", " - drm/v3d: Fix global performance monitor reference counting", " - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups", " - drm/v3d: Skip CSD when it has zeroed workgroups", " - drm/amdgpu: fix waiting for all submissions for userptrs", " - drm/amdgpu: restart the CS if some parts of the VM are still invalidated", " - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)", " - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems", " - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload", " - drm/amd/pm: fix smu13 power limit default/cap calculation", " - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2", " - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in", " set_soft_freq_limited_range", " - drm/amd/display: Bound VBIOS record-chain walk loops", " - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", " - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", " - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs", " - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs", " - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", " - drm/amd/display: Use krealloc_array() in dal_vector_reserve()", " - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", " - driver core: faux: fix root device registration", " - driver core: reject devices with unregistered buses", " - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible", " - netfilter: nft_fib: fix stale stack leak via the OIFNAME register", " - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()", " - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-", " strict mode", " - wifi: mac80211: tests: mark HT check strict", " - RDMA/umem: fix kernel-doc warnings", " - RDMA: Move DMA block iterator logic into dedicated files", " - RDMA/umem: Fix truncation for block sizes >= 4G", " - vsock/virtio: fix potential unbounded skb queue", " - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc", " - debugobjects: Do not fill_pool() if pi_blocked_on", " - debugobjects: Don't call fill_pool() in early boot hardirq context", " - arm64: cputype: Add C1-Ultra definitions", " - arm64: cputype: Add C1-Premium definitions", " - arm64: errata: Mitigate TLBI errata on various Arm CPUs", " - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU", " - [Config] Add TLBI Erratum for Azure Cobalt 100.", " - vsock/virtio: fix skb overhead overflow on 32-bit builds", " - Linux 7.0.13", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses", " - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU", "", " * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //", " CVE-2026-46300: when fragments backed by read-only page-cache pages are", " - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53131", " - netfilter: require Ethernet MAC header before using eth_hdr()", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-53175", " - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-53186", " - RDMA/srp: bound SRP_RSP sense copy by the received length", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53216", " - net: mvpp2: limit XDP frame size to the RX buffer", "", " * CVE-2026-53221", " - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53260", " - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().", "", " * INVALID or PRIVATE BUG (LP: #2158267)", " - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", "" ], "package": "linux", "version": "7.0.0-31.31", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2162413, 2162012, 2161309, 2161757, 2161385, 2156972, 2161036, 2160654, 2160666, 2160302, 2158605, 2156313, 2158883, 2158860, 2158462, 2156867, 2152688, 2158229, 2161462, 2160733, 2160733, 2160733, 2158815, 2158815, 2158815, 2158003, 2158003, 2158003, 2158267, 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:09:29 +0200" } ], "notes": "linux-modules-7.0.0-31-generic version '7.0.0-31.31' (source package linux version '7.0.0-31.31') was added. linux-modules-7.0.0-31-generic version '7.0.0-31.31' has the same source package name, linux, as removed package linux-modules-7.0.0-30-generic. As such we can use the source package version of the removed package, '7.0.0-30.30', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-image-7.0.0-30-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.0.0-30-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-7.0.0-30-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-30.30", "version": "7.0.0-30.30" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.04 resolute image from daily image serial 20260903 to 20260908", "from_series": "resolute", "to_series": "resolute", "from_serial": "20260903", "to_serial": "20260908", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }