SUSE-SU-2026:22433-1

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
• CVE-2025-38549: efivarfs: Fix memory leak of efivarfsfsinfo in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3registerwork (bsc#1256668).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifssetcifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxlpayloadfromuserallowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with globaltxfc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211txprepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31414: netfilter: nfconntrackexpect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31446: ext4: fix use-after-free in updatesuperwork when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfcdiscovertargets_done() (bsc#1262656).
• CVE-2026-31469: virtionet: Fix UAF on dstops when IFFXMITDSTRELEASE is cleared and napitx is false
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with reqqueuemutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2capconndel() (bsc#1262674).
• CVE-2026-31500: Bluetooth: btintel: serialize btintelhwerror() with hcireqsync_lock (bsc#1262993).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bonddebugrlbhashshow (bsc#1263006).
• CVE-2026-31555: futex: Clear stale exiting pointer in futexlockpi() retry path (bsc#1263178).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVMMEMORYENCRYPTREGREGION (bsc#1263152).
• CVE-2026-31592: KVM: SEV: Protect all of sevmemencregisterregion() with kvm->lock (bsc#1263123).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2groupextend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in checkwsleas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
• CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31671: xfrmuser: fix info leak in buildreport() (bsc#1263115).
• CVE-2026-31673: afunix: read UNIXDIAGVFS data under unixstate_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6trt: reject oversized addrnr in rtmt6_check() (bsc#1263568).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
• CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).
• CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
• CVE-2026-31703: writeback: Fix use after free in inodeswitchwbsworkfn() (bsc#1263883).
• CVE-2026-31752: bridge: brndsend: validate ND option lengths (bsc#1264045).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-31759: usb: ulpi: fix double free in ulpiregisterinterface() error path (bsc#1264076).
• CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
• CVE-2026-43023: Bluetooth: SCO: fix race conditions in scosockconnect() (bsc#1264137).
• CVE-2026-43024: netfilter: nftables: reject immediate NFQUEUE verdict (bsc#1263930).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTAEXPECTNAT absent (bsc#1263932).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43035: net: sched: clsapi: fix tcchainfillnode to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).
• CVE-2026-43036: net: use skbheaderpointer() for TCPv4 GSO frag_off check (bsc#1263993).
• CVE-2026-43040: net: ipv6: ndisc: fix ndiscrauseropt to initialize nduseropt_padX fields to zero to prevent an info-
• CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).
• CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211tdlsoper (bsc#1263945).
• CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).
• CVE-2026-43054: scsi: target: tcmloop: Drain commands in targetreset handler (bsc#1264063).
• CVE-2026-43059: Bluetooth: MGMT: fix crash in setmeshsync and setmeshcomplete (bsc#1264184).
• CVE-2026-43065: ext4: always drain queued discard work in ext4mbrelease() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4fcreplay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4mbfindbygoal() (bsc#1264255).
• CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
• CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).
• CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in _ioam6filltracedata() (bsc#1264239).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifssanitizeprepath (bsc#1264437).
• CVE-2026-43119: Bluetooth: hcisync: annotate data-races around hdev->reqstatus (bsc#1264561).
• CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).
• CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).
• CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).
• CVE-2026-43198: tcp: fix potential race in tcpv6synrecvsock() (bsc#1264610).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfdeventpage_set() (bsc#1264551).
• CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43249: 9p/xen: protect xen9pfsfront_free against concurrent calls (bsc#1264476).
• CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).
• CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).
• CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).
• CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).
• CVE-2026-43333: bpf: reject direct access to nullable PTRTOBUF pointers (bsc#1264726).
• CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).
• CVE-2026-43339: ipv6: prevent possible UaF in addrconfpermanentaddr() (bsc#1264763).
• CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).
• CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).
• CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).
• CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).
• CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).
• CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).
• CVE-2026-43405: libceph: Use u32 for non-negative values in cephmonmapdecode() (bsc#1264741).
• CVE-2026-43406: libceph: prevent potential out-of-bounds reads in processmessageheader() (bsc#1265073).
• CVE-2026-43407: libceph: Fix potential out-of-bounds access in cephhandleauth_reply() (bsc#1265020).
• CVE-2026-43411: tipc: fix divide-by-zero in tipcskfilter_connect() (bsc#1264672).
• CVE-2026-43413: scsi: hisisas: Fix NULL pointer exception during userscan() (bsc#1264671).
• CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).
• CVE-2026-43470: nfs: return EISDIR on nfs3proccreate if d_alias is a dir (bsc#1265128).
• CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).
• CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).
• CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).
• CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).
• CVE-2026-45841: netfilter: nfnetlinkosf: fix divide-by-zero in OSFWSS_MODULO (bsc#1266390).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudpfillmetadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxesrqfrom_init (bsc#1266711).
• CVE-2026-45856: RDMA/uverbs: Validate wqesize before using it in ibuverbspostsend (bsc#1266720).
• CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).
• CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).
• CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).
• CVE-2026-45886: bpf: Fix bpfxdpstore_bytes proto for read-only arg (bsc#1266810).
• CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).
• CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
• CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
• CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).
• CVE-2026-45961: gfs2: fix memory leaks in gfs2fillsuper error path (bsc#1266933).
• CVE-2026-45964: SUNRPC: fix gssauth kref leak in gssalloc_msg error path (bsc#1266698).
• CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).
• CVE-2026-45970: bonding: alb: fix UAF in rlbarprecv during bond up/down (bsc#1267205).
• CVE-2026-45974: btrfs: fix invalid leaf access in btrfsquotaenable() if ref key not found (bsc#1266922).
• CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).
• CVE-2026-45984: gfs2: Move the inode glock locking to gfs2filebuffered_write (bsc#1267214).
• CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).
• CVE-2026-46005: xfs: fix a resource leak in xfsallocbuftarg() (bsc#1267431).
• CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
• CVE-2026-46024: libceph: Prevent potential null-ptr-deref in cephhandleauth_reply() (bsc#1267218).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).
• CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payloadsize() in rxercv (bsc#1266901).
• CVE-2026-46079: rbd: fix null-ptr-deref when deviceadddisk() fails (bsc#1266452).
• CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).
• CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
• CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).
• CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).
• CVE-2026-46110: net: stmmac: rename STMMACGETENTRY() -> STMMACNEXTENTRY() (bsc#1266759).
• CVE-2026-46111: Bluetooth: hciconn: fix potential UAF in createbig_sync (bsc#1267626).
• CVE-2026-46113: KVM: x86/mmu: Add helper to convert SPTE value to its shadow page (bsc#1266969).
• CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
• CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).
• CVE-2026-46120: ip6gre: Use cached t->net in ip6erspanchangelink() (bsc#1267640).
• CVE-2026-46123: Bluetooth: virtiobt: clamp rx length before skbput (bsc#1267621).
• CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
• CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).
• CVE-2026-46159: btrfs: fix btrfsioctlspaceinfo() slotcount TOCTOU which can lead to info-leak (bsc#1267652).
• CVE-2026-46160: btrfs: fix missing lastunlinktrans update when removing a directory (bsc#1267624).
• CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6rcvencap() (bsc#1266903).
• CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5ibdevressrq_init() (bsc#1266816).
• CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4srqevent() (bsc#1266826).
• CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).
• CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drmgemfbinitwith_funcs() (bsc#1267663).
• CVE-2026-46227: sctp: revalidate list cursor after sctpsendmsgtoasoc() in SCTPSENDALL (bsc#1267697).
• CVE-2026-46244: netfilter: nftinner: Fix IPv6 innerthoff desync (bsc#1267654).
• CVE-2026-46259: procfs: fix missing RCU protection when reading realparent in dotask_stat() (bsc#1267685).
• CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).

The following non-security bugs were fixed:

• ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).
• ACPI: IPMI: Fix message kref handling on dead device (git-fixes).
• ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).
• ALSA: PCM: Fix wait queue list corruption in sndpcmdrain() on linked streams (git-fixes).
• ALSA: aloop: Drop superfluous break (git-fixes).
• ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).
• ALSA: cmipci: check sndctlnew1() return value (git-fixes).
• ALSA: core: Fix unintuitive behavior of sndpowerrefandwait() (git-fixes).
• ALSA: es1938: check sndctlnew1() return value (git-fixes).
• ALSA: gus: check sndctlnew1() return value (git-fixes).
• ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).
• ALSA: ice1712: check sndctlnew1() return value (git-fixes).
• ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).
• ALSA: sc6000: Use standard print API (stable-fixes).
• ALSA: seq: Clear variable event pointer on read (git-fixes).
• ALSA: seq: Fix partial userptr event expansion (git-fixes).
• ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).
• ALSA: ua101: Reject too-short USB descriptors (git-fixes).
• ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).
• ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).
• ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).
• ALSA: usb-audio: Propagate errors in scarlettctlenum_put() (git-fixes).
• ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).
• ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).
• ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).
• ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).
• ALSA: ymfpci: check sndctlnew1() return value (git-fixes).
• ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).
• ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).
• ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).
• ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget (git-fixes).
• ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).
• ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).
• ASoC: SOF: ipc3-control: Validate size in sndsofupdate_control (git-fixes).
• ASoC: SOF: ipc4-control: Fix TOCTOU in sofipc4bytes_put (git-fixes).
• ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).
• ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).
• ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).
• ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).
• ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).
• ASoC: cs35l56: Do not leave parent IRQ disabled if system_suspend fails (git-fixes).
• ASoC: cs35l56: Fix flushing of IRQ work in cs35l56sdwremove() (git-fixes).
• ASoC: cs35l56: Fix missing calls to wmadsp2remove() (git-fixes).
• ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).
• ASoC: meson: aiu: Validate written enum values (git-fixes).
• ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).
• ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).
• ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).
• ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).
• ASoC: topology: Check PCM and DAI name strings before use (git-fixes).
• ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).
• Bluetooth: 6lowpan: check skbclone() return value in sendmcast_pkt() (git-fixes).
• Bluetooth: HIDP: fix missing length checks in hidpinputreport() (git-fixes).
• Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART (git-fixes).
• Bluetooth: ISO: fix UAF in isorecvframe (git-fixes).
• Bluetooth: ISO: serialize isosockclear_timer with socket lock (git-fixes).
• Bluetooth: L2CAP: Fix possible crash on l2capecredconn_rsp (git-fixes).
• Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout() on !conn (git-fixes).
• Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).
• Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).
• Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).
• Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).
• Bluetooth: RFCOMM: hold listener socket in rfcommconnectind() (git-fixes).
• Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).
• Bluetooth: bnep: Fix UAF read of dev->name (git-fixes).
• Bluetooth: bnep: reject short frames before parsing (git-fixes).
• Bluetooth: btmtksdio: fix infinite loop in btmtksdiotxrxwork() (git-fixes).
• Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).
• Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).
• Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).
• Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).
• Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).
• Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).
• Bluetooth: fix UAF in l2capsockcleanuplisten() vs l2capconn_del() (git-fixes).
• Bluetooth: hci: validate codec capability element length (git-fixes).
• Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close (git-fixes).
• Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).
• Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).
• Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (git-fixes).
• Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).
• Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).
• HID: quirks: really enable the intended work around for appledisplay (git-fixes).
• HID: uclogic: Fix regression of input name assignment (git-fixes).
• HID: wacom: Fix OOB write in wacomhidsetdevicemode() (git-fixes).
• Improve compatibility with awk 2.4.0 (bsc#1266214).
• Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).
• Input: atmelmxtts - fix boundary check in mxtpreparecfg_mem (git-fixes).
• Input: ims-pcu - fix usbfreecoherent() size in imspcubuffers_free() (git-fixes).
• Input: usbtouchscreen - clamp NEXIO datalen/xlen to URB buffer size (git-fixes).
• Input: xpad - fix out-of-bounds access for Share button (git-fixes).
• KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
• KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
• KVM: SVM: Allow KVMSETNESTED_STATE to clear GIF when SVME==0 (git-fixes).
• KVM: SVM: Do not set GIF when clearing EFER.SVME (git-fixes).
• KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).
• KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).
• KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).
• KVM: X86: Fix arrayindexnospec protection in __pvsendipi (git-fixes).
• KVM: arm64: Discard PC update state on vcpu reset (git-fixes).
• KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes).
• KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).
• KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes).
• KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes).
• KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits (git-fixes).
• KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).
• KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).
• KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).
• KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).
• KVM: nSVM: Set exitcodehi to -1 when synthesizing SVMEXITERR (failed VMRUN) (git-fixes).
• KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).
• KVM: x86/mmu: Fix UBSAN warning when reading nxhugepages parameter (git-fixes).
• KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).
• PM: sleep: Use complete() in devicepmsleep_init() (git-fixes).
• RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)
• RDMA/efa: Extend admin timeout error print (git-fixes)
• RDMA/efa: Fix possible deadlock (git-fixes)
• RDMA/efa: Improve admin completion context state machine (git-fixes)
• RDMA/manaib: Report maxmsgsz in manaibqueryport (git-fixes).
• wicked test: Added missing locking in backport (bsc#1267732).
• USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).
• USB: serial: belkin_sa: validate interrupt status length (git-fixes).
• USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).
• USB: serial: ioti: fix heap overflow in buildi2cfwhdr() (git-fixes).
• USB: serial: ioti: fix heap overflow in getmanuf_info() (git-fixes).
• USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).
• USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).
• USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).
• USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).
• USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).
• USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).
• USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).
• X.509: Fix validation of ASN.1 certificate header (git-fixes).
• add bugnumber to existing mana_ib change (bsc#1267682)
• agp/amd64: Fix broken error propagation in agpamd64probe() (git-fixes).
• arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)
• arm64: tlb: Optimize ARM64WORKAROUNDREPEAT_TLBI (git-fixes)
• auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).
• batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes).
• batman-adv: bla: fix reportwork leak on backbonegw purge (git-fixes).
• batman-adv: clear current gateway during teardown (git-fixes).
• batman-adv: dat: handle forward allocation error (git-fixes).
• batman-adv: fix batadvskbis_frag() kernel-doc (git-fixes).
• batman-adv: fix fragment reassembly length accounting (git-fixes).
• batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).
• batman-adv: frag: disallow unicast fragment in fragment (git-fixes).
• batman-adv: tpmeter: add only finished tpvars to lists (git-fixes).
• batman-adv: tpmeter: avoid divide-by-zero for deccwnd (git-fixes).
• batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).
• batman-adv: tp_meter: avoid window underflow (git-fixes).
• batman-adv: tp_meter: fix fast recovery precondition (git-fixes).
• batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes).
• batman-adv: tpmeter: initialize deccwnd explicitly (git-fixes).
• batman-adv: tpmeter: initialize dupacks explicitly (git-fixes).
• batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes).
• batman-adv: tt: fix negative lastchangesetlen (git-fixes).
• batman-adv: tt: fix negative ttbufflen (git-fixes).
• bcache: fix uninitialized closure object (git-fixes).
• bnxt_en: Fix NULL pointer dereference (bsc#1268307).
• comedi: comeditest: Fix limiting of convertarg in waveformaicmdtest() (git-fixes).
• comedi: comeditest: fix check for valid scanbeginsrc in waveformai_cmdtest() (git-fixes).
• crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).
• crypto: amlogic - avoid double cleanup in mesoncryptoprobe() (git-fixes).
• crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents (git-fixes).
• crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).
• crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).
• crypto: ccp - Fix snpfilterreservedmemregions() off-by-one (git-fixes).
• crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).
• crypto: drbg - Fix drbgmaxaddtl() on 64-bit kernels (git-fixes).
• crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).
• crypto: drbg - Fix the fips_enabled priority boost (git-fixes).
• crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).
• crypto: ecrdsa - fix unknown OID check in ecrdsaparamcurve (git-fixes).
• crypto: hisilicon/qm - disable error report before flr (git-fixes).
• crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).
• crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).
• crypto: qat - protect service table iterations with service_lock (git-fixes).
• crypto: qat - validate RSA CRT component lengths (git-fixes).
• crypto: rng - Free default RNG on module exit (git-fixes).
• device property: set fwnode->secondary to NULL in fwnode_init() (git-fixes).
• driver core: reject devices with unregistered buses (git-fixes).
• driver core: use READONCE() for dev->driver in devhassyncstate() (git-fixes).
• drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).
• drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).
• drm/amd/display: Clamp HDMI HDCP2 rxidlist read to buffer size (git-fixes).
• drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).
• drm/amd/display: Fix integer overflow in biosgetimage() (stable-fixes).
• drm/amd/display: Reject gpiobitshift >= 32 in biosparsergetgpiopininfo() (git-fixes).
• drm/amd/display: Use kreallocarray() in dalvector_reserve() (git-fixes).
• drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).
• drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync (stable-fixes).
• drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).
• drm/amdgpu/uvd3.1: Do not validate the firmware when already validated (git-fixes).
• drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).
• drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).
• drm/amdgpu: fix integer overflow in amdgpugemalign_pitch() (git-fixes).
• drm/amdgpu: fix spelling typos (stable-fixes).
• drm/amdgpu: set subblockindex for mca ras sub-blocks (git-fixes).
• drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).
• drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).
• drm/amdkfd: fix NULL dereference in getqueueids() (git-fixes).
• drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPM_OPS() (git-fixes).
• drm/bridge: chipone-icn6211: use devmdrmbridge_add in i2c probe (git-fixes).
• drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).
• drm/bridge: megachips: remove bridge when irq request fails (git-fixes).
• drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).
• drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).
• drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).
• drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).
• drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).
• drm/hyperv: use VMBUSRINGSIZE() (git-fixes).
• drm/hyperv: validate VMBus packet size in receive callback (git-fixes).
• drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).
• drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).
• drm/i915: Extract inteldbufmdclkcdclkratio_update() (stable-fixes).
• drm/i915: Fix potential UAF in TTM object purge (git-fixes).
• drm/i915: Loop over all active pipes in intelmbusdbox_update (stable-fixes).
• drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).
• drm/msm/dp: Fix the ISR_* enum values (git-fixes).
• drm/msm/dp: fix HPD state status bit shift value (git-fixes).
• drm/msm/dsi: do not dump registers past the mapped region (git-fixes).
• drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).
• drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).
• drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).
• drm/radeon: fix integer overflow in radeonalignpitch() (git-fixes).
• drm/radeon: fix memory leak in radeonringrestore() on lock failure (git-fixes).
• drm/rockchip: cdn-dp: add missing check in cdndpconfig_video() (git-fixes).
• drm/tegra: Fix iommumapsgtable() return value check (git-fixes).
• drm/tegra: dc: Fix device node reference leak in tegradchas_output() (git-fixes).
• drm/tidss: Drop extra drmmodeconfig_reset() call (git-fixes).
• drm/tidss: Fix missing drmbridgeadd() call (git-fixes).
• drm/vc4: fix krealloc() memory leak (git-fixes).
• drm/virtio: Fix driver removal with disabled KMS (git-fixes).
• drm/virtio: fix dmafence refcount leak on error in virtiogpudmafence_wait() (git-fixes).
• drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).
• efi: Allocate runtime workqueue before ACPI init (git-fixes).
• ethtool: provide customized dim profile management (bsc#1261256).
• fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).
• fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).
• fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).
• fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).
• fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).
• fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).
• fbdev: radeon: fix potential memory leak in radeonfbpciregister() (git-fixes).
• fbdev: s3fb: fix potential memory leak in s3pciprobe() (git-fixes).
• fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).
• fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).
• fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).
• fbdev: tridentfb: fix potential memory leak in tridentpciprobe() (git-fixes).
• fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).
• fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).
• firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).
• firmware: armffa: Skip freepages on RX buffer alloc failure (git-fixes).
• firmware: armscmi: Fix OOB in scmipowernameget() (git-fixes).
• firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).
• firmwareloader: Fix recursive lock in devicecachefwimages() (git-fixes).
• firmwareloader: fix device reference leak in firmwareupload_register() (git-fixes).
• gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).
• gpu: host1x: Allow entries in BO caches to be freed (git-fixes).
• gpu: host1x: Fix iommumapsgtable() return value check (git-fixes).
• hv: utils: handle and propagate errors in kvp_register (git-fixes).
• hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).
• hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).
• hwmon: (pmbus/adm1266) cap PDIO scan in getmultiple at ADM1266PDIO_NR (git-fixes).
• hwmon: (pmbus/adm1266) do not clobber GPIO bits before PDIO read in get_multiple (git-fixes).
• hwmon: (pmbus/adm1266) include PEC byte in pmbusblockxfer read buffer (git-fixes).
• hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).
• hwmon: (pmbus/adm1266) register the gpiochip after pmbusdo_probe() (git-fixes).
• hwmon: (pmbus/adm1266) register the nvmem device after pmbusdoprobe() (git-fixes).
• hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).
• hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).
• hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).
• hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2CSMBUSBLOCK_MAX (git-fixes).
• hwrng: jh7110 - fix refcount leak in starfivetrngread() (git-fixes).
• hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).
• hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).
• i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
• i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).
• i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).
• i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).
• iio: adc: viperboard: Fix error handling in vprbrdiioread_raw (git-fixes).
• iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).
• iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).
• iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).
• iio: dac: ad5686: fix input raw value check (git-fixes).
• iio: dac: max5821: fix return value check in powerdown sync (git-fixes).
• iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).
• iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).
• iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).
• iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).
• iio: sspsensors: cancel delayed workrefresh on remove (git-fixes).
• iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).
• kabi: arm64: module: Update missing .init.text.ftrace_trampoline section message (bsc#1265579 bsc#1265170).
• linux/dim: move useful macros to .h file (bsc#1261256).
• misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).
• misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).
• misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).
• misc: fastrpc: fix use-after-free race in fastrpcmapcreate (git-fixes).
• mmc: core: Fix host controller programming for fixed driver type (git-fixes).
• mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).
• mmc: litexmmc: Use DIVROUND_UP for more accurate clock calculation (git-fixes).
• mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
• mmc: sdhci: add signal voltage switch in sdhciresumehost (git-fixes).
• net: ethtool: add ethtool COALESCERXCQE_FRAMES/NSECS (bsc#1261256).
• net: gro: do not merge zcopy skbs (git-fixes).
• net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).
• net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).
• net: mana: Add support for RX CQE Coalescing (bsc#1261256).
• net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).
• net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer (bsc#1265928).
• net: mana: Skip redundant detach on already-detached port (git-fixes).
• net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).
• net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).
• net: mana: hardening: Reject zero maxnumqueues from GDMAQUERYMAX_RESOURCES (git-fixes).
• net: mana: validate rxreqidx to prevent out-of-bounds array access (bsc#1266402).
• net: wwan: iosm: fix potential memory leaks in ipcimeminit() (git-fixes).
• phy: marvell: mvebu-a3700-utmi: fix incorrect USB2PHYCTRL register access (git-fixes).
• platform/x86: advswbutton: Check ACPIHANDLE() against NULL (git-fixes).
• platform/x86: hpaccel: Check ACPICOMPANION() against NULL (git-fixes).
• platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).
• platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).
• r8152: fix incorrect register write to USBUPHYXTAL (git-fixes).
• rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538).
• rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538).
• rpm: Add BuildRequires for Rust enablement (bsc#1258538).
• s390/barrier: Make arrayindexmask_nospec() _alwaysinline (bsc#1263068).
• s390/entry: Scrub r12 register on kernel entry (bsc#1263068).
• s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).
• sched/rt: Skip currently executing CPU in rtonextcpu() (bsc#1262649).
• security/keys: fix missed RCU read section on lookup (stable-fixes).
• serial: fsllpuart: fix rx buffer and DMA map leaks in startrx_dma (git-fixes).
• serial: qcom-geni: fix UARTRXPAR_EN bit position (git-fixes).
• slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).
• smb: client: correctly handle ErrorContextData as a flexible array (git-fixes)
• smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).
• soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).
• soc: ti: k3-ringacc: Fix access mode for k3ringaccringpoptail_io/proxy (git-fixes).
• spi: at91-usart: drop dead runtime pm support (git-fixes).
• spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).
• spi: fsl-lpspi: replace dmaengineterminateall() with dmaengineterminatesync() (git-fixes).
• spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).
• spi: meson-spifc: fix runtime PM leak on remove (git-fixes).
• spi: mtk-snfi: Fix resource leak in mtksnandreadpagecache() (git-fixes).
• spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).
• spi: st-ssc4: switch to use modern name (stable-fixes).
• spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).
• spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).
• string: add memiszero() helper to check if memory area is all zeros (stable-fixes).
• thermal: hwmon: Fix critical temperature attribute removal (git-fixes).
• thunderbolt: Bound root directory content to block size (git-fixes).
• thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).
• thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).
• thunderbolt: Reject zero-length property entries in validator (git-fixes).
• thunderbolt: Validate XDomain request packet size before type cast (git-fixes).
• thunderbolt: property: Reject dirlen < 4 to prevent sizet underflow (git-fixes).
• thunderbolt: property: Reject u32 wrap in tbpropertyentry_valid() (git-fixes).
• tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).
• tty: serial: pchuart: add check for dmaalloc_coherent() (git-fixes).
• usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).
• usb: cdns3: plat: fix unbalanced pmruntimeforbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles (git-fixes).
• usb: chipidea: core: convert ciroleswitch to local variable (git-fixes).
• usb: dwc2: Fix use after free in debug code (git-fixes).
• usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).
• usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).
• usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).
• usb: gadget: fhid: fix device reference leak in hidgalloc() (git-fixes).
• usb: gadget: net2280: Fix double free in probe error path (git-fixes).
• usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).
• usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).
• usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).
• watchdog: apple: Add "apple,t8103-wdt" compatible (git-fixes).
• watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).
• watchdog: sprdwdt: Remove redundant sprdwdt_disable() on register failure (git-fixes).
• watchdog: unregister PM notifier on watchdog unregister (git-fixes).
• wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).
• wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).
• wifi: ath11k: fix error path leak in ath11ktmcmdwmiftm() (git-fixes).
• wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).
• wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).
• wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).
• wifi: ath11k: fix use after free in ath11kdprxmsducoalesce() (git-fixes).
• wifi: ath11k: fix warning when unbinding (git-fixes).
• wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).
• wifi: cfg80211: advance loop vars in cfg80211mergeprofile() (git-fixes).
• wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).
• wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).
• wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).
• wifi: mac80211: limit injected antenna index in ieee80211parsetx_radiotap (git-fixes).
• wifi: mt76: fix argument to ieee80211isfirst_frag() (git-fixes).
• wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).
• wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).
• wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).
• wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).
• wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).
• wifi: nl80211: reject oversized EMA RNR lists (git-fixes).
• wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).
• wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).
• wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).
• wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).
• wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).
• wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication (git-fixes).
• wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).
• wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).