Your message dated Thu, 29 Oct 2026 13:25:01 +0000
with message-id <[email protected]>
and subject line Bug#1150891: fixed in linux 6.12.113-1
has caused the Debian Bug report #1150891,
regarding linux: xfrm interface use-after-free introduced by this version
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150891: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150891
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: linux
Version: 6.12.94
Severity: important
Tags: upstream
X-Debbugs-Cc: [email protected]
Dear Maintainer,
After upgrading the user laptops, we frequently encountered the following error
:
- unregister_netdevice: waiting for nm-xfrm-<id> to become free. Usage count =
-3.
It blocks the vpn connection and the user have to reboot to be able to reuse
the vpn.
The problem doesn't appear in the 6.12.93.
And it was fixed in the mainline v7.2-rc1 via the commit
8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff : xfrm: Fix dev use-after-free in xfrm
async resumption
-- System Information:
Debian Release: 13.7
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.111+deb13-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
--- End Message ---
--- Begin Message ---
Source: linux
Source-Version: 6.12.113-1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
linux, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated linux package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 15 Oct 2026 17:02:11 +0200
Source: linux
Architecture: source
Version: 6.12.113-1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Kernel Team <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1149499 1149564 1150891
Changes:
linux (6.12.113-1) trixie-security; urgency=high
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.112
- Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature"
- Revert "hwmon: (emc1403) Rely on subsystem locking"
- landlock: Fix TCP Fast Open connection bypass
- [s390x] boot: Add sized_strscpy() to enable strscpy() usage
- [s390x] boot: Avoid IPL parameter append past command line
- sunvdc: fix -EIO issue due to lack of retries
- net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue
- net: cpsw: Execute ndo_set_rx_mode callback in a work queue
- ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec().
- ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and
MCAST_JOIN_GROUP.
- ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and
MCAST_LEAVE_GROUP.
- ipv6: mcast: Don't hold RTNL for MCAST_ socket options.
- ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()
(CVE-2026-98101)
- media: video-i2c: fix buffer queue ordering
- ipv6: Select best matching nexthop object in fib6_table_lookup()
- ipv6: Honor oif when choosing nexthop for locally generated traffic
- pidfd: hold exec_update_lock around namespace ioctl (CVE-2026-89766)
- xfrm: avoid RCU warnings around the per-netns netlink socket
- xfrm: fix compat ALLOCSPI request use-after-free
- xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for
xfrm_trans_reinject()
- esp: downgrade zerocopy managed frags before mutating skb frags
- RDMA/siw: Clear association under lock if siw_qp_modify fails in
siw_accept
- RDMA/rxe: validate access flags before swapping the MR's PD
- RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
- [arm64] firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
- clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
- RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
- RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
- IB/iser: reject a remote invalidation of an unregistered direction
- IB/isert: wait for deferred control PDU completions before releasing the
connection
- RDMA/mad: Fix receive buffer leak when PKey enforcement fails
- RDMA/irdma: Enforce local fence for IB_WR_REG_MR
- RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
- dmaengine: sprd: Fix runtime PM reference leak in probe
- wifi: virt_wifi: free skb when disconnected
- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
- wifi: libipw: reject too-short beacon and probe responses
- wifi: libipw: reject too-short association responses
- IB/IPoIB: Avoid restoring OPER_UP after multicast flush
- wifi: cfg80211: don't get the radio mask for netdev-less wdevs
- wifi: cfg80211: check IP header size in cfg80211_classify8021d()
- soundwire: cadence_master: wait and cancel cdns->work before clock stop
- dma-coherent: Warn if OF reserved memory is beyond current coherent DMA
mask
- dma-coherent: report a failed reserved memory assignment
- dmaengine: Fix device kref underflow in dma_chan_put()
- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
- dmaengine: wait for RCU readers before releasing dma_device
- wifi: cfg80211: only group hidden BSSes with beacon entries
- wifi: cfg80211: don't filter by BSS type when removing stale entries
- wifi: mac80211: don't start a ROC while scanning
- wifi: cfg80211: add option for vif allowed radios
- wifi: mac80211: use vif radio mask to limit ibss scan frequencies
- wifi: mac80211: don't warn when an IBSS has no channel to scan
- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
- wifi: mac80211: suppress chanctx warning for debugfs reset
- wifi: mac80211: abort chanswitch when leaving a mesh
- wifi: mac80211: reset state when starting AP fails
- wifi: mac80211: unlist vifs when their netdev is unregistered
- wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
- wifi: cfg80211: skip regulatory for punctured subchannels
- wifi: cfg80211: expose cfg80211_chandef_get_width()
- wifi: mac80211: don't allow injecting frames wider than the chanctx
- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
- wifi: mac80211: require a peer station for TDLS setup confirm
- wifi: mac80211: don't allow link changes when iface is down
- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
- wifi: mac80211: don't access the TSF of a down interface
- wifi: mac80211: add HE 6 GHz capability in the scan elems len
- wifi: mac80211: mesh: reset the CSA state when leaving
- wifi: mac80211: mesh: release the channel if start fails
- wifi: mac80211: set up the TX info early to fix failure paths
- mm: memblock: show all region flags in debugfs
- scsi: qla2xxx: Fix the ql2xfc2target parameter description
- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic
DMA
- RDMA/efa: Keep admin queues alive while IRQ is registered
- RDMA/efa: Keep EQ resources alive while IRQ is registered
- RDMA/siw: Bound fragmented header copies by the remaining length
- netfilter: nft_nat: fully initialise new_addr in netmap setup
- netfilter: flowtable: hold reference on ct until flow is released
- perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
- [arm64] hibernate: clone only the linear map that exists at runtime
- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
- keys: fix lost wakeup when reaping a dead key type
- ALSA: bcd2000: Fix race between rawmidi and disconnect
- [arm64] phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow
- [arm64] phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio
setting
- ALSA: pcm: set timer->private_data before registering the PCM timer
- ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask
- ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map
- ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec
params
- Input: trackpoint - fix the inertia attribute name in the ABI document
- gpio: virtuser: skip free_irq when no IRQ is installed
- ALSA: 6fire: Clean ups with guard()
- ALSA: usb: 6fire: Avoid embedded URBs
- ALSA: 6fire: fix OOB write from device-reported iso length
- wifi: virt_wifi: don't transfer operstate before register
- drm/vc4: Use managed KMS polling to fix UAF on unbind
- ALSA: hda: trace PCM open only after assigning a stream
- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
- btrfs: tree-checker: print dev extent offset in error message
- [arm64] drm/msm/dsi: round the byte clock rate after reparenting to the
PHY PLL
- seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
- ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
- net: fddi: skfp: fix NULL deref when setting the MAC address while down
- wifi: brcmfmac: fix lost 802.1x TX completion wakeup
- net: bridge: mst: move switchdev call outside rcu
- tcp: Don't call skb_clone_and_charge_r() for close()d listener in
tcp_v6_do_rcv().
- tcp: do not let tcp_rmem be set below 4096
- ksmbd: return buffer overflow for partial filesystem info
- ksmbd: fix partial file information responses
- ksmbd: keep compound responses on query info errors
- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
- Bluetooth: hci_core: Print number of packets in conn->data_q
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
- Bluetooth: coredump: Quiesce dump work on unregister
- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync
- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events
- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown
- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
- pppoatm: ensure a writable skb header and linear data
- drop_monitor: synchronize tracepoint unregistration on error path
- drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
- net: stmmac: do not overwrite phc_index when no PTP clock is registered
- [powerpc*] KVM: PPC: Book3S HV: fix use-after-free in
kvmhv_emulate_tlbie_all_lpid()
- [powerpc*] KVM: PPC: Book3S HV: fix secure device page leak on
uv_page_in() failure
- [powerpc*] iommu: Fix the overflow validation in iommu_tce_check_ioba
- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
- ASoC: hdmi-codec: Report a change when the channel status moves
- net: netsec: fix device_node reference leak on phy_np
- net: lock the socket in sock_gettstamp()
- net: ethernet: cortina: Ack RX overrun interrupt correctly
- net: stmmac: propagate FPE preemption-class mapping errors
- net: macb: fix ordering around PTP timestamp read
- net: mvpp2: prevent buffer overflow in page_pool allocation
- net: skbuff: do not leave stale header offsets after pskb_carve()
- drm/amdgpu: check ras and obj before dereference
- btrfs: abort transaction on failure to update inode for hole punching and
reflinking
- [amd64] x86/fred: Reconstruct the #GP context for rejected INT
instructions
- mm/huge_memory: use folio's memcg inside __folio_split()
- wifi: rtw88: TX QOS Null data the same way as Null data
- wifi: rtw88: Fix the random "error beacon valid" messages for USB
- Input: xpad - add support for Victrix Pro BFG Controller
- Input: xpad - add support for Azeron devices
- Input: xpad - fix PDP Marvel Xbox 360 controller
- ALSA: core: Fix potential UAF after asynchronous card release
- ALSA: virtio: reset device before deleting virtqueues
- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
- ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
- ata: libahci_platform: Fix device reference leak in
ahci_platform_get_resources()
- cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
- exec: Cleanup POSIX timers right after de_thread()
- rds: ib: use rds_conn_drop() on protocol version mismatch
- [amd64] x86/microcode/intel: Reject problematic loading on Granite Rapids
systems
- tcp: exclude old ACKs from tcp fast path
- RDMA/ucma: Serialize join and leave on copy_to_user failure
- RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
- openvswitch: avoid reallocating confirmed conntrack labels
- net: xfrm: reject unrepresentable espintcp transport headers
- HID: logitech-hidpp: fix race condition when accessing stale stack
pointer
- [arm64] hibernate: pass HVC_SET_VECTORS args to the resume hvc
- [arm64] dts: renesas: r8a779f0: Set UFS lane count
- [arm64] percpu: Fix this_cpu_write() casting
- [arm64] percpu: Fix this_cpu_and() mask generation
- Bluetooth: btusb: fix NXP IW610 composite device handling
- Bluetooth: eir: validate service data length before reading UUID
- Bluetooth: hci_codec: validate vendor codec count length
- Bluetooth: hci_sync: Serialize local codec list cleanup
- dmaengine: sun6i: fix non-atomic read of DMA position registers
- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
- dmaengine: ti: k3-udma-glue: fix NULL dereference in
k3_udma_glue_release_rx_chn()
- ipv6: xfrm: use full sockets in local error paths
- net: lan743x: fix RX checksum use-after-free
- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
- net/sched: act_api: release tail references on DELACTION failure
- net/sched: hhf: cap hh_flows_limit at change time
- net/packet: clear RX owner on VNET header error
- net/packet: avoid truncating TPACKET_V3 private size
- scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
- xfrm: serialize state GC with device state flush
- xfrm: use hlist_del_init_rcu for state_cache and state_cache_input
- memstick: ms_block: destroy io_queue workqueue on removal
- mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
- KEYS: encrypted: fix integer overflow of datablob_len
- keys: translate request_key_auth pid for the reading procfs instance
- KEYS: trusted: Fix tpm2_load_cmd() boundary check
- i2c: at91: release DMA channels on remove and probe error
- i2c: atr: fix dangling adapter pointer on add failure
- i2c: imx: release DMA channels on probe error
- i2c: imx: disable autosuspend on remove
- IB/mlx4: Fix use-after-free on pkey sysfs registration failure
- IB/hfi1: Resolve the credit-return buffer through the send context's node
- IB/hfi1: Fix the PIO_CRED credit-return mmap
- selinux: preserve user SID across nested backing files
- selinux: recheck intermediate backing files on mprotect()
- selinux: always fill AVC decision in avc_has_perm_noaudit()
- power: sequencing: don't call .post_enable() if pwrseq_unit_enable()
failed
- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
- power: sequencing: fix NULL-pointer dereference in
pwrseq_device_register()
- mmc: core: Cancel SDIO IRQ work before freeing host
- mmc: core: Fix OF node reference leak on card add failure
- mmc: hsq: Fix use-after-free in retry work
- mmc: mmci: Fix use-after-free in busy-timeout work
- mmc: mxcmmc: cancel data work and watchdog on remove
- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260
- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
- mmc: sdio_uart: fix xmit_fifo leak when the port table is full
- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
- mmc: spi: reset bytes_xfered before retrying CRC failures
- mmc: sdhci_am654: Move tuning_loop to local variable
- mmc: sdhci_am654: Reset command and data lines on failed tuning
- mmc: sdhci_am654: Clear ITAPDLY on tuning failure
- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning
failure
- Input: adp5588-keys - cache GPIO state before registering the gpiochip
- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
- Input: cyttsp5 - clamp the HID report size before memcpy
- Input: evdev - zero absinfo before partial copy in EVIOCSABS
- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
- Input: soc_button_array - fix MS Surface Pro 11 probe failure
- Input: soc_button_array - check btns_desc->package.count
- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
- Input: zero ff_effect before compat copy in input_ff_effect_from_user
- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
- hwmon: (pmbus/core) increase number of phases and add new mask
- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding
- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676
- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
- hwmon: (w83793) release probe data through kref
- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
- watchdog: digicolor: Avoid division by zero
- watchdog: msc313e: Fix premature reset during timeout update
- watchdog: msc313e: Propagate error code in resume()
- watchdog: rtd119x: Avoid division by zero
- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start()
- wifi: brcmsmac: fix UAF in brcms_free_timer()
- wifi: iwlegacy: fix broadcast stations deallocation
- wifi: libertas_tf: fix UAF in lbtf_free_adapter()
- wifi: rsi: fix heap OOB write on key removal
- wifi: wlcore: release runtime PM ref on regdomain config failure
- wifi: wilc1000: fix out-of-bounds read in P2P public action frames
- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
- wifi: p54: validate curve data length in the calibration curve converters
- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
- wifi: mwifiex: validate scan response extents
- wifi: mwifiex: prevent authentication frame length truncation
- wifi: mwifiex: validate action frame fixed fields
- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
- drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
- [arm64] drm/msm/adreno: fix autosuspend cleanup during teardown
- [arm64] drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
- smb: client: cancel reconnect work in clean_demultiplex_info()
- smb: client: fix rlist race and missing initialization
- smb: client: reject short Next offsets in parse_server_interfaces()
- smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
- smb: client: fix unaligned access in WSL reparse point parser
- smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
- smb: client: fix potential OOB read in smb3_enum_snapshots()
- smb: client: fix server->total_read for compound encrypted PDUs
- smb: client: fix missing lower-bound check on DFS referral string offsets
- smb: client: fix missing iov bounds check in parse_posix_sids()
- HID: asus: fortify keyboard handshake (Closes: #1149499)
- ksmbd: fix partial normalized name responses
- spi: spi-zynqmp-gqspi: stop the controller on shutdown
- smb: client: fix busy dentry warning on unmount after DIO
(CVE-2026-72315)
- xfs: don't stash removename operations with unknown ftype
- erofs: fix large folio race in erofs_fscache_req_complete
- ALSA: hda/realtek: Limit Star Labs internal mic boost
- ALSA: hda/realtek: Add StarFighter HDA SSID
- netfilter: nf_tables: Tolerate chains with no remaining hooks
- netfilter: nf_tables: Simplify chain netdev notifier
- xfrm: Refactor xfrm_input lock to reduce contention with RSS
- xfrm: Fix dev use-after-free in xfrm async resumption (CVE-2026-72463)
(Closes: #1150891)
- xfrm: save input state data before secpath resets
- remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage
- [s390x] KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
- bpf: Fix bpf_skb_change_tail wrt csum partial skbs
- bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
- bpf: Fix divide-by-zero in btf_struct_walk()
- bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
- tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
- HID: elecom: fix bus type for M-XGL20DLBK
- [amd64] KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr()
- bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
- bpf: Fix out-of-bounds read of rtt_min in sock_ops
- bpf: Remove migrate_{disable|enable} in ->map_for_each_callback
- bpf: Bail out early in __htab_map_lookup_and_delete_elem()
- bpf: Factor out htab_elem_value helper()
- bpf: Register dtor for freeing special fields
- bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
- bpf, sockmap: Fix self-redirect copied_seq double-counting
- [arm64] bpf, arm64: set up the frame pointer for the exception callback
- pinctrl: meson: Fix typo in s4 group name
- [amd64] HID: amd_sfh: Validate PCI BAR size before mapping
- HID: bpf: fix __hid_bpf_hw_check_params report length
- [riscv64] KVM: Preserve firmware counter value across stop/start
- [riscv64] KVM: Report snapshot write failure to the guest
- [riscv64] KVM: Fix perf-backed counter accounting across stop and read
- [arm64] KVM: arm64: vgic-its: Free the caches when GITS_BASER changes
- [arm64] KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry
sizes
- [arm64] KVM: arm64: vgic-its: Skip unreachable devices instead of failing
the save
- [arm64] KVM: arm64: Return -EINVAL for an empty SMCCC filter range at
base
0
- [arm64] KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP
- squashfs: Add dictionary size range check to prevent shift-out-of-bounds
- scsi: sd_zbc: Reject disks with too many zones
- Bluetooth: SMP: reject Security Request over BR/EDR
- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
- cgroup: selftests: Move memcontrol specific helpers out of common
cgroup_util.c
- scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
- docs: s390/pci: Improve and update PCI documentation
- [s390x] pci/docs: Fix sriov_numvfs attribute name
- [s390x] cio: Fix cio_update_schib() to not cache invalid schib
- [s390x] cio: Check pmcw.dnv before pmcw.ena in I/O entry points
- [s390x] cio: Guard PMCW field accesses with dnv check
- xsk: Use a 32-bit compare in xsk_map_gen_lookup
- bpf: Skip unsettled links in link iterator
- net/sched: cls_u32: fix manual hash table handle IDR aliasing
- net/mlx5: devcom, Base component size on linked devices
- bpf: Restrict CO-RE poisoning to relocatable instructions
- libbpf: Reject truncated ldimm64 CO-RE relocations
- netfilter: flowtable: publish HW_DEAD after worker is done
- netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
- netfilter: nft_synproxy: use the family-aware checksum helper
- ipvs: revalidate ihl before icmp_send
- netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
- [arm64] io: Reject non-user protection in ioremap_prot()
- ocfs2: make ocfs2_calc_xattr_init() return void
- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
- drm/nouveau/disp: don't reject HDMI config on cards without SCDC
- net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
- net: gue: reject invalid REMCSUM offsets
- net: ethernet: mtk_eth_soc: unregister net_devices in case of probe
failure
- ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
- eth: fbnic: Handle maximum standalone channels
- eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the
mailbox
- sctp: avoid livelock while updating retransmit path
- bpf: Bound ownership depth through local kptrs and graph roots
- net: usb: catc: bound the RX packet length in catc_rx_done()
- bpf: Check params size before reading reserved fields
- net/sched: sch_hfsc: bound the classify inner-filter walk with a drift
budget
- drm/virtio: fix object leak when drm_gem_handle_create() fails
- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and
control
fallthrough
- Bluetooth: btintel_pcie: validate device-supplied DMA indices
- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
- octeontx2-af: Fix memory scaling limitation in SR-IOV mode
- dpll: use exact lookup for reference sync pin id
- net: usb: sr9700: include receive overhead in the length check
- ipv6: Fix dst leak for uncached routes.
- tg3: clean up PHYLIB resources on probe failure
- [amd64] drm/i915/psr: Add new SU area calculation helper to apply
workarounds
- [amd64] drm/i915/psr: Clear stale sel fetch enable bits on sel fetch
disable
- [s390x] debug: Do not register views for failed static debug areas
- [s390x] debug: Fix NULL pointer dereference in debug_info_copy()
- net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
- genetlink: report the real command id for dump-only ops in policy dumps
- net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure
- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower
bounds
- bpf: Fix bounds check for skb-backed dynptrs
- bpf: Fix bpf_sock context code generation
- bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
- net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
- net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
- sctp: hold asoc or transport before mod_timer() in timer handlers
- net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
- bpf: Reject dev-bound-only programs on other devices
- nfc: nfcmrvl: validate helper command length before pull
- nfc: st21nfca: validate received frame size
- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
- nfc: llcp: Fix race condition in accept_queue lifecycle
- nfc: virtual_ncidev: Add missing ioctl compat handler
- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
- nfc: st21nfca: validate ISO15693 inventory length
- nfc: llcp: fix -ENOMEM on connect with zero-length service name
- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
- nfc: llcp: fix slab-out-of-bounds reads when logging service names
- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
- net/sched: act_gate: budget the per-entry list in get_fill_size
- veth: manage XDP program pointers during channel resize
- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
- vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
- bpf: Fix immediate JMP JEQ/JNE on MIPS32
- bpf: Fix BSWAP 32 and 16 on MIPS64
- driver core: Add device probe log helper dev_warn_probe()
- tg3: use random MAC address when tg3_get_device_address fails
- net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
- net: bcmgenet: initialize u64 stats seq counter for all queues
- net: bcmgenet: move bcmgenet_power_up into resume_noirq
- net: bcmgenet: allow return of power up status
- net: bcmgenet: do not skip WoL power up on GENET V1
- net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
- net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
- ip_gre: Reject enabling collect metadata through changelink
- vxlan: use one headroom snapshot for neighbour replies
- net: xps: reject an out of range traffic class
- drm/imagination: clamp freelist reconstruction requests
- bonding: crypto offload enabled, non-offload slave failover, rekey failed
- net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
- tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
- nfp: hold IPsec RX state under the XArray lock
- net/smc: fix UAF on lgr list traversal in smcr_port_err()
- tipc: Fix a data race on mon->peer_cnt in mon_timeout()
- net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock
fails
- llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
- bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
- net/sched: sch_teql: fix shadowed err in __teql_resolve()
- vlan: ensure sufficient headroom in vlan_dev_hard_header()
- autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
- [amd64] perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted
PERF_GLOBAL_CTRL bits
- [amd64] perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if
CPU has PEBS isolation, to fix stuck PEBS_ENABLED
- [amd64] perf/x86/intel: Don't pointlessly context switch DS_AREA (and
PEBS
config) if PEBS is unused
- [amd64] perf/x86/intel: Make @data a mandatory param for
intel_guest_get_msrs()
- mptcp: return sk_wait_data() errors from recvmsg()
- rculist: add list_splice_rcu() for private lists
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit
phase
(CVE-2026-52988)
- [amd64] x86/mce: Fix hardware debug register corruption on task migration
- [amd64] x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
- virtio_net: copy zerocopy frags in start_xmit without NAPI
- tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers
underflow
- tcp: prevent collapsing skbs across boundary in rtx queue
- sctp: discard the rest of the packet on a stale-cookie error
- af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
- ata: libata-scsi: bound the ATA passthru sense descriptor writes
- cgroup/pids: Restore pids.events notifications in local mode
- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
- fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder
syzbot's "WARNING in do_new_mount" saga
- writeback: bound cleanup_offline_cgwb() rescans by rotating scanned
inodes
- workqueue: Fix NULL current_pwq deref in flush dependency check
- writeback: report a Tasks-RCU quiescent state per cgwb drain pass
- fsl/fman: Fix clk reference leak in read_dts_node()
- ipe: protect the dm-verity root hash with RCU
- ipv6: do not let ipv6_find_hdr() return an offset past the packet end
- ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
- gpio: zynq: fix runtime PM leak on request error path
- llc: reserve device headroom for allocated frames
- mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
- rds: ib: Clear the sg list when mapping an MR fails
- [amd64] drm/i915: fix incorrect RCU teardown order
- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
- drm/amd/display: Bump frame warning limit for clang builds of dml
- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
- drm/nouveau: fix autosuspend cleanup during teardown
- drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
- drm/nouveau: fix double-free in nvif_vmm_dtor
- drm/nouveau: Fix gem reference leak in validate_init()
- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
- drm/nouveau: RCU-free the scheduler-containing nouveau_sched
- drm/nouveau: don't bump pin count on failed re-pin in
nouveau_bo_pin_locked()
- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV
- drm/virtio: fix memory leak of fence event on execbuffer failure
- drm/virtio: fix NULL pointer dereference on fence allocation failure
- gpio: tps65219: Fix GPIO input value reads
- mm/hugetlb: preserve mremap address delta when skipping page tables
- PCI: of_property: Omit bus properties without a subordinate bus
- HID: alps: fix use-after-free on input2 registration failure
- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
- net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
- net/mlx5e: advertise MACsec offload only when supported
- net/sched: reject IDR error pointers when deleting actions
- net: arp: terminate device name before lookup
- net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
- net: hisilicon: hns_dsaf_mac: fix mdio device leak in
hns_mac_register_phy()
- net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
- net: openvswitch: conntrack: remove 'add_helper' dead code
- net: openvswitch: conntrack: fix helper UAF due to extensions realloc
- net: atl1c: fix soft lockup on out-of-range tpd_cons read
- net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
- net: bridge: mdb: restart port group walk after deletion
- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
- net: usb: lan78xx: Fix URB reference leak in
lan78xx_submit_deferred_urbs()
- netfilter: ip6t_rpfilter: reject routes without inet6_dev
- netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
- netfilter: nf_tables: skip expired catchall elements on insert and delete
- nfc: fix use-after-free in nfc_get_local_general_bytes
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
- nfc: port100: reject frames whose declared length exceeds the received
data
- scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
- perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
- perf/core: Run sched_task() for PMUs with only CPU-wide events
- pinctrl: single: free the IRQ on domain creation failure
- pinctrl: sunxi: keep a shadow copy of the data register output latches
- [s390x] cio: Fix NULL pointer dereference in ccw_device_get_util_str()
- [s390x] cmf: Fix virtual vs physical address confusion
- [s390x] vfio-ap: fix KVM GISC and page leak when queue removed from host
config
- KVM: Ensure memory attributes xarray nodes are accounted to the caller's
memcg
- KVM: Don't treat reserved xarray entries as having memory attributes
- [arm64] KVM: arm64: Fix spurious warning for benign stage 2 teardown race
- [riscv64] KVM: Synchronize hrtimer callback during teardown
- [riscv64] KVM: Fix HSM hart status error propagation
- Bluetooth: hci_conn: fix CIS hold ownership on reuse
- Bluetooth: hci_sock: validate event length before filtering
- Bluetooth: hci_sock: reject out-of-range OCF values
- Bluetooth: ISO: balance the parent hold in hci_bind_bis()
- Bluetooth: L2CAP: validate frame length before control and FCS access
- Bluetooth: mgmt: fix race in read_unconf_index_list()
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in
RFCOMM_CONNINFO
- smb: client: fix create context out-of-bounds reads
- smb: client: clean up failed cached directory opens
- smb: client: validate POSIX create context length
- xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption
- xfs: fix attr fork block count checks in xrep_inode_blockcounts
- xfs: release orphanage dir inode if chown fails
- xfs: use correct jiffies comparison function in xchk_maybe_relax
- xfs: check padding field in xfs_ioc_commit_range
- xfs: don't call xfs_exchange_range_finish for a dry run
- xfs: check di_forkoff correctly in scrub
- xfs: fix blockgc group quota scanning when usrquota isn't enforced
- net: tls: fix silent data drop under pipe back-pressure
- ring-buffer: Add helper functions for allocations
- ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
(CVE-2026-89503)
- sched: Rework prev_balance() to avoid stale prev references
- sched/core: Make core-sched flips wait for in-flight selections
(CVE-2026-89520)
- ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
(CVE-2026-89500)
- dmaengine: Add devm_dma_request_chan()
- i2c: mxs: fix DMA channel leak on probe error
- lockd: fix swapped arguments in nlmsvc_match_ip() (CVE-2026-93231)
- [arm64] firmware: qcom_scm: Rename peripheral as pas_id
- remoteproc: pas: Replace metadata context with PAS context structure
- remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
- power: supply: ab8500_fg: fix use-after-free on remove (CVE-2026-89797)
- [riscv64] PCI: starfive: Use regulator APIs to control the 3v3 power
supply of PCIe slots
- [riscv64] PCI: starfive: Fix resource leaks on error paths in host_init()
- iommu/msm: Use helper function devm_clk_get_prepared()
- iommu/msm: Unwind probe state on registration failure (CVE-2026-89452)
- iommufd: Pass @pasid through the device attach/replace path
- iommufd: Fix UAF in selftest IOPF reporting (CVE-2026-89445)
- [amd64] platform/x86: ISST: Check for admin capability for write commands
- [amd64] platform/x86: ISST: Validate max level for set feature
- mmc: via-sdmmc: cancel card-detect work on remove (CVE-2026-89441)
- PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder
value
- PCI: Allow per function PCI slots to fix slot reset on s390
(CVE-2026-89795)
- [amd64] platform/x86: think-lmi: Fix current password length check
- [amd64] platform/x86: think-lmi: improve check if BIOS account security
enabled
- [amd64] platform/x86: think-lmi: Fix certificate thumbprint sysfs output
- [amd64] platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
- [amd64] platform/x86: int1092: Fix potential memory leak in sar_probe()
(CVE-2026-89437)
- [amd64] platform/x86/amd/pmc: Move STB block into amd_pmc_s2d_init()
- [amd64] platform/x86/amd/pmc: Move STB functionality to a new file for
better code organization
- [amd64] platform/x86/amd/pmc: Define enum for S2D/PMC msg_port and add
helper function
- [amd64] platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init()
error
paths
- [amd64] platform/x86/amd/pmc: Propagate SMU errors and validate S2D
address (CVE-2026-81016)
- io_uring/waitid: have io_waitid_complete() remove wait queue entry
- io_uring/waitid: avoid siginfo copy during ring teardown
- power: supply: qcom_battmgr: fix use-after-free (CVE-2026-89467)
- net/smc: Address spelling errors
- net/smc: stop killed, freed and out_of_sync sharing a byte
(CVE-2026-80980)
- net/mlx5e: SHAMPO, Always calculate page size
- net/mlx5e: do not HW-GRO coalesce small frames
- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
- hwrng: drivers - Switch back to struct platform_driver::remove()
- hwrng: stm32 - Fix runtime PM cleanup on registration failure
- i3c: master: Do not treat master device as a duplicate target
(CVE-2026-93199)
- wifi: mt76: mt7915: set correct background radar capability
- wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
(CVE-2026-80937)
- i3c: master: Fix use-after-free of master->this (CVE-2026-93200)
- udf: Move udf_map_block() up
- udf: Fix data loss when converting inline inodes to out of line
- usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior
- usb: dwc3: clear forceRM when issuing EndTransfer (CVE-2026-90030)
- wifi: rtw89: cleanup unused rtwdev::roc_work
- wifi: rtw89: Hide some errors when the device is unplugged
- wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
(CVE-2026-80939)
- usb: typec: tcpm: fix debug accessory mode detection for sink ports
- usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
- wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
(CVE-2026-80935)
- xhci: Cleanup Candence controller PCI device and vendor ID usage
- usb: cdns3: rename hibernated argument of role->resume() to lost_power
- usb: cdnsp: fix wakeup from S3 after controller context loss
- usb: storage: realtek_cr: fix use-after-free on disconnect
(CVE-2026-90029)
- usb: gadget: f_mass_storage: fix null pointer dereference in
fsg_common_set_num_buffers() (CVE-2026-90023)
- staging: rtl8723bs: fix spacing around operators
- staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
(CVE-2026-90016)
- staging: sm750fb: fix mono image source stride mismatch in
lynxfb_ops_imageblit()
- tracing/probes: Fix anon_stack check for unnamed bitfields in
btf_find_struct_member
- Documentation: tracing: Add documentation about eprobes
- tracing/probes: Fix BTF kflag check for anonymous struct member access
- tracing: Clean up use of trace_create_maxlat_file()
- tracing: Take trace_array reference when opening options file
(CVE-2026-90013)
- ftrace: Take trace_array reference before accessing its ftrace_ops
(CVE-2026-90002)
- dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
(CVE-2026-89996)
- compiler_types: Move lock checking attributes to
compiler-context-analysis.h
- futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
- rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
- perf/aux: Allocate non-contiguous AUX pages by default
- [amd64] perf/x86/intel: Remove anythread_deprecated bit from
perf_capabilities
- ring-buffer: Show persistent buffer dropped events in trace_pipe file
- ring-buffer: Allow splice reads on static buffers
- nvme: add missing SRCU grace period in error path (CVE-2026-89972)
- nvme: all namespaces in a subsystem must adhere to a common atomic write
size
- nvme: refactor the atomic write unit detection
- nvme: fix atomic write size validation
- nvme: skip the zoned limits update if the zone info query failed
(CVE-2026-89971)
- [s390x] vfio-ap: Fix missing lock required to access list of
ap_matrix_mdev objects (CVE-2026-89956)
- mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
- nvdimm: preserve flush callback -ENOMEM
- nvdimm: pmem: keep PREFLUSH before data writes (CVE-2026-98161)
- nvdimm: virtio_pmem: stop allocating child flush bio
- nvdimm: virtio_pmem: always wake -ENOSPC waiters
- nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags
- nvdimm: virtio_pmem: refcount requests for token lifetime
(CVE-2026-93196)
- mtd: rawnand: pl353: Add message about ECC mode
- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw
accesses
- clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs
- mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
- [amd64] KVM: x86/mmu: Dynamically allocate shadow MMU's hashed page list
- [amd64] KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and
"back"
halves
- [amd64] KVM: x86: Extract REGS and SREGS runtime sync code to helpers
- [amd64] KVM: x86: Rename __{g,s}et_sregs2() =>
kvm_vcpu_ioctl_x86_{g,s}et_sregs2()
- [amd64] KVM: x86: Move the bulk of register specific code from x86.c to
regs.c
- [amd64] KVM: x86: Check EFER validity on KVM_SET_SREGS*
- media: i2c: imx355: Replace client->dev usage
- media: imx355: Avoid calling imx355_power_off twice in error path
- media: rkvdec: Propagate platform_get_irq() errors
- [s390x] KVM: s390: Zero initialize data structures for
inject_pfault_token
(CVE-2026-89921)
- [amd64] KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not
supported
- scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
(CVE-2026-89859)
- scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
(CVE-2026-97537)
- scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
(CVE-2026-97536)
- scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
(CVE-2026-97532)
- scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
(CVE-2026-97535)
- media: chips-media: wave5: Add timeout while stop_streaming
(CVE-2026-89868)
- scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
- scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
- scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
- scsi: qla2xxx: Skip vport under deletion in report ID acquisition
(CVE-2026-97531)
- scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
(CVE-2026-97530)
- scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity
- scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
(CVE-2026-97528)
- scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
(CVE-2026-97527)
- scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
(CVE-2026-97529)
- f2fs: validate MOVE_RANGE destination size (CVE-2026-89840)
- f2fs: convert F2FS_I_SB to sbi in f2fs_setattr()
- f2fs: don't allow unaligned truncation to smaller/equal size on pinned
file
- f2fs: fix to avoid potential section-unaligned pinfile
- f2fs: dirty directory inodes on mtime/ctime update
- f2fs: limit recovery filename logging to stored length (CVE-2026-89838)
- f2fs: fix dentry folio leak in find_in_level (CVE-2026-89837)
- f2fs: embed f2fs_gc_kthread in f2fs_sb_info (CVE-2026-93285)
- f2fs: Convert clear_node_page_dirty() to clear_node_folio_dirty()
- f2fs: fix to clear dirty flag on folio in error path (CVE-2026-89832)
- f2fs: accurately adjust free_sections during free_segment_range
(CVE-2026-97534)
- drm/amdgpu: Fix missing unwind in amdgpu_ib_schedule() error path
- drm/amdgpu: add a helper to calculate ring distance
- drm/amdgpu: plumb timedout fence through to force completion
- drm/amdgpu: avoid force-completing uninitialized UVD rings
(CVE-2026-89827)
- drm/nouveau/disp/r535: Add scanline position support + head state support
- drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
- drm/sysfb: simpledrm: Improve panel-size validation
- drm/sysfb: simpledrm: Improve stride validation (CVE-2026-93244)
- firmware: sysfb: Move bpp-depth calculation into screen_info helper
- drm/sysfb: simpledrm: Improve framebuffer-size validation
- drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
(CVE-2026-89806)
- drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
- configfs:get_target() - release path as soon as we grab configfs_item
reference
- configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
(CVE-2026-97950)
- tracing: Fix memory corruption from a "STACKTRACE" histogram key
(CVE-2026-97934)
- ipmr: account multicast table and route memory (CVE-2026-97939)
- sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
- reboot: fix cad_pid use-after-free race (CVE-2026-97938)
- configfs: unhash the dentry before dropping the item in rmdir
(CVE-2026-97949)
- tracing: Constify struct event_trigger_ops
- tracing: Remove get_trigger_ops() and add count_func() from trigger ops
- tracing: Merge struct event_trigger_ops into struct event_command
- tracing: Set the trace clock before registering the histogram trigger
(CVE-2026-97935)
- virtio-mmio: Remove virtqueue list from mmio device
- virtio_mmio: disable IRQ wake before free_irq
- tools/bootconfig: Cleanup bootconfig footer size calculations
- tools/bootconfig: Fix integer overflow and truncation in size checks
- tracing: Take trace_array reference when opening a tracer options file
(CVE-2026-97933)
- tracing: Take the reference before publishing the named histogram trigger
(CVE-2026-97919)
- tracing: Undo the registration when enabling the histogram trigger fails
(CVE-2026-97918)
- EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout
- EDAC/altera: Use parent device for devres in altr_portb_setup()
- genetlink: pin family module during policy dump (CVE-2026-97901)
- drm/bridge: tc358768: Enforce input bus flags via atomic_check
- io_uring/rw: end write accounting from ->ki_complete (CVE-2026-97619)
- io_uring/net: don't overconsume buffers when using MSG_TRUNC
(CVE-2026-97618)
- bootconfig: Fix integer overflow in initrd size check (CVE-2026-97906)
- net: bridge: use option bits for CFM/MRP frame handlers (CVE-2026-97615)
- drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches
(CVE-2026-97620)
- netfilter: cttimeout: detach dataplane timeout policy and repurpose
refcount (CVE-2026-74347)
- netfilter: cttimeout: prevent UAF during module unload (CVE-2026-97609)
- net: macb: Replace open-coded implementation with napi_schedule()
- net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX
NAPI
- net: macb: unify device pointer naming convention
- net: macb: initialize PTP state before registering clock
- erofs: add sysfs feature entry for xattr prefixes
- [amd64,arm64] idpf: Fix kernel-doc descriptions to avoid warnings
- [amd64,arm64] idpf: introduce idpf_q_vec_rsrc struct and move vector
resources to it
- [amd64,arm64] idpf: disable DIM work before freeing q_vectors
(CVE-2026-97603)
- ipv6: make ipv6_pinfo.saddr_cache a boolean
- ipv6: reorganise struct ipv6_pinfo
- ipv6: Move ipv6_fl_list from ipv6_pinfo to inet_sock.
- ipv6: flowlabel: cap duplicate leases per socket (CVE-2026-97597)
- landlock: Clarify documentation for the IOCTL access right
- landlock: Fix use-after-free of the source's parent directory
(CVE-2026-97594)
- netmem: add a couple of page helper wrappers
- net: page_pool: rename page_pool_alloc_netmem to *_netmems
- page_pool: disable sync for cpu for dmabuf memory provider
- bnxt_en: Propagate TPA buffer allocation failures in
bnxt_queue_mem_alloc() (CVE-2026-97571)
- mptcp: pm: drop match in userspace_pm_append_new_local_addr
- sock: add sock_kmemdup helper
- mptcp: use sock_kmemdup for address entry
- mptcp: pm: userspace: fix address ID overflow
- bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
- eth: bnxt: store rx buffer size per queue
- bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
- bnxt_en: Don't free the live ring's TPA state on queue restart failure
(CVE-2026-97574)
- mptcp: pm: reset retrans_time when ADD_ADDR entry is reused
- mptcp: pm: use for_each_subflow helper
- mptcp: pm: rename add_entry structure to add_addr
- mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0
(CVE-2026-97566)
- tcp: introduce icsk->icsk_keepalive_timer
- mptcp: do not reschedule the RTX timer for fallback sockets
- smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl()
- smb/client: fix security flag calculation when setting security
descriptors
- smb: client: fail DACL rewrite when the new DACL exceeds 64K
(CVE-2026-97559)
- xfs: report healthy filesystem events in scrub stats
- xfs: fix short ifork reaping computation in xreap_bmapi_binval
- xfs: strengthen the "is cow staging" helpers in scrub
- xfs: remove the i_ino field in struct xfs_inode
- xfs: fix under-reservation of blocks when repairing sf directories
(CVE-2026-97549)
- xfs: fix backwards mergeability logic in refcount scrubber
- cifs: Fix specification of function pointers
- 9p: Fix v9fs_issue_write() to update i_size and remote_i_size
- [arm64] phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context
- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb
handling
- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
- swiotlb: use the adjusted address for the highmem page lookup
- net: phy: mediatek: do not report link and per-speed LED rules together
- btrfs: take commit root semaphore when iterating in
mark_block_group_to_copy()
- [arm64] Use load LSE atomics for the non-return per-CPU atomic operations
- [arm64] percpu: Fix LSE operations on {8,16}-bit types
- [arm64] i2c: qcom-cci: Stop complaining about DT set clock rate
- [arm64] i2c: qcom-cci: Remove the unused variable cci_clk_rate
- [arm64] i2c: qcom-cci: fix device_node refcount leak in
cci_probe()/cci_remove()
- scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU
- Input: hp_sdc - shut down kicker timer on module exit
- wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
- hwmon: (pwm-fan) Stop RPM timer before freeing tach data
- drm/msm/dpu: clear pending peripheral flush state
- wifi: libipw: reject TKIP frames without a full MIC
- wifi: mac80211: track MU-MIMO configuration on disabled interfaces
- wifi: mac80211: refuse to make a monitor active when it has no queue
- smb: mark the new channel addition log as informational log with
cifs_info
- smb: client: fix use-after-free of iface in cifs_try_adding_channels()
- drm/amdgpu: Failed to check various return code
- drm/amdgpu/umsch: remove vpe test from umsch
- drm/amdgpu: use GFP_NOWAIT for memory allocations
- drm/amdgpu: fix rmmio iounmap skipped on device removal
- smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
- drm: add drm_memory_stats_is_zero
- drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments
- smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
- smb/client: send lease break ACKs thru correct session for multiuser
mounts
- [arm64] boot: Disable trapping of PMZR_EL0 writes to EL2
- vlan: require the MAC header to be present in __vlan_insert_inner_tag()
- gpio: cdev: fix kernel stack leak to user-space in error path
- ipe: fix use-after-free when auditing a newly loaded policy
- bna: prevent IOC timer rearm during teardown
- i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
- drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
- drm/client: Pass force parameter to client restore
- drm/client: fix restore of partially initialized client
- [amd64] drm/i915/mst: add mst sub-struct to struct intel_dp
- [amd64] drm/i915/dp_mst: Fix configuring FEC for a disconnected stream
- mm/rmap: allocate anon_vma_chain objects unlocked when possible
- mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma
publish
- drm/xe/vm: nuke PTs only after unlinking contested VMAs
- mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
- mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
- mm/hugetlb: create hstate_is_gigantic_no_runtime helper
- mm/hugetlb: do not dissolve gigantic pages without runtime support
- super: make iterate_supers_type() deletion-safe
- PCI: Fix Resizable BAR restore order
- PCI: Fix BAR resize for devices on a root bus
- packet: use ubuf_info completion for TX_RING packets
- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
- HID: alps: unregister DualPoint Stick input device on remove
- net/sched: act_ct: fix helper UAF due to extensions realloc
- net/sched: act_ct: avoid modifying shared unconfirmed ct entry
- net: ipconfig: Remove outdated comment and indent code block
- net: ipconfig: bound DHCP option construction
- net: ena: Remove autopolling mode
- net: ena: fix MMIO read buffer leak on probe failure
- [amd64] perf/x86/intel: Update event constraints and cache_extra_regsfor
LNL
- [amd64] perf/x86/intel: Remove incorrect LionCove PEBS data-source
constraints
- [amd64] perf/x86/intel: Update event constraints and cache_extra_regsfor
ADL
- [amd64] perf/x86/intel: Fix GRT PEBS load/store direction for latency
events, to fix sample classification
- [riscv64] KVM: Fix null pointer dereference in
kvm_riscv_aia_imsic_rw_attr()
- [riscv64] KVM: Serialize IMSIC attributes with vCPU migration
- rose: fix dev_put() leak in rose_loopback_timer()
- rose: hold loopback neighbour reference across timer callback
- rose: fix race between loopback timer and module removal
- rose: clear neighbour pointer after rose_neigh_put() in state machines
- rose: guard rose_neigh_put() against NULL in timer expiry
- rose: fix netdev double-hold in rose_rx_call_request()
- rose: fix notifier unregistered too early in rose_exit()
- rose: fix netdev double-hold in rose_make_new()
- rose: drop CALL_REQUEST in loopback timer when device is not running
- rose: cancel neighbour timers in rose_neigh_put() before freeing
- nvme: revert the cross-controller atomic write size validation
- bootconfig: Fix negative seeks on 32-bit with LFS enabled
- tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection
- mtd: rawnand: pl353: Fix debug prints
- [amd64] platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init
fails
- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due
to
race condition
- bpf: Reject key-less BTF for hash maps
- mm/hugetlb: keep max_huge_pages when dissolving surplus folios
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.113
- smb: client: fix OOB read/write from unvalidated DataOffset in
coalesce_t2() (CVE-2026-89633)
- smb: client: fix cifsFileInfo reference leak in deferred close
(CVE-2026-97558)
- [arm64] KVM: arm64: nv: Fix life cycle of the nested_mmus array
- [arm64] KVM: arm64: nv: Delay freeing of shadow S2 structures until VM
destruction
- smb: client: use finish_no_open() for non-regular inodes
- xfs: don't let memory failures leak blocks and kill repairs
- [riscv64] KVM: Fix null pointer dereference in
kvm_riscv_aia_imsic_has_attr()
- bpf, xdp: move offload check into dev_xdp_install() (CVE-2026-90146)
- ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture
- Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
- ASoC: SOF: ipc4-priv: Add kernel doc for fw_context_save of
sof_ipc4_fw_data
- ASoC: SOF: ipc4/Intel: Add support for library restore firmware
functionality
- smb/client: use stack-allocated smb2_file_all_info in
smb3_query_mf_symlink()
- smb/client: pass cifs_open_info_data to SMB2_open()
- smb: client: close handle after create-context parsing failure
- Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
- Bluetooth: ISO: release unused CIS holds after channel attach
- smb: client: close completed creates on compound wait errors
- xfs: fix cursor and pointer handling when recovering iunlink buckets
- neighbour: Skip default parms when resumed in neightbl_dump_info().
- ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
- audit: fix exe mark UAF in kill_rules()
- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
- kprobes: Skip disarmed probes when checking optkprobe overlap
- of/irq: Fix remaining refcount leaks in of_irq_init()
- of/overlay: put property on deadprops only after changeset add succeeds
- of/overlay: only treat a positive changeset id as registered
- net: fix checksum offsets in skb_splice_from_iter()
- netfilter: nft_flow_offload: drop flowtable reference on init error path
- net/packet: prevent TX_RING byte count overflow
- rtc: ac100: Assign .num before accessing .hws
- rtc: spear: initialize IRQ state before requesting alarm IRQ
- sctp: check RCV_SHUTDOWN after the sendmsg connect wait
- tpm: Disable TPM on null key name mismatch
- virt: vmgenid: set driver_data before registering notification handlers
- smb: client: clear setuid/setgid bit on write with
cifsacl/modefromsid/posix extensions (CVE-2026-89638)
- rds_tcp: close NULL deref window in rds_tcp_set_callbacks
- vt: skip screen update for DEC alignment test on backgroup consoles
- wifi: wlcore: Fix runtime PM leak in wlcore_remove()
- ALSA: caiaq: unregister the input device when probe fails
- ALSA: line6: reject oversized playback packets
- mm/secretmem: properly account locked pages (CVE-2026-93243)
- perf/core: Fix WARN in perf_sigtrap()
- random: vDSO: avoid call to memset() when zeroing reserved parameter
- mm/damon/core: don't skip damos_adjust_quota() while esz is not zero
- iio: accel: kionix-kx022a: Fix array boundary check
- mtd: core: call _get_device() with the master MTD
- nvmet: preserve device path on allocation failure
- random: fix vgetrandom_opaque_params kernel-doc
- of/overlay: don't leak fragment references when changeset init fails
- of/overlay: don't create "//" paths for fragments targeting the root
- ASoC: wm8903: Move the DRC QR threshold to the register that holds it
- wifi: wfx: validate MIB read length before copying to caller
- ASoC: tegra: Fix ASRC Stream6 input threshold control
- wifi: ath11k: reset ar->num_stations on hardware start
- wifi: ath9k: reject short WMI command responses
- wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
- rtc: Switch back to struct platform_driver::remove()
- rtc: ac100: Fix clock provider use-after-free on probe failure
- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
- wifi: cfg80211: preserve hidden-group beacon IE ownership
- wifi: mac80211: Add multicast to unicast support for 802.3 path
- wifi: mac80211: Add 802.3 multicast encapsulation offload support
- wifi: mac80211: prevent AP VLAN tx from other interfaces
- ASoC: codecs: rt286: Revert delay value for jack setup
- ASoC: codecs: rt274: Fix format setting for 44100 rate
- Bluetooth: hci_core: free the HCI ID if naming fails
- Bluetooth: btintel: validate DDC record lengths
- net/mctp: publish the mctp_dev only after it is initialised
- net/sched: cls_api: reclaim an empty proto on the error path
- ipv6: fix prefix route expiry in modify_prefix_route()
- netfilter: ipset: do not update comments from kernel-side adds
- Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
- net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
- net: systemport: Fix RUNT MIB counter register offset calculation
- net/mlx5: LAG, Refactor lag logic
- net/mlx5: Fix slab-out-of-bounds when handling team device events
- octeontx2-af: mcs: Fix SC resource cleanup loop
- tipc: prevent GCM nonce reuse on peer key changes
- memcg: convert memcg->socket_pressure to u64
- mptcp: Fix up subflow's memcg when CONFIG_SOCK_CGROUP_DATA=n.
- net: Clean up __sk_mem_raise_allocated().
- net-memcg: Introduce mem_cgroup_from_sk().
- net-memcg: Introduce mem_cgroup_sk_enabled().
- net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
- net/sched: fq_codel: match the no-drop threshold to the packet size
- net/sched: sch_codel: match the no-drop threshold to the packet size
- virtio_blk: set the zone write granularity
- net: bcmgenet: fix NULL dereference in set_coalesce before first open
- net: cap skb->queue_mapping when the tx queue is picked
- net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
- tcp: refresh TS.Recent for accepted old ACKs
- ipvs: fix missing counter decrement in lblc
- ipvs: do not create invisible templates
- ipvs: filter some flags received in the backup server
- netfilter: bpf: reject invalid NAT manipulation types
- netfilter: conntrack: remove skb argument from nf_ct_refresh
- netfilter: conntrack: rework offload nf_conn timeout extension logic
- netfilter: flowtable: generalize pending status bit
- net: microchip: vcap: stop scanning after deleting key field
- net: sparx5: make ports inherit the switch base mac address type
- net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
- ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
- xdp, xsk: constify read-only arguments of some static inline helpers
- net: mvneta: clear XDP pfmemalloc flag between frames
- i2c: at91: release DMA channels when probe defers
- perf: Fix race between perf_event_exit_task() and perf_pending_task()
- ALSA: core: Define auto-cleanup for snd_card_free()
- ALSA: ice1712: Fix the error handling via auto-cleanup at probe
- PCI: Accept AtomicOps already enabled by the hypervisor
- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
- drm/amd/pm/si: Fix updating clock limits on AC/DC
- drm/amdgpu/gfx6: fix firmware leak on teardown
- drm/radeon: Read the VRAM VBIOS signature with readb()
- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
- drm/mediatek: Fix ovl adaptor platform device leak
- drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
- drm/amdgpu: fix IP instance memory leak on kobject add failure
- drm/amdgpu: fix ACP MFD device leak on init failure
- binder: fix is_failure flag for superseded transaction cleanup
- binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
- kgdboc: Fix tty driver reference leak in configure_kgdboc()
- Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
- Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
- Input: s6sy761 - fix resume ordering and restore sensing
- Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
- Input: synaptics - limit T440p InterTouch quirk to LEN0036
- nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
- [arm64] soc: qcom: geni-se: Correct QUP Core ICC vote constants
- USB: cdc-acm: fix racy TIOCMIWAIT implementation
- USB: cdc-acm: skip URB restart in port_shutdown if disconnected
- USB: serial: fix port tear down use-after-free
- usb: storage: sierra_ms: reject short SWoC info transfers
- usb: hub: use shorter 120ms post resume hold for SS root hubs
- usb: octeon-hcd: fix the FIFO-flush timeout computation
- usb: ohci-da8xx: disable controller wakeup on cleanup
- usb: ohci-s3c2410: disable controller wakeup on removal
- usb: ohci-st: disable controller wakeup on removal
- usb: gadget: midi2: Fix the jack descriptor array sizes
- usb: gadget: f_uac1_legacy: validate bRequest index in
generic_{set,get}_cmd
- usb: typec: anx7411 - stop the IRQ before destroying the workqueue
- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path
- usb: gadget: aspeed-vhub: cancel wake work on device removal
- USB: gadget: dummy-hcd: Fix wait for outstanding request completions
- usb: gadget: f_fs: Fix NULL pointer dereference in
FUNCTIONFS_ENDPOINT_DESC
- usb: chipidea: tegra: disable runtime PM on resume failure
- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
- usb: typec: tcpm: recover after failure to start the frs ams
- usb: typec: tipd: don't send GAID when probe fails in APP mode
- usb: typec: tipd: fix uninitialized typec_partner_desc in
tps6598x_connect()
- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
- usb: typec: ucsi: Get the connector fwnode based on reg value
- usb: typec: ucsi: displayport: Current CAM OOB index fixup
- usb: cdns3: fix use-after-free in cdns3_gadget_exit()
- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
- tty: vt: fix memory leak in vc_allocate()
- tty: amiserial: fix broken TIOCMIWAIT
- tty: vcc: zero-initialize control packet in vcc_send_ctl()
- tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
- tty: abort break signalling on hangup
- tty: serial: max3100: shut down timer before freeing port
- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
- serial: fix TIOCMIWAIT race
- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
- serial: tegra: don't clear the Tx FIFO on an Rx-only reset
- serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around
- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL
- ASoC: codecs: max98363: fix uninitialized stream_config->type
- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
- ALSA: seq: Serialize compat port-info ioctls
- ALSA: ua101: reject mismatched capture/playback packet sizes
- EDAC/altera: Fix memory leak on dci allocation failure
- i2c: xiic: don't clobber msg->len to signal block-read completion
- Bluetooth: RFCOMM: Fix initial port reference race
- Bluetooth: hci_sync: Fix inquiry cache use-after-free
- Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
- Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
- Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
- Bluetooth: hci_core: Serialize fragmented ISO packet queueing
- Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
- Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
- Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
- io_uring: fix task_work add use-after-free with SQPOLL
- ipvs: bound LBLCR and LBLC cache growth
- HID: multitouch: stop the release timer from being rearmed on remove
- net: ext2end IPv6 exthdr detection of tunneled packets
- tpm: fix off-by-four bounds check in tpm2_get_random()
- nvme-multipath: fix underflow in ANA log bounds checks
- nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT
- nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
- mtd: block2mtd: Fix divide error when erase_size is zero
- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of
OOB
- mtd: spinand: fix zero oobavail when no ECC engine is used
- [amd64] KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are
modified
- [amd64] KVM: x86/mmu: Bail from shadow walks if the root is invalid or a
dummy
- wifi: cw1200: fix TX padding OOB read leaking heap data to device
- wifi: iwlegacy: 3945: free EEPROM data on remove
- wifi: mac80211: keep paired old chanctx alive
- wifi: mac80211: drain PS delivery work during station teardown
- wifi: mac80211: account proxy paths against the mesh path limit
- wifi: mac80211: keep fallback association elements alive
- wifi: mac80211: minstrel_ht: validate fixed rate index
- wifi: mac80211: reject invalid 320 MHz CSA bandwidth
- wifi: mac80211: release mesh path quota on failed additions
- wifi: mac80211: fix mesh fast xmit path deletion UAF
- wifi: mac80211: handle empty FILS association request payload
- USB: serial: cp210x: add Corsair AX1500i Power Supply
- USB: serial: quatech2: fix baud rate overflow
- USB: serial: ssu100: fix baud rate overflow
- USB: serial: fix dynamic id driver deregistration race
- USB: serial: fix driver deregistration order
- USB: serial: fix ioctl hangup race
- USB: serial: option: add support for SIMCom SIM8260C
- USB: serial: option: add Quectel EG060W
- USB: serial: option: add Compal EXM-G1x support
- USB: serial: option: add Quectel RG660QB
- USB: serial: option: add Compal EXC-T1 support
- [amd64] thunderbolt: Fix KASAN reported use-after-free when request is
canceled
- [amd64] thunderbolt: Disable CL states for the Anker Prime TB5 dock
- [amd64] thunderbolt: Reject oversized XDomain properties responses
- smb: client: discard post-EOF pagecache when extending a file via zero
range
- smb: client: discard post-EOF pagecache when extending a file via copy
range
- smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
- iio: accel: kxcjk-1013: reject duplicate event disable
- iio: accel: sca3000: fix frequency divider condition check
- iio: adc: pac1934: check ACPI label duplication
- iio: adc: stm32-adc: fix check on internal channel availability
- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on
unbind
- iio: admv1013: initialize callback mutex before registering notifier
- iio: buffer: serialize buffer teardown with mode claims
- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
- iio: frequency: admv1013: fix wrong channel field used in
admv1013_read_raw()
- iio: gyro: adis16136: fix unprotected debugfs reads
- iio: health: max30102: fix NULL dereference in interrupt handler
- iio: imu: adis16400: fix unprotected debugfs reads
- iio: imu: adis16480: fix unprotected debugfs reads
- iio: light: gp2ap020a00f: drain irq_work after free_irq
- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency
lookup
- iio: proximity: aw96103: validate firmware data length
- iio: proximity: isl29501: Fix return type of isl29501_register_write
- iio: proximity: pulsedlight: fix iio_device left registered on PM setup
failure
- iio: proximity: sx9324: Correct proximity channel resolution
- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
- iio: trigger: cancel reenable_work before freeing trigger
- ipv6: use RCU in ip6_output() (CVE-2025-40158)
- jfs: fix array-index-out-of-bounds read in add_missing_indices
(CVE-2025-38204)
- [arm64] KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT
save (CVE-2026-89912)
- svcrdma: Use svc_xprt_put to free listener on create failure
(CVE-2026-89527)
- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
(CVE-2026-93179)
- console: introduce console_lock guard()s
- tty/vt: use guard()s
- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
- mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
- mptcp: prevent race between disconnect() and rtx (CVE-2026-97567)
- pfcp: fix socket lifetime on netdevice registration failure
- netfs: clear post-EOF pagecache when extending a file via write
- mm: shmem: remove __shmem_huge_global_enabled()
- mm: factor out the order calculation into a new helper
- mm: shmem: change shmem_huge_global_enabled() to return huge order bitmap
- mm: shmem: ignore sysfs configs for shmem forced collapse
- [arm64] KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor
- cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1
- net: usb: qmi_wwan: add Quectel EG120K-EA
- xen/netfront: drop RX packets with a short Ethernet header
(CVE-2026-98375)
- fs,fsverity: reject size changes on fsverity files in setattr_prepare
- fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
- drm/amd/display: Fix fast updates on DCE 8.1
- usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
- tty: fix saved termios reset race
- perf: Remove unnecessary parameter of security check
- perf/core: Check kernel access when kernel callchains are requested
- perf: Require kernel access for text poke events
- [arm64] fpsimd: signal: Clear PSTATE.SM when restoring FPSIMD frame only
- [arm64] fpsimd: signal: Mandate SVE payload for streaming-mode state
- [arm64] fpsimd: signal: Consistently read FPSIMD context
- [arm64] fpsimd: signal: Forbid non-streaming SVE payload on SME-only
systems
- Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
- Bluetooth: Serialize SMP remote OOB data access
- [arm64] errata: Factor out broken AMU const counter cap
- [arm64] errata: Add Cortex-A725 erratum 3821522 workaround
- [arm64] KVM: arm64: Use stage-1 leaf size for VM_PFNMAP
- fsverity: add dependency on 64K or smaller pages
- drm/amdgpu: reset VI ASIC on MacBookPro15,1
- drm/amdgpu: reset VI ASIC on MacBookPro14,3
- usb: ohci-spear: Remove unnecessary NULL check before
clk_disable_unprepare()
- usb: ohci-spear: disable controller wakeup on removal
- USB: dwc2: shut down wakeup timer before freeing HCD state
- drm/amd/display: Preserve eDP mode on initial ASSR failure
- usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
- tty: introduce tty_port_tty guard()
- tty: tty_port: use guard()s
- tty: tty_port: restore TTY_IO_ERROR on activation failure
- tty: n_gsm: fix missing modem controls after DLCI open in convergence
layer type 2
- perf: Replace perf_event_header__init_id with full header init
- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194
- i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume
to facilitate atomic mode
- i2c: xiic: preserve PEC byte length in SMBus block read setup
- drm/amd/display: Mark DCE 6.4 as not APU
- mtd: spinand: fix NULL pointer dereference with no ECC engine
- wifi: mac80211: shut down RX BA session timer on teardown
- mtd: spinand: Enable QE on all dies
- nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
- [arm64] KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
- ipv4: free inet_opt and ireq_opt after an RCU grace period
(CVE-2026-98432)
- bnxt_en: fix DMA mapping length for padded small packets
(Closes: #1149564)
- tty: port: fix tty_port_tty_vhangup() race
- wifi: mac80211: count only matching reservations in reserved switch
- fs: Free any excess xarray nodes in clear_inode()
- net/mlx5e: Prevent stale XSK buffer release on refill retry
- net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
- net: mana: Skip WQ object destruction for uninitialized RXQ
- net: mana: remove double CQ cleanup in mana_create_rxq error path
- [amd64] KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR
is
intercepted
- wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()
- wifi: mac80211: set info->band for 802.3 encap offload frames
- iio: accel: kx022a: Use cleanup.h helpers
- iio: accel: kionix-kx022a: Prevent memory leak and fix state
- iio: adc: ad_sigma_delta: fix use-after-free on unbind
- iio: adc: aspeed: Simplify with dev_err_probe
- iio: adc: aspeed: propagate reset deassert errors
- iio: adc: max1363: sign-extend bipolar differential channel reads
- iio: adc: axp288: Add TS bias override for Haier HV103H
- iio: adc: stm32-adc: fix possible division by zero in processed channel
- smb: client: only require read lease for size-extending preallocate
- iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs
- iio: cdc: ad7150: fix OF matching and publish module aliases
- iio: bu27034: simplify using guard(mutex)
- iio: light: rohm-bu27034: Fix infinite delay on error
- iio: light: rohm-bu27034: Fix error return
- tools: ynl-gen: use names of constants in generated limits
- tools: ynl-gen: support limits using definitions
- tools: ynl: add scope qualifier for definitions
- doc/netlink: netlink-raw: Add max check
- f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
- f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
- f2fs: fix to reset all pinned status during fggc
- mm/damon/core: do non-safe region walk on kdamond_apply_schemes()
- mm/damon/core: fix unconditionally skip last region
- Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING
- wifi: ath12k: fix reusing m3 memory
- crypto: drbg - Fix ineffective sanity check
- ipv4: validate checksum_start before completing checksum (CVE-2026-99999)
- ipv4: stop PMTU walk when nexthop group shrinks
- ipv4: stop exception dump when nexthop group shrinks
- ipv4: stop route notification sizing when nexthop group shrinks
- ipv4: do not warn on route notification size race
- ipv6: do not warn on route notification size race
- Input: ati_remote2 - fix type confusion in device attribute handlers
- Input: xpad - add support for Corsair Novablade Pro
- arm64: irq: exclude the softirq stack switch from KCOV
- [amd64] ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
- btrfs: scrub: fix local_root reference leak in
scrub_print_warning_inode()
- cipso: adjust cached option offsets when removing CIPSO
- dm ioctl: don't let data_start run past the buffer
- usb: f81604: fix struct f81604_int_data size mismatch
- vsock/virtio: account only unread bytes in read_skb()
- wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
- wireguard: queueing: preserve tstamp_type when encapsulating packet
- wireguard: noise: reject response consumption after intermediate
initiation
- workqueue: Fix NULL current_pwq deref in chained work check
- xen/netfront: don't leak the skb when xennet_fill_frags() fails
- tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
- strparser: make sure __strp_recv isn't running before tearing down the
parser
- swiotlb: fix default_swiotlb_limit() for non-growable default pool
- tcp: reject net_iov in zerocopy receive mapping hints
- tipc: destroy topsrv workqueues before closing connections
- tipc: hold a reference to nodes found by link name
- Revert "wifi: libertas: reject short monitor TX frames"
- selinux: fix data race on AVC latest_notif
- selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
- sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when
!streamoute
- [amd64] EDAC/amd64: Mask UMC chip select to the four implemented selects
- gpio: xilinx: fix runtime PM leak on request error path
- ibmveth: h_free logical LAN on open-fail after register
- ibmveth: fix TX LTB and filter unwind on open-fail
- ice: fix metadata_dst refcount handling on representor teardown
- keys: finalize persistent keyring timeout after link attempt
- KEYS: Fix add_key() race with keyring restriction
- memstick: core: wait for request completion before freeing card
- memstick: rtsx_usb_ms: complete requests after eject instead of dropping
them
- dm-crypt: reject the lmk IV mode with AEAD ciphers
- dm-snap: reject the transient exception store for snapshot-merge
- dm: fix reading free memory in do_resume
- mmc: cavium-octeon: destroy slot platform devices on remove
- mmc: cavium-thunderx: destroy slot platform devices on remove
- mmc: mtk-sd: Cancel request timeout work on remove
- mmc: sdhci-sprd: disable runtime PM on remove
- net/packet: guard the ll header push in packet_rcv_spkt()
- net/smc: protect clcsock lifetime in smc_getname
- net: bridge: avoid recursive multicast port cleanup
- net: dsa: microchip: fix KSZ8765 fiber detection
- net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
- net: sparx5: free the matchall entry on destroy
- net: usb: ax88179_178a: fix rx frame length for non-last packets
- nvme: fix swapped ZRASF zone state values for full and read only
- openvswitch: fix soft lockup in the netlink flow dump
- optee: register TEE devices only once fully initialized
- regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
- regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
- pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
- pmdomain: rockchip: don't ignore clock lookup errors on attach
- pmdomain: rockchip: fix clock leak on domain probe failure
- pmdomain: rockchip: propagate subdomain add errors
- scsi: qedi: Initialize callback state before registration
- [riscv64] entry: gate shadow call stack reload on sstatus.SPP, not tp
- [riscv64] fix load_unaligned_zeropad() fixup for RV32
- Bluetooth: btintel_pcie: use managed IRQ teardown
- Bluetooth: hci_sock: Serialize dead-device detachment
- Bluetooth: ISO: Reject concurrent BIS listener setup
- Bluetooth: ISO: Serialize concurrent connect calls
- Bluetooth: MGMT: Fix status of pending commands flushed on power off
- Bluetooth: RFCOMM: free the skb when the DLC has no owner
- Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
- drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
- drm/gud: don't keep a connector without a CRTC as connector_state
- [amd64] drm/i915/gem: Prevent overstepping exec array boundary
- [amd64] drm/i915/gt: Unmask interrupts only when ACTIVE is true
- drm/imagination: Size page table preallocation by device address
- drm/vc4: drain the hangcheck timer and works on V3D unbind
- drm/amdkfd: align SDMA doorbell base for shader doorbell writes
- drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
- drm/amdgpu: serialize vblank counter reads against GPU reset
- drm/amdgpu: make Mac FB workaround generic
- drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
- drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
- namespace: don't copy an unmounted mount tree
- fs: refuse fspick() on internal superblocks
- namespace: check a submount for references right before unmounting it
- dcache: don't put a mountpoint on a dentry that's being removed
- namespace: don't let a pseudo dentry become the root of a mount
- namei: don't reveal overmounted entries in refwalk
- namespace: refuse an automount below a mount that is in no namespace
- [arm64] dts: lx2160a: fix incorrect pinmux
- [arm64] dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
- [arm64] dts: lx2160a: fix the iic5 spi3 pinmux offset and value
- Bluetooth: btintel_pcie: fix TX descriptor bounds check
- Bluetooth: btintel_pcie: Add recovery mechanism
- Bluetooth: btintel_pcie: Add shared HW reset for clean start
- drm/dp: don't mark the AUX backlight enabled when enabling failed
- gpio: exar: initialize the ID before registering its cleanup
- drm/aspeed: Balance the display clock enable on teardown
- drm/vc4: Free the BO cache size list on teardown
- net/sched: em_text: reject unterminated algo before autoload
- amt: send the relay's General Query directly from the receive path
- cxgb4/ch_ktls: disable softirqs around tid_list erases
- optee: sync secure world ABI headers
- [arm64] tee: optee: ffa: support shared memory offsets on large-page
kernels
- nvmet: use the local P2P device on metadata allocation failure
- [arm64] boot: Don't set PMUv3p9 FGT2 bits without PMUv3
- btrfs: fix xattr replace when multiple xattrs are packed in the same item
- wifi: mt76: mt7925: restore the legacy BSS after MLO teardown
- wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
- wifi: mt76: mt7915: disable rx napi when removing device
- wifi: mt76: mt7925: don't put the band auto marker in TGID
- wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
- wifi: mt76: mt792x: pick the SAR table layout from the table itself
- ASoC: adau1372: allow sleepy powerdown GPIOs
- ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
- ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
- cpuset: separate tmpmasks and cpuset allocation logic
- cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in
cpuset_handle_hotplug()
- flow_dissector: avoid u16 truncation of skb->len when computing thoff
- devlink: fix devlink_rel reference leak when notify work is pending
- net/sched: cls_route: reject change with no routing attribute
- pfcp: make sure the SEID is linear before reading it
- bnxt_en: Add bnxt_clear_bars() helper
- bnxt_en: Fix driver init in kdump kernel
- flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
- drm/imagination: Fix reference and vm_bo handling in remap()
- veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
- net/mlx5e: Order ICOSQ cc update after CQ doorbell
- mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
- ptp: ocp: fix PCIe delay estimation calculation
- net: openvswitch: validate transport header presence in set_ipv6_addr
- vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
- drm/vc4: Make v3d paths unavailable on any generation newer than vc4
- drm/vc4: Fix binner slot allocation failing on an idle GPU
- drm/panthor: validate userspace queue count against initialized firmware
slot count
- io_uring/waitid: use io_waitid_remove_wq() consistently
- io_uring/waitid: fix KCSAN warning on io_waitid->head
- netfilter: conntrack: fix erronous removal of offload bit
- netfilter: flowtable: fix offloaded ct timeout never being extended
- wifi: mt76: mt7603: initialize global station WCID
- can: fix unique skb identifier regression under RPS
- drm/amd/display: Don't replace a sink mode that shares the native totals
- sched_ext: Generate qseq from a per-task counter
- HID: steam: Fully unregister controller when hidraw is opened
- HID: steam: Rearrange teardown sequence
- HID: steam: Refactor registration
- HID: steam: Clean up locking
Checksums-Sha1:
d679ca71370b2510c3f120ca452503d8d51a9967 290418 linux_6.12.113-1.dsc
906275a30c7581f5f23681ae935dfa88fb1aa0a1 151589656 linux_6.12.113.orig.tar.xz
5b62a04c2fd924f77eef7c497d8b4b4f7e4c9d73 1954984 linux_6.12.113-1.debian.tar.xz
f387a6456c403e8ee95d2ffd983edba06865c59a 5884 linux_6.12.113-1_source.buildinfo
Checksums-Sha256:
7785e2db803dc74912f2dd4861eb454404cf3b9a2c2120f0cc3efda1f2337fa6 290418
linux_6.12.113-1.dsc
2efc477744741f5d580a199ee79c251abb01f899759c621d1af0c3d361380821 151589656
linux_6.12.113.orig.tar.xz
e2d62aaf6d3771dce7116feea9c419b47d6bbf8cb957153896fbbc276f2a54f9 1954984
linux_6.12.113-1.debian.tar.xz
1e8ac52ec78b76cbe8a732934e81ffaf23f19f32effe82471dbdaa984b99424c 5884
linux_6.12.113-1_source.buildinfo
Files:
45df6d3b14bf56238e10cf8f4a980cc2 290418 kernel optional linux_6.12.113-1.dsc
6455c13db94c8767c0d4f17ec98c8c9d 151589656 kernel optional
linux_6.12.113.orig.tar.xz
718d6afd37f0fbef1c50a451aa7717ba 1954984 kernel optional
linux_6.12.113-1.debian.tar.xz
4c1403f1ea9a45951b51a1b5f35ab69e 5884 kernel optional
linux_6.12.113-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrQ68tfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E+vkP/RaBZxxLc7W/4gGaIX9V++T5huA2z6Fu
gpguVBeXuG/vudO9z95yEyG/xHpvIWRaQ5CLKvgFDFrb+dwaSZFdO2rFoL8263Z0
1mqk5NrY57E1vctun/Rldf6b/JmSvK73uZNxKveL+KBywz8eRlPqtn0wm2qEI/qf
/4OMYfbmKYlGBxbDrvP5qWOOTXbQ5ddktQH9f7wFAijfTi7OjNo01+NwAdRppGPt
R1HHeny5u9J533/i+vWbyyjfmkbBJW3YOLwb9gNo31JF1VC/panIb8hN5NOkonf0
Uie7fSHzY+bPcG0cRRNbE+InucIPhwOsD/W07C+tJCQs6pj6z3qQN1zViY60jTlN
0wH80pJAugq+/oidKSFrq8sWdedKlIG3iK45emAnEMFe+XJHAkiU87Uvcr1D4t+d
UdAtiUudUpToucVUEBVxoaBbE0LltKUD16xrmp93DC4VSmcQ8xfbLsVBVOLmnjms
8C5fIMVlFsd594xmCgvs53DBFeNr2hziW9AKAvKo/KDezRu7LbVdE+h7ea50BeHa
GIiIpGdP5OupkddGWQzY63SqEibBwQMkaFJ7ZNzXYU7EoG+XvFJo0f210Gl0Tm36
3ejysjdbxXcqp1OzxXZtbTBwhzDDigISG0IIDdZZ/cgUQPD/Lgw321n1MH4IDxNB
Y56jJh25bz2F
=WU5T
-----END PGP SIGNATURE-----
pgpBxcWon3X18.pgp
Description: PGP signature
--- End Message ---
