{"schema_version":1,"generated_at":"2026-10-30T03:31:28.522226+00:00","sources":{"cves":{"ref":"HEAD","sha":"604accad567eb6e7fb4c7fdc422470c25f35f467","committed_at":"2026-10-28T12:38:42+01:00"},"queue":{"ref":"FETCH_HEAD","sha":"7f27b6ac0da11e40e4e828813263489e51221ab0","committed_at":"2026-10-29T14:43:04-04:00"},"live_checked":true},"scope":"All branch assessments for project deliveries, outstanding CVEs, and reviews","trees":[{"series":"6.1.y","ref":"FETCH_HEAD","sha":"79807e970724c1f90cee1316361d61b80db4eef6","committed_at":"2026-10-15T14:15:52+02:00","version":"6.1.190","records":[{"id":"CVE-2026-100073","title":"ext4: fix transaction overflow during writeback","status":"not-applicable","project":false,"upstream":[{"sha":"46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","url":"https://git.kernel.org/stable/c/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-100073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-100073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-100072","title":"ACPI: platform: Use acpi_bus_get_primary_device()","status":"unfixed","project":false,"upstream":[{"sha":"a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","url":"https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-100072","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-100072.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99215","title":"power: supply: core: prevent unregistering a power supply while a callback runs","status":"unfixed","project":false,"upstream":[{"sha":"5b4bd13e0552926648a46c2c9a12a24dfaee3715","url":"https://git.kernel.org/stable/c/5b4bd13e0552926648a46c2c9a12a24dfaee3715"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5b4bd13e0552926648a46c2c9a12a24dfaee3715","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/5b4bd13e0552926648a46c2c9a12a24dfaee3715.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99215","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99215.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99211","title":"netlink: reset skb headers before unicast and multicast filtering","status":"unfixed","project":false,"upstream":[{"sha":"8bf659bd54e1f00e34cf5244b1d289c506fa47c0","url":"https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8bf659bd54e1f00e34cf5244b1d289c506fa47c0","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/8bf659bd54e1f00e34cf5244b1d289c506fa47c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99209","title":"drm/xe: skip eviction of a BO with no resource","status":"not-applicable","project":false,"upstream":[{"sha":"448e76cbdc6652ccd3ba337b7a6e1f028859f2ed","url":"https://git.kernel.org/stable/c/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"448e76cbdc6652ccd3ba337b7a6e1f028859f2ed","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99209","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99209.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99208","title":"drm/xe/oa: Zero OA buffer at allocation","status":"not-applicable","project":false,"upstream":[{"sha":"fd8662823caa114a63f07222d2aa448f6ac5e864","url":"https://git.kernel.org/stable/c/fd8662823caa114a63f07222d2aa448f6ac5e864"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd8662823caa114a63f07222d2aa448f6ac5e864","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/fd8662823caa114a63f07222d2aa448f6ac5e864.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99208","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99208.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99191","title":"calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()","status":"unfixed","project":false,"upstream":[{"sha":"8070ed578b6b9134e045627fb745c887a806d46e","url":"https://git.kernel.org/stable/c/8070ed578b6b9134e045627fb745c887a806d46e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8070ed578b6b9134e045627fb745c887a806d46e","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/8070ed578b6b9134e045627fb745c887a806d46e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99191","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99191.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99189","title":"gpio: mxc: fix race between chained IRQ handler install and probe completion","status":"not-applicable","project":false,"upstream":[{"sha":"38d44f78f041ffe60c8e2443b99434a199e7541d","url":"https://git.kernel.org/stable/c/38d44f78f041ffe60c8e2443b99434a199e7541d"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"38d44f78f041ffe60c8e2443b99434a199e7541d","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/38d44f78f041ffe60c8e2443b99434a199e7541d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99189","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99189.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99183","title":"accel/rocket: search every core slot when looking up a scheduler","status":"not-applicable","project":false,"upstream":[{"sha":"89c2c777df17eb0201c8e22afabbf3691f2a28fe","url":"https://git.kernel.org/stable/c/89c2c777df17eb0201c8e22afabbf3691f2a28fe"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"89c2c777df17eb0201c8e22afabbf3691f2a28fe","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/89c2c777df17eb0201c8e22afabbf3691f2a28fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99183","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99183.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99178","title":"x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context","status":"unfixed","project":false,"upstream":[{"sha":"81d99abe2bd81379abfb595e403bbbee6fbfc624","url":"https://git.kernel.org/stable/c/81d99abe2bd81379abfb595e403bbbee6fbfc624"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"81d99abe2bd81379abfb595e403bbbee6fbfc624","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/81d99abe2bd81379abfb595e403bbbee6fbfc624.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99178","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99178.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99172","title":"ipc: drop the mqueue mount with kern_unmount() on setup failure","status":"unfixed","project":false,"upstream":[{"sha":"f0e48172a59e517e613b73f73cc35f24fd123aeb","url":"https://git.kernel.org/stable/c/f0e48172a59e517e613b73f73cc35f24fd123aeb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0e48172a59e517e613b73f73cc35f24fd123aeb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f0e48172a59e517e613b73f73cc35f24fd123aeb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99172","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99172.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99146","title":"drm/i915/dmc: Add sanity check for DMC load address","status":"unfixed","project":false,"upstream":[{"sha":"7dedc5bb11f95e96fe80757c924d8d9aa7327759","url":"https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7dedc5bb11f95e96fe80757c924d8d9aa7327759","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/7dedc5bb11f95e96fe80757c924d8d9aa7327759.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99146","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99146.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99125","title":"s390/pai: Handle multiple PMU stop callback invocations","status":"not-applicable","project":false,"upstream":[{"sha":"f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40","url":"https://git.kernel.org/stable/c/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99122","title":"vsock/vmci: validate packet source for connected sockets","status":"unfixed","project":false,"upstream":[{"sha":"ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7","url":"https://git.kernel.org/stable/c/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99122","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99122.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99109","title":"smb: client: reject SetEA requests that do not fit the request buffer","status":"unfixed","project":false,"upstream":[{"sha":"4aa2c106aef4bf3dfd97c30842db0767b26e8428","url":"https://git.kernel.org/stable/c/4aa2c106aef4bf3dfd97c30842db0767b26e8428"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4aa2c106aef4bf3dfd97c30842db0767b26e8428","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/4aa2c106aef4bf3dfd97c30842db0767b26e8428.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99109","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99109.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99101","title":"ntfs: move attribute payload before shrinking its record","status":"unknown","project":false,"upstream":[{"sha":"0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","url":"https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99090","title":"drm/amdgpu: serialize vblank counter reads against GPU reset","status":"unfixed","project":false,"upstream":[{"sha":"1a6023edfbb5673f55fab6348f135fb3b1428ea5","url":"https://git.kernel.org/stable/c/1a6023edfbb5673f55fab6348f135fb3b1428ea5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a6023edfbb5673f55fab6348f135fb3b1428ea5","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/1a6023edfbb5673f55fab6348f135fb3b1428ea5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99090","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99090.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99087","title":"dm-integrity: fix NULL pointer dereference when the 'R' flag is used","status":"unfixed","project":false,"upstream":[{"sha":"7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84","url":"https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99087","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99087.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99086","title":"dm-integrity: validate the superblock on resume","status":"unfixed","project":false,"upstream":[{"sha":"fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2","url":"https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2","lines":80,"reason":"","source":"https://github.com/torvalds/linux/commit/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99086","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99086.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99076","title":"ipv6: udp: Create exceptions before socket matching","status":"unfixed","project":false,"upstream":[{"sha":"ac76cab50e899a7346408b8d3c3a4192c2eefb9f","url":"https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac76cab50e899a7346408b8d3c3a4192c2eefb9f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/ac76cab50e899a7346408b8d3c3a4192c2eefb9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99076","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99076.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99026","title":"net: team: free skb when broadcast has no txable port","status":"unfixed","project":false,"upstream":[{"sha":"489114c9ecae44e523361a4b3e610ee5ebd9189c","url":"https://git.kernel.org/stable/c/489114c9ecae44e523361a4b3e610ee5ebd9189c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"489114c9ecae44e523361a4b3e610ee5ebd9189c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/489114c9ecae44e523361a4b3e610ee5ebd9189c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99021","title":"regulator: of: fill in supply names in of_regulator_bulk_get_all()","status":"unfixed","project":false,"upstream":[{"sha":"e2151c29cec73f6cc70abf1c7cbc7b9b202489f5","url":"https://git.kernel.org/stable/c/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e2151c29cec73f6cc70abf1c7cbc7b9b202489f5","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99021","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99021.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98999","title":"drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin","status":"not-applicable","project":false,"upstream":[{"sha":"cf238c067eaae1cbfb00738e29219b9568d2313e","url":"https://git.kernel.org/stable/c/cf238c067eaae1cbfb00738e29219b9568d2313e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf238c067eaae1cbfb00738e29219b9568d2313e","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/cf238c067eaae1cbfb00738e29219b9568d2313e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98996","title":"fs: don't silently unmount busy mounts","status":"unfixed","project":false,"upstream":[{"sha":"6857e209015f95be7a8f19a9cd5dac345b9b9859","url":"https://git.kernel.org/stable/c/6857e209015f95be7a8f19a9cd5dac345b9b9859"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"6857e209015f95be7a8f19a9cd5dac345b9b9859","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/6857e209015f95be7a8f19a9cd5dac345b9b9859.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98996","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98996.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98989","title":"namespace: check a recursive bind mount for mount namespace loops","status":"unfixed","project":false,"upstream":[{"sha":"c640a01a78e42302879006ed7b7d5a9a943ba815","url":"https://git.kernel.org/stable/c/c640a01a78e42302879006ed7b7d5a9a943ba815"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c640a01a78e42302879006ed7b7d5a9a943ba815","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c640a01a78e42302879006ed7b7d5a9a943ba815.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98983","title":"unshare: don't drop active namespace references that were never taken","status":"unfixed","project":false,"upstream":[{"sha":"0b6f31a3c0b16066f812e94b52a704174a6f23cd","url":"https://git.kernel.org/stable/c/0b6f31a3c0b16066f812e94b52a704174a6f23cd"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0b6f31a3c0b16066f812e94b52a704174a6f23cd","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/0b6f31a3c0b16066f812e94b52a704174a6f23cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98983","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98983.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98980","title":"namei: don't reveal overmounted entries in refwalk","status":"unfixed","project":false,"upstream":[{"sha":"8189ab688f5a2c745dc90b63374da02f213d6994","url":"https://git.kernel.org/stable/c/8189ab688f5a2c745dc90b63374da02f213d6994"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8189ab688f5a2c745dc90b63374da02f213d6994","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/8189ab688f5a2c745dc90b63374da02f213d6994.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98980","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98980.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98978","title":"namespace: never expire a locked mount","status":"unfixed","project":false,"upstream":[{"sha":"f78ddcc872248c7aa1d7e904928441a0be4c6d5d","url":"https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f78ddcc872248c7aa1d7e904928441a0be4c6d5d","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/f78ddcc872248c7aa1d7e904928441a0be4c6d5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98978","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98978.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98975","title":"xfs: stop exchanging reflink flags when exchanging mappings","status":"unfixed","project":false,"upstream":[{"sha":"d84d6c1a7f1e2de9e601703a326a4c1b7b421943","url":"https://git.kernel.org/stable/c/d84d6c1a7f1e2de9e601703a326a4c1b7b421943"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d84d6c1a7f1e2de9e601703a326a4c1b7b421943","lines":160,"reason":"","source":"https://github.com/torvalds/linux/commit/d84d6c1a7f1e2de9e601703a326a4c1b7b421943.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98972","title":"cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()","status":"unfixed","project":false,"upstream":[{"sha":"e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469","url":"https://git.kernel.org/stable/c/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98972","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98972.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98966","title":"bonding: fix the program leak when XDP is replaced","status":"unfixed","project":false,"upstream":[{"sha":"184b5ddf82d45d6f75cc83719a2e453392512bd2","url":"https://git.kernel.org/stable/c/184b5ddf82d45d6f75cc83719a2e453392512bd2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"184b5ddf82d45d6f75cc83719a2e453392512bd2","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/184b5ddf82d45d6f75cc83719a2e453392512bd2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98966","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98966.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98960","title":"btrfs: don't stash io_uring encoded data across -EAGAIN","status":"not-applicable","project":false,"upstream":[{"sha":"51562a8cb11628d3a5e105b4c347ec5473e5745f","url":"https://git.kernel.org/stable/c/51562a8cb11628d3a5e105b4c347ec5473e5745f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"51562a8cb11628d3a5e105b4c347ec5473e5745f","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/51562a8cb11628d3a5e105b4c347ec5473e5745f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98960","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98960.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98959","title":"btrfs: fix xattr replace when multiple xattrs are packed in the same item","status":"unfixed","project":false,"upstream":[{"sha":"858bee1c77857aabcc2327cd32dd8266332de332","url":"https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"858bee1c77857aabcc2327cd32dd8266332de332","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/858bee1c77857aabcc2327cd32dd8266332de332.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98959","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98959.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98958","title":"wifi: mt76: account non-AQL frames per peer rather than per link","status":"not-applicable","project":false,"upstream":[{"sha":"752770d7a58c821c17909c3ca67f9f14ab146a40","url":"https://git.kernel.org/stable/c/752770d7a58c821c17909c3ca67f9f14ab146a40"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"752770d7a58c821c17909c3ca67f9f14ab146a40","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/752770d7a58c821c17909c3ca67f9f14ab146a40.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98958","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98958.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98957","title":"wifi: mt76: mt7915: disable rx napi when removing device","status":"unfixed","project":false,"upstream":[{"sha":"916c484d29d82f45c281da2786fcd6a1284430ce","url":"https://git.kernel.org/stable/c/916c484d29d82f45c281da2786fcd6a1284430ce"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"916c484d29d82f45c281da2786fcd6a1284430ce","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/916c484d29d82f45c281da2786fcd6a1284430ce.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98957","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98957.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98954","title":"net: always dissect GSO packets in __virtio_net_hdr_to_skb()","status":"unfixed","project":false,"upstream":[{"sha":"44378d02c5aaae24b60a75fbbb539b4aa4db503d","url":"https://git.kernel.org/stable/c/44378d02c5aaae24b60a75fbbb539b4aa4db503d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"44378d02c5aaae24b60a75fbbb539b4aa4db503d","lines":139,"reason":"","source":"https://github.com/torvalds/linux/commit/44378d02c5aaae24b60a75fbbb539b4aa4db503d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98954","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98954.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98951","title":"riscv: ptrace: Zero-initialize regset buffers before copyin","status":"not-applicable","project":false,"upstream":[{"sha":"59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97","url":"https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98951","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98951.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98947","title":"vsock: Fix memory leak in vmci_transport_recv_dgram_cb()","status":"unfixed","project":false,"upstream":[{"sha":"7c24a4e87e219072e5e106f6791146cbf3b056b3","url":"https://git.kernel.org/stable/c/7c24a4e87e219072e5e106f6791146cbf3b056b3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c24a4e87e219072e5e106f6791146cbf3b056b3","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7c24a4e87e219072e5e106f6791146cbf3b056b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98946","title":"drm/vc4: Disable the V3D interrupt across runtime suspend","status":"unfixed","project":false,"upstream":[{"sha":"6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f","url":"https://git.kernel.org/stable/c/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f","lines":67,"reason":"","source":"https://github.com/torvalds/linux/commit/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98946","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98946.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98938","title":"rust: irq: pass RegistrationInner as cookie to request_irq","status":"not-applicable","project":false,"upstream":[{"sha":"9a7931e847f338a687e96cde9f37e0cff83ddd84","url":"https://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"9a7931e847f338a687e96cde9f37e0cff83ddd84","lines":185,"reason":"","source":"https://github.com/torvalds/linux/commit/9a7931e847f338a687e96cde9f37e0cff83ddd84.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98937","title":"perf/core: Check kernel access when kernel callchains are requested","status":"unfixed","project":false,"upstream":[{"sha":"a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f","url":"https://git.kernel.org/stable/c/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98937","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98937.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98932","title":"EDAC/altera: Fix use-after-free in error paths","status":"unfixed","project":false,"upstream":[{"sha":"eef3b67f9c6782127163b631c9043011a68016e2","url":"https://git.kernel.org/stable/c/eef3b67f9c6782127163b631c9043011a68016e2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"eef3b67f9c6782127163b631c9043011a68016e2","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/eef3b67f9c6782127163b631c9043011a68016e2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98930","title":"KVM: s390: Fix IRQ injection with SIGP Stop and Store Status","status":"unfixed","project":false,"upstream":[{"sha":"d343407b728a80b74be3c24b59f15e60289ea527","url":"https://git.kernel.org/stable/c/d343407b728a80b74be3c24b59f15e60289ea527"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d343407b728a80b74be3c24b59f15e60289ea527","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/d343407b728a80b74be3c24b59f15e60289ea527.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98930","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98930.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98929","title":"macsec: initialize SecY before registering the netdevice","status":"unfixed","project":false,"upstream":[{"sha":"c2de369c5c5b8599ca10fd5ca8d11fcd845c1331","url":"https://git.kernel.org/stable/c/c2de369c5c5b8599ca10fd5ca8d11fcd845c1331"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c2de369c5c5b8599ca10fd5ca8d11fcd845c1331","lines":141,"reason":"","source":"https://github.com/torvalds/linux/commit/c2de369c5c5b8599ca10fd5ca8d11fcd845c1331.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98926","title":"drm/amd/display: Remove sink usage from DPMS","status":"unknown","project":false,"upstream":[{"sha":"8fa813b7fd1eccbed13e126166cf764f1f11a7d3","url":"https://git.kernel.org/stable/c/8fa813b7fd1eccbed13e126166cf764f1f11a7d3"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"over-limit","patches":[{"sha":"8fa813b7fd1eccbed13e126166cf764f1f11a7d3","lines":384,"reason":"","source":"https://github.com/torvalds/linux/commit/8fa813b7fd1eccbed13e126166cf764f1f11a7d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98926","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98926.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98924","title":"fs: avoid repeated scans in evict_inodes()","status":"unfixed","project":false,"upstream":[{"sha":"7459c021874246c196f397686e100702f059b9e7","url":"https://git.kernel.org/stable/c/7459c021874246c196f397686e100702f059b9e7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7459c021874246c196f397686e100702f059b9e7","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/7459c021874246c196f397686e100702f059b9e7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98924","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98924.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98920","title":"netfs: Fix missing alloc tagging of direct mempool allocations","status":"not-applicable","project":false,"upstream":[{"sha":"b78b728e21c32ec4c330b299f657fb1eb02dffc2","url":"https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b78b728e21c32ec4c330b299f657fb1eb02dffc2","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/b78b728e21c32ec4c330b299f657fb1eb02dffc2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98917","title":"parisc: Increase kernel stack size to 32kb","status":"unfixed","project":false,"upstream":[{"sha":"94b7e3a7e871ae27d4935c76959dfc61829f27f9","url":"https://git.kernel.org/stable/c/94b7e3a7e871ae27d4935c76959dfc61829f27f9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"94b7e3a7e871ae27d4935c76959dfc61829f27f9","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/94b7e3a7e871ae27d4935c76959dfc61829f27f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98917","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98917.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98916","title":"wifi: nl80211: check link is beaconing for color change","status":"unfixed","project":false,"upstream":[{"sha":"55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4","url":"https://git.kernel.org/stable/c/55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98916","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98916.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98914","title":"drm/amdgpu: cap ATOM command table nesting depth","status":"unfixed","project":false,"upstream":[{"sha":"27ef1795bc4e47cae838e0a3ced531c549f9b23d","url":"https://git.kernel.org/stable/c/27ef1795bc4e47cae838e0a3ced531c549f9b23d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"27ef1795bc4e47cae838e0a3ced531c549f9b23d","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/27ef1795bc4e47cae838e0a3ced531c549f9b23d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98906","title":"net: lan966x: restore RX state on reload failure","status":"unfixed","project":false,"upstream":[{"sha":"aa97f11a76e545ed73cc455bcdd1ece4b480b507","url":"https://git.kernel.org/stable/c/aa97f11a76e545ed73cc455bcdd1ece4b480b507"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa97f11a76e545ed73cc455bcdd1ece4b480b507","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/aa97f11a76e545ed73cc455bcdd1ece4b480b507.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98904","title":"mailbox: imx: Use devm_pm_runtime_enable()","status":"unfixed","project":false,"upstream":[{"sha":"1f602619e408b6e9655ee76656a2a5ab6e89c5e4","url":"https://git.kernel.org/stable/c/1f602619e408b6e9655ee76656a2a5ab6e89c5e4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1f602619e408b6e9655ee76656a2a5ab6e89c5e4","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/1f602619e408b6e9655ee76656a2a5ab6e89c5e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98904","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98904.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98903","title":"mailbox: imx: Add a channel shutdown field","status":"unfixed","project":false,"upstream":[{"sha":"5ccea7eacb7786c358833634f45700365f6c1d99","url":"https://git.kernel.org/stable/c/5ccea7eacb7786c358833634f45700365f6c1d99"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5ccea7eacb7786c358833634f45700365f6c1d99","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/5ccea7eacb7786c358833634f45700365f6c1d99.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98903","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98903.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98901","title":"ksmbd: fix lease break and ack state handling","status":"unfixed","project":false,"upstream":[{"sha":"5015191096db311759fef98769270336cd8b1324","url":"https://git.kernel.org/stable/c/5015191096db311759fef98769270336cd8b1324"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"5015191096db311759fef98769270336cd8b1324","lines":184,"reason":"","source":"https://github.com/torvalds/linux/commit/5015191096db311759fef98769270336cd8b1324.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98897","title":"ksmbd: don't hold ci->m_lock while waiting for a lease break ack","status":"not-applicable","project":false,"upstream":[{"sha":"27a9bc968d4ae809a3f5ca2f2b136856ee613cb4","url":"https://git.kernel.org/stable/c/27a9bc968d4ae809a3f5ca2f2b136856ee613cb4"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"27a9bc968d4ae809a3f5ca2f2b136856ee613cb4","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/27a9bc968d4ae809a3f5ca2f2b136856ee613cb4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98897","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98897.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98880","title":"ntfs3: handle set_blocksize failures","status":"unfixed","project":false,"upstream":[{"sha":"24f7d1824b7581ae3daf9d443c5dfeabd89df6d8","url":"https://git.kernel.org/stable/c/24f7d1824b7581ae3daf9d443c5dfeabd89df6d8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"24f7d1824b7581ae3daf9d443c5dfeabd89df6d8","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/24f7d1824b7581ae3daf9d443c5dfeabd89df6d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98880","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98880.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98875","title":"drm/nouveau/gsp: add SEC2 to GA100 chip table","status":"not-applicable","project":false,"upstream":[{"sha":"604d0efb17cc0dd197e089134736ac2698d5fca7","url":"https://git.kernel.org/stable/c/604d0efb17cc0dd197e089134736ac2698d5fca7"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"604d0efb17cc0dd197e089134736ac2698d5fca7","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/604d0efb17cc0dd197e089134736ac2698d5fca7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98875","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98875.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98869","title":"bpf: Infer zext_dst based on static register liveness analysis","status":"not-applicable","project":false,"upstream":[{"sha":"7ce090afbf725e25fff29caacce1eaf8459b1117","url":"https://git.kernel.org/stable/c/7ce090afbf725e25fff29caacce1eaf8459b1117"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"7ce090afbf725e25fff29caacce1eaf8459b1117","lines":429,"reason":"","source":"https://github.com/torvalds/linux/commit/7ce090afbf725e25fff29caacce1eaf8459b1117.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98869","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98869.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98863","title":"KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails","status":"unfixed","project":false,"upstream":[{"sha":"10180a277549339020b08000206092c07e0bff5a","url":"https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"10180a277549339020b08000206092c07e0bff5a","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/10180a277549339020b08000206092c07e0bff5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98863","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98863.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98859","title":"HID: multitouch: stop the release timer from being rearmed on remove","status":"unfixed","project":false,"upstream":[{"sha":"5acb2dace582f061aab5e14c399ac9480315f44b","url":"https://git.kernel.org/stable/c/5acb2dace582f061aab5e14c399ac9480315f44b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5acb2dace582f061aab5e14c399ac9480315f44b","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/5acb2dace582f061aab5e14c399ac9480315f44b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98859","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98859.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98853","title":"net: gso: limit recursive IP-in-IP segmentation","status":"unfixed","project":false,"upstream":[{"sha":"006c8b834aed8b02bd8fb9fb05e9e7ead37d1763","url":"https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"006c8b834aed8b02bd8fb9fb05e9e7ead37d1763","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98853","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98853.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98852","title":"net: extend IPv6 exthdr detection of tunneled packets","status":"unfixed","project":false,"upstream":[{"sha":"5f0764cb1c81a9712bce605d38efe6d844a70b29","url":"https://git.kernel.org/stable/c/5f0764cb1c81a9712bce605d38efe6d844a70b29"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5f0764cb1c81a9712bce605d38efe6d844a70b29","lines":67,"reason":"","source":"https://github.com/torvalds/linux/commit/5f0764cb1c81a9712bce605d38efe6d844a70b29.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98852","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98852.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98843","title":"netfs: zero gaps in read-gaps folio to avoid writing back stale data","status":"not-applicable","project":false,"upstream":[{"sha":"8db55c5cd831a786a1a2a2d391aa80354535a353","url":"https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8db55c5cd831a786a1a2a2d391aa80354535a353","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/8db55c5cd831a786a1a2a2d391aa80354535a353.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98843","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98843.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98839","title":"vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()","status":"unfixed","project":false,"upstream":[{"sha":"39495ef5d6f8019e62d65807f217a7ca8232727a","url":"https://git.kernel.org/stable/c/39495ef5d6f8019e62d65807f217a7ca8232727a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"39495ef5d6f8019e62d65807f217a7ca8232727a","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/39495ef5d6f8019e62d65807f217a7ca8232727a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98839","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98839.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98834","title":"mtd: core: avoid double-free of OTP NVMEM device","status":"unfixed","project":false,"upstream":[{"sha":"26300879cd8e4612dce66bb8f6ff7cd35fcf3e59","url":"https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"26300879cd8e4612dce66bb8f6ff7cd35fcf3e59","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98829","title":"wifi: mac80211: drop oversized fragments to avoid extra_len overflow","status":"unfixed","project":false,"upstream":[{"sha":"5e4f3509793b4db2c0835340224743db680e861f","url":"https://git.kernel.org/stable/c/5e4f3509793b4db2c0835340224743db680e861f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5e4f3509793b4db2c0835340224743db680e861f","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/5e4f3509793b4db2c0835340224743db680e861f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98829","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98829.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98828","title":"wifi: ath9k: reject short WMI command responses","status":"unfixed","project":false,"upstream":[{"sha":"93ce8ea70451e800601bc9444aa33043de15d67b","url":"https://git.kernel.org/stable/c/93ce8ea70451e800601bc9444aa33043de15d67b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"93ce8ea70451e800601bc9444aa33043de15d67b","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/93ce8ea70451e800601bc9444aa33043de15d67b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98828","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98828.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98827","title":"wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE","status":"unfixed","project":false,"upstream":[{"sha":"aeaca27c1db3106967ffbb2b517d98c835f6d500","url":"https://git.kernel.org/stable/c/aeaca27c1db3106967ffbb2b517d98c835f6d500"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aeaca27c1db3106967ffbb2b517d98c835f6d500","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/aeaca27c1db3106967ffbb2b517d98c835f6d500.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98827","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98827.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98826","title":"rtc: ac100: Fix clock provider use-after-free on probe failure","status":"unfixed","project":false,"upstream":[{"sha":"fcf0b58e976e83adf246b014518e49c662b96f5e","url":"https://git.kernel.org/stable/c/fcf0b58e976e83adf246b014518e49c662b96f5e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fcf0b58e976e83adf246b014518e49c662b96f5e","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/fcf0b58e976e83adf246b014518e49c662b96f5e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98824","title":"wifi: mac80211: validate TX status rate metadata","status":"unfixed","project":false,"upstream":[{"sha":"6bdcdb31318c10e6369cff8e5b32c37397e98091","url":"https://git.kernel.org/stable/c/6bdcdb31318c10e6369cff8e5b32c37397e98091"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"6bdcdb31318c10e6369cff8e5b32c37397e98091","lines":165,"reason":"","source":"https://github.com/torvalds/linux/commit/6bdcdb31318c10e6369cff8e5b32c37397e98091.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98824","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98824.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98822","title":"wifi: mac80211: prevent AP VLAN tx from other interfaces","status":"unfixed","project":false,"upstream":[{"sha":"7f93ca31f7fd9b42e7d692f59514436d448ac908","url":"https://git.kernel.org/stable/c/7f93ca31f7fd9b42e7d692f59514436d448ac908"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f93ca31f7fd9b42e7d692f59514436d448ac908","lines":80,"reason":"","source":"https://github.com/torvalds/linux/commit/7f93ca31f7fd9b42e7d692f59514436d448ac908.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98822","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98822.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98820","title":"blk-mq: set RQF_USE_SCHED when the operation is known","status":"unfixed","project":false,"upstream":[{"sha":"ab6c756f28c741d704a7c3e04814bfc3adf6f818","url":"https://git.kernel.org/stable/c/ab6c756f28c741d704a7c3e04814bfc3adf6f818"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ab6c756f28c741d704a7c3e04814bfc3adf6f818","lines":134,"reason":"","source":"https://github.com/torvalds/linux/commit/ab6c756f28c741d704a7c3e04814bfc3adf6f818.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98820","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98820.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98818","title":"mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()","status":"not-applicable","project":false,"upstream":[{"sha":"af2fb3ee6679b517e2fdbd3ba16ec276a8b74312","url":"https://git.kernel.org/stable/c/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"af2fb3ee6679b517e2fdbd3ba16ec276a8b74312","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98818","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98818.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98816","title":"bpf: Fix overflow of jump offset in constant blinding","status":"unfixed","project":false,"upstream":[{"sha":"ad139384ecddb6f3e7e3c3c12765aafae0e39670","url":"https://git.kernel.org/stable/c/ad139384ecddb6f3e7e3c3c12765aafae0e39670"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad139384ecddb6f3e7e3c3c12765aafae0e39670","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/ad139384ecddb6f3e7e3c3c12765aafae0e39670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98816","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98816.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98815","title":"nvme: fix cdev lifetime","status":"unfixed","project":false,"upstream":[{"sha":"9952f3882ecba709092379b71e02b09762b26f96","url":"https://git.kernel.org/stable/c/9952f3882ecba709092379b71e02b09762b26f96"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9952f3882ecba709092379b71e02b09762b26f96","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/9952f3882ecba709092379b71e02b09762b26f96.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98815","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98815.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98814","title":"nvme: fix command effects log lifetime for multipath heads","status":"unfixed","project":false,"upstream":[{"sha":"72ece656abd4de8645a421fb482d7a11e6533a45","url":"https://git.kernel.org/stable/c/72ece656abd4de8645a421fb482d7a11e6533a45"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"72ece656abd4de8645a421fb482d7a11e6533a45","lines":126,"reason":"","source":"https://github.com/torvalds/linux/commit/72ece656abd4de8645a421fb482d7a11e6533a45.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98814","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98814.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98813","title":"bpf: Hold map BTF for the memory allocator destructor record","status":"not-applicable","project":false,"upstream":[{"sha":"ab39974240a0cff765f3bb9cce81d8001ffdb144","url":"https://git.kernel.org/stable/c/ab39974240a0cff765f3bb9cce81d8001ffdb144"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ab39974240a0cff765f3bb9cce81d8001ffdb144","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/ab39974240a0cff765f3bb9cce81d8001ffdb144.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98813","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98813.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98810","title":"wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()","status":"unfixed","project":false,"upstream":[{"sha":"6f63e919fe1e335b8abcb3a28bfd4804a98d875a","url":"https://git.kernel.org/stable/c/6f63e919fe1e335b8abcb3a28bfd4804a98d875a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f63e919fe1e335b8abcb3a28bfd4804a98d875a","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/6f63e919fe1e335b8abcb3a28bfd4804a98d875a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98810","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98810.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98808","title":"net: systemport: Fix buffer overflow in bcm_sysport_get_stats()","status":"unfixed","project":false,"upstream":[{"sha":"eb7b84af0ec5c71b4920e999611b466b3784496c","url":"https://git.kernel.org/stable/c/eb7b84af0ec5c71b4920e999611b466b3784496c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb7b84af0ec5c71b4920e999611b466b3784496c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/eb7b84af0ec5c71b4920e999611b466b3784496c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98807","title":"net/mlx5: Fix slab-out-of-bounds when handling team device events","status":"unfixed","project":false,"upstream":[{"sha":"04c824940d52871c49866a4ac67b504146f7cf35","url":"https://git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"04c824940d52871c49866a4ac67b504146f7cf35","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/04c824940d52871c49866a4ac67b504146f7cf35.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98807.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98806","title":"octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled","status":"not-applicable","project":false,"upstream":[{"sha":"056994563935e049093f100efaad7e63ad113814","url":"https://git.kernel.org/stable/c/056994563935e049093f100efaad7e63ad113814"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"056994563935e049093f100efaad7e63ad113814","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/056994563935e049093f100efaad7e63ad113814.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98803","title":"net: stmmac: fix rx Scatter-Gather support","status":"unfixed","project":false,"upstream":[{"sha":"88095728511e0df9c89528944f5a1762ad298983","url":"https://git.kernel.org/stable/c/88095728511e0df9c89528944f5a1762ad298983"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"88095728511e0df9c89528944f5a1762ad298983","lines":180,"reason":"","source":"https://github.com/torvalds/linux/commit/88095728511e0df9c89528944f5a1762ad298983.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98803","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98803.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98802","title":"seg6: ensure packet data is writable before modifying SRH and IPv6 DA","status":"unfixed","project":false,"upstream":[{"sha":"8ae3f4067ba4ae3a15581392f6dac422e3d3def0","url":"https://git.kernel.org/stable/c/8ae3f4067ba4ae3a15581392f6dac422e3d3def0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8ae3f4067ba4ae3a15581392f6dac422e3d3def0","lines":292,"reason":"","source":"https://github.com/torvalds/linux/commit/8ae3f4067ba4ae3a15581392f6dac422e3d3def0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98802","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98802.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98801","title":"net: restrict SO_RESERVE_MEM to TCP sockets and cap max value","status":"unfixed","project":false,"upstream":[{"sha":"37e02c42a00be692c06343e11779aadc45f45971","url":"https://git.kernel.org/stable/c/37e02c42a00be692c06343e11779aadc45f45971"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"37e02c42a00be692c06343e11779aadc45f45971","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/37e02c42a00be692c06343e11779aadc45f45971.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98801","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98801.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98800","title":"bpf: Wait for an RCU tasks grace period before freeing trampoline progs","status":"unfixed","project":false,"upstream":[{"sha":"0fb5751a6e411b1b466c06e50021818d9391df98","url":"https://git.kernel.org/stable/c/0fb5751a6e411b1b466c06e50021818d9391df98"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fb5751a6e411b1b466c06e50021818d9391df98","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/0fb5751a6e411b1b466c06e50021818d9391df98.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98800","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98800.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98799","title":"bpf: Skip detached progs in trampoline images that are still in use","status":"unfixed","project":false,"upstream":[{"sha":"17637e1a581a22466ac3620a91e099683ff9cc6f","url":"https://git.kernel.org/stable/c/17637e1a581a22466ac3620a91e099683ff9cc6f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"17637e1a581a22466ac3620a91e099683ff9cc6f","lines":955,"reason":"","source":"https://github.com/torvalds/linux/commit/17637e1a581a22466ac3620a91e099683ff9cc6f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98797","title":"net: cap skb->queue_mapping when the tx queue is picked","status":"unfixed","project":false,"upstream":[{"sha":"ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d","url":"https://git.kernel.org/stable/c/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98796","title":"net: ethernet: mtk_eth_soc: allocate dummy netdev sooner","status":"unfixed","project":false,"upstream":[{"sha":"6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b","url":"https://git.kernel.org/stable/c/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98796","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98796.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98795","title":"net: sparx5: skip ptp deinit if init was skipped","status":"unfixed","project":false,"upstream":[{"sha":"0d2c49915bc3aea4521cda5e4d42f24f63b94585","url":"https://git.kernel.org/stable/c/0d2c49915bc3aea4521cda5e4d42f24f63b94585"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0d2c49915bc3aea4521cda5e4d42f24f63b94585","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/0d2c49915bc3aea4521cda5e4d42f24f63b94585.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98795","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98795.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98792","title":"netfilter: flowtable: generalize pending status bit","status":"unfixed","project":false,"upstream":[{"sha":"7c549fb7eecd01fdba7c0d12c01da876ef8a3214","url":"https://git.kernel.org/stable/c/7c549fb7eecd01fdba7c0d12c01da876ef8a3214"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c549fb7eecd01fdba7c0d12c01da876ef8a3214","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/7c549fb7eecd01fdba7c0d12c01da876ef8a3214.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98792","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98792.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98789","title":"bpf: Fix objects stuck in free_by_rcu_ttrace","status":"unfixed","project":false,"upstream":[{"sha":"fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043","url":"https://git.kernel.org/stable/c/fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98789","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98789.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98788","title":"futex: Fix private hash use-after-free on resize","status":"not-applicable","project":false,"upstream":[{"sha":"f35e3b5784221654f9cdbd6222275a7fa203f6c3","url":"https://git.kernel.org/stable/c/f35e3b5784221654f9cdbd6222275a7fa203f6c3"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"f35e3b5784221654f9cdbd6222275a7fa203f6c3","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/f35e3b5784221654f9cdbd6222275a7fa203f6c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98788","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98788.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98786","title":"drm/amd/display: guard dc_sink dereferences in MST mode validation","status":"unfixed","project":false,"upstream":[{"sha":"217f64f348c90cba62164e7ff38e0ccf78a5ca09","url":"https://git.kernel.org/stable/c/217f64f348c90cba62164e7ff38e0ccf78a5ca09"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"217f64f348c90cba62164e7ff38e0ccf78a5ca09","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/217f64f348c90cba62164e7ff38e0ccf78a5ca09.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98786","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98786.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98758","title":"usb: typec: ucsi: glink: fix use-after-free of ucsi on remove","status":"not-applicable","project":false,"upstream":[{"sha":"63b269ec537dc0fd26d0bd64872c26860d108c9d","url":"https://git.kernel.org/stable/c/63b269ec537dc0fd26d0bd64872c26860d108c9d"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"63b269ec537dc0fd26d0bd64872c26860d108c9d","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/63b269ec537dc0fd26d0bd64872c26860d108c9d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98758","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98758.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98747","title":"serial: core: fix NULL pointer dereference in serial_core_unregister_port()","status":"not-applicable","project":false,"upstream":[{"sha":"499485a67fbacf4d9afbdb43522388c64f853428","url":"https://git.kernel.org/stable/c/499485a67fbacf4d9afbdb43522388c64f853428"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"499485a67fbacf4d9afbdb43522388c64f853428","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/499485a67fbacf4d9afbdb43522388c64f853428.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98747","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98747.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98740","title":"EDAC/altera: Drop __init from ECC setup paths for re-probe safety","status":"unfixed","project":false,"upstream":[{"sha":"b62a264163ca51bee04785c581344751812395df","url":"https://git.kernel.org/stable/c/b62a264163ca51bee04785c581344751812395df"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b62a264163ca51bee04785c581344751812395df","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/b62a264163ca51bee04785c581344751812395df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98740","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98740.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98738","title":"Bluetooth: Serialize SMP remote OOB data access","status":"unfixed","project":false,"upstream":[{"sha":"81a2345f1984f0b36d3226571bc196316a01b648","url":"https://git.kernel.org/stable/c/81a2345f1984f0b36d3226571bc196316a01b648"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"81a2345f1984f0b36d3226571bc196316a01b648","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/81a2345f1984f0b36d3226571bc196316a01b648.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98738","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98738.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98737","title":"Bluetooth: hci_sync: Fix inquiry cache use-after-free","status":"unfixed","project":false,"upstream":[{"sha":"8ed67535fdff40ca652bcd4ac7da68d11d01bd34","url":"https://git.kernel.org/stable/c/8ed67535fdff40ca652bcd4ac7da68d11d01bd34"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ed67535fdff40ca652bcd4ac7da68d11d01bd34","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/8ed67535fdff40ca652bcd4ac7da68d11d01bd34.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98737","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98737.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98734","title":"Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown","status":"unfixed","project":false,"upstream":[{"sha":"848a7a91c7f03675d3bd8db6f7721cbf9cb50e21","url":"https://git.kernel.org/stable/c/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"848a7a91c7f03675d3bd8db6f7721cbf9cb50e21","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98734","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98734.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98720","title":"KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified","status":"unfixed","project":false,"upstream":[{"sha":"2abb25273c82061dd4670690c81c319c03740bf6","url":"https://git.kernel.org/stable/c/2abb25273c82061dd4670690c81c319c03740bf6"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2abb25273c82061dd4670690c81c319c03740bf6","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/2abb25273c82061dd4670690c81c319c03740bf6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98720","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98720.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98715","title":"KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN","status":"unfixed","project":false,"upstream":[{"sha":"60d93c27859fb3ec5b5a689e24de303f166477d0","url":"https://git.kernel.org/stable/c/60d93c27859fb3ec5b5a689e24de303f166477d0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"60d93c27859fb3ec5b5a689e24de303f166477d0","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/60d93c27859fb3ec5b5a689e24de303f166477d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98715","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98715.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98714","title":"KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded","status":"unfixed","project":false,"upstream":[{"sha":"e27fc915c8f575ab5630e27d97465c2077d4b9d1","url":"https://git.kernel.org/stable/c/e27fc915c8f575ab5630e27d97465c2077d4b9d1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e27fc915c8f575ab5630e27d97465c2077d4b9d1","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/e27fc915c8f575ab5630e27d97465c2077d4b9d1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98714","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98714.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98692","title":"thunderbolt: Make the DP tunnel activation callback mandatory","status":"not-applicable","project":false,"upstream":[{"sha":"12f5d8b85a66a0ac08d082517d92ce136f8c0d42","url":"https://git.kernel.org/stable/c/12f5d8b85a66a0ac08d082517d92ce136f8c0d42"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"12f5d8b85a66a0ac08d082517d92ce136f8c0d42","lines":243,"reason":"","source":"https://github.com/torvalds/linux/commit/12f5d8b85a66a0ac08d082517d92ce136f8c0d42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98692","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98692.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98685","title":"smb: client: discard post-EOF pagecache when extending a file via clone range","status":"unfixed","project":false,"upstream":[{"sha":"4721587f96cb8de8164f3fd203093a0875560999","url":"https://git.kernel.org/stable/c/4721587f96cb8de8164f3fd203093a0875560999"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4721587f96cb8de8164f3fd203093a0875560999","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/4721587f96cb8de8164f3fd203093a0875560999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98685","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98685.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98684","title":"smb: client: flush and commit data before querying allocated ranges","status":"unfixed","project":false,"upstream":[{"sha":"aa994489bd835547c191827acc460192e147032d","url":"https://git.kernel.org/stable/c/aa994489bd835547c191827acc460192e147032d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa994489bd835547c191827acc460192e147032d","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/aa994489bd835547c191827acc460192e147032d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98684","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98684.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98683","title":"smb: client: flush dirty data before zeroing a range","status":"unfixed","project":false,"upstream":[{"sha":"8f8d32c1044f70e46e87550e039a15ff20a4b21c","url":"https://git.kernel.org/stable/c/8f8d32c1044f70e46e87550e039a15ff20a4b21c"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f8d32c1044f70e46e87550e039a15ff20a4b21c","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/8f8d32c1044f70e46e87550e039a15ff20a4b21c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98683","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98683.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98682","title":"smb: client: drain and invalidate before server-side copy/clone","status":"unfixed","project":false,"upstream":[{"sha":"c9b1194e8ec99d95db25db45edd2fbf690f043ab","url":"https://git.kernel.org/stable/c/c9b1194e8ec99d95db25db45edd2fbf690f043ab"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c9b1194e8ec99d95db25db45edd2fbf690f043ab","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/c9b1194e8ec99d95db25db45edd2fbf690f043ab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98682","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98682.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98674","title":"iio: adc: adi-axi-adc: Initialize state mutex","status":"not-applicable","project":false,"upstream":[{"sha":"549b71ce050637dd32678371ad76c445a2f8c9aa","url":"https://git.kernel.org/stable/c/549b71ce050637dd32678371ad76c445a2f8c9aa"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"549b71ce050637dd32678371ad76c445a2f8c9aa","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/549b71ce050637dd32678371ad76c445a2f8c9aa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98674","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98674.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98665","title":"iio: health: max30102: fix NULL dereference in interrupt handler","status":"unfixed","project":false,"upstream":[{"sha":"f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d","url":"https://git.kernel.org/stable/c/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98665","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98665.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98661","title":"iio: light: rohm-bu27034: Fix infinite delay on error","status":"not-applicable","project":false,"upstream":[{"sha":"8065a6c02f629187131f3136bedb26f9080e3cca","url":"https://git.kernel.org/stable/c/8065a6c02f629187131f3136bedb26f9080e3cca"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"8065a6c02f629187131f3136bedb26f9080e3cca","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/8065a6c02f629187131f3136bedb26f9080e3cca.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98652","title":"KVM: s390: Add missing srcu in kvm_s390_set_irq_state()","status":"unknown","project":false,"upstream":[{"sha":"f3a557067d57ce6ae98d485c8009b223e16f5f36","url":"https://git.kernel.org/stable/c/f3a557067d57ce6ae98d485c8009b223e16f5f36"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"f3a557067d57ce6ae98d485c8009b223e16f5f36","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/f3a557067d57ce6ae98d485c8009b223e16f5f36.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98652","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98652.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98642","title":"bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk","status":"not-applicable","project":false,"upstream":[{"sha":"1c21452d02eec2f008e2c5535820f85adbd7587a","url":"https://git.kernel.org/stable/c/1c21452d02eec2f008e2c5535820f85adbd7587a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c21452d02eec2f008e2c5535820f85adbd7587a","lines":94,"reason":"","source":"https://github.com/torvalds/linux/commit/1c21452d02eec2f008e2c5535820f85adbd7587a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98642","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98642.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98634","title":"scsi: sd_zbc: Reject disks with too many zones","status":"unfixed","project":false,"upstream":[{"sha":"b6ec0f79745967c751c85df373062c8d15e45fc4","url":"https://git.kernel.org/stable/c/b6ec0f79745967c751c85df373062c8d15e45fc4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b6ec0f79745967c751c85df373062c8d15e45fc4","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/b6ec0f79745967c751c85df373062c8d15e45fc4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98628","title":"bpf: Make post-verification instruction rewrites killable","status":"unfixed","project":false,"upstream":[{"sha":"261b61d3735b042ae25634f795c4540be0fc140c","url":"https://git.kernel.org/stable/c/261b61d3735b042ae25634f795c4540be0fc140c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"261b61d3735b042ae25634f795c4540be0fc140c","lines":113,"reason":"","source":"https://github.com/torvalds/linux/commit/261b61d3735b042ae25634f795c4540be0fc140c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98628","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98628.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98620","title":"net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure","status":"unfixed","project":false,"upstream":[{"sha":"310d1ac61a4d5a2ca8356a3a48d263acf54503ce","url":"https://git.kernel.org/stable/c/310d1ac61a4d5a2ca8356a3a48d263acf54503ce"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"310d1ac61a4d5a2ca8356a3a48d263acf54503ce","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/310d1ac61a4d5a2ca8356a3a48d263acf54503ce.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98620","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98620.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98617","title":"eth: fbnic: use the Rx queue napi pointer to find the napi vector","status":"not-applicable","project":false,"upstream":[{"sha":"b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e","url":"https://git.kernel.org/stable/c/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98617","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98617.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98616","title":"eth: fbnic: reset num_napi when the napi vectors are freed","status":"not-applicable","project":false,"upstream":[{"sha":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","url":"https://git.kernel.org/stable/c/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98616","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98616.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98599","title":"bpf: Reject non-negative offsets in stack_slot_obj_get_spi()","status":"not-applicable","project":false,"upstream":[{"sha":"79a9172f3ab4ad8392c5e5c8944b9b7710ade620","url":"https://git.kernel.org/stable/c/79a9172f3ab4ad8392c5e5c8944b9b7710ade620"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"79a9172f3ab4ad8392c5e5c8944b9b7710ade620","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/79a9172f3ab4ad8392c5e5c8944b9b7710ade620.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98599","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98599.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98598","title":"ipv6: Prevent rt6_insert_exception() for dying fib6_info.","status":"unfixed","project":false,"upstream":[{"sha":"0346ec2f080b40d95ed05b853bb9226289e75212","url":"https://git.kernel.org/stable/c/0346ec2f080b40d95ed05b853bb9226289e75212"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0346ec2f080b40d95ed05b853bb9226289e75212","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/0346ec2f080b40d95ed05b853bb9226289e75212.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98598","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98598.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98589","title":"bpf: Reject pkt arguments in mutating subprogs","status":"unfixed","project":false,"upstream":[{"sha":"a6c1edfbe240e4377038a0e1d233ad81fde9a21b","url":"https://git.kernel.org/stable/c/a6c1edfbe240e4377038a0e1d233ad81fde9a21b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6c1edfbe240e4377038a0e1d233ad81fde9a21b","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/a6c1edfbe240e4377038a0e1d233ad81fde9a21b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98589","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98589.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98570","title":"net: ipv6: keep room for the mac header in dst_dev_overhead()","status":"unfixed","project":false,"upstream":[{"sha":"87cd6b717e4069dca34e0866e57eaeb44d3b173e","url":"https://git.kernel.org/stable/c/87cd6b717e4069dca34e0866e57eaeb44d3b173e"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"87cd6b717e4069dca34e0866e57eaeb44d3b173e","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/87cd6b717e4069dca34e0866e57eaeb44d3b173e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98570","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98570.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98565","title":"net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621","status":"unknown","project":false,"upstream":[{"sha":"c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4","url":"https://git.kernel.org/stable/c/c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98565","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98565.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98562","title":"net: libwx: fix races in Tx timestamp handling","status":"not-applicable","project":false,"upstream":[{"sha":"3173cba1170131816972ed2b6185cb970ba8b747","url":"https://git.kernel.org/stable/c/3173cba1170131816972ed2b6185cb970ba8b747"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"3173cba1170131816972ed2b6185cb970ba8b747","lines":295,"reason":"","source":"https://github.com/torvalds/linux/commit/3173cba1170131816972ed2b6185cb970ba8b747.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98562","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98562.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98558","title":"net: flush skb_defer_nodes in dev_cpu_dead()","status":"unfixed","project":false,"upstream":[{"sha":"06e3f54e8b22040ada01a28343badf1990b4dd7d","url":"https://git.kernel.org/stable/c/06e3f54e8b22040ada01a28343badf1990b4dd7d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"06e3f54e8b22040ada01a28343badf1990b4dd7d","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/06e3f54e8b22040ada01a28343badf1990b4dd7d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98558","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98558.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98556","title":"gve: DQO: reject TSO packets with an out of range MSS","status":"unfixed","project":false,"upstream":[{"sha":"296c83b5ccc808c080865eb20fd7a477b0355bb7","url":"https://git.kernel.org/stable/c/296c83b5ccc808c080865eb20fd7a477b0355bb7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"296c83b5ccc808c080865eb20fd7a477b0355bb7","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/296c83b5ccc808c080865eb20fd7a477b0355bb7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98556","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98556.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98551","title":"perf/core: Fill branch entries with a single assignment","status":"unfixed","project":false,"upstream":[{"sha":"24b620729e53d978b3e425f55bc66efd3bab1f59","url":"https://git.kernel.org/stable/c/24b620729e53d978b3e425f55bc66efd3bab1f59"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"24b620729e53d978b3e425f55bc66efd3bab1f59","lines":163,"reason":"","source":"https://github.com/torvalds/linux/commit/24b620729e53d978b3e425f55bc66efd3bab1f59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98551","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98551.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98539","title":"fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga","status":"unfixed","project":false,"upstream":[{"sha":"1abd643f3783ea8f8e273c18697ff0413aa92dc7","url":"https://git.kernel.org/stable/c/1abd643f3783ea8f8e273c18697ff0413aa92dc7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1abd643f3783ea8f8e273c18697ff0413aa92dc7","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/1abd643f3783ea8f8e273c18697ff0413aa92dc7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98539","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98539.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98525","title":"mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()","status":"unfixed","project":false,"upstream":[{"sha":"26cc0e69cce062cd3aa6fae33074684669c35a71","url":"https://git.kernel.org/stable/c/26cc0e69cce062cd3aa6fae33074684669c35a71"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"26cc0e69cce062cd3aa6fae33074684669c35a71","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/26cc0e69cce062cd3aa6fae33074684669c35a71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98525","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98525.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98509","title":"drm/virtio: fix memory leak of fence event on execbuffer failure","status":"unknown","project":false,"upstream":[{"sha":"b74aad23d99b279bb34d135795f39a6d8ecdc075","url":"https://git.kernel.org/stable/c/b74aad23d99b279bb34d135795f39a6d8ecdc075"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"b74aad23d99b279bb34d135795f39a6d8ecdc075","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/b74aad23d99b279bb34d135795f39a6d8ecdc075.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98509","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98509.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98508","title":"drm/virtio: fix NULL pointer dereference on fence allocation failure","status":"unknown","project":false,"upstream":[{"sha":"846b3c64fe3e77d9db20a7e3e62dbbb637c773e1","url":"https://git.kernel.org/stable/c/846b3c64fe3e77d9db20a7e3e62dbbb637c773e1"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"846b3c64fe3e77d9db20a7e3e62dbbb637c773e1","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/846b3c64fe3e77d9db20a7e3e62dbbb637c773e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98508","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98508.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98506","title":"mm/hugetlb: do not dissolve gigantic pages without runtime support","status":"unfixed","project":false,"upstream":[{"sha":"a363c62a653cc8b3e21da9545fa4e028ef50f9c3","url":"https://git.kernel.org/stable/c/a363c62a653cc8b3e21da9545fa4e028ef50f9c3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a363c62a653cc8b3e21da9545fa4e028ef50f9c3","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/a363c62a653cc8b3e21da9545fa4e028ef50f9c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98506","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98506.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98505","title":"mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()","status":"unfixed","project":false,"upstream":[{"sha":"39c0ceedd54557bdc1542de08d22b2ed33e534e4","url":"https://git.kernel.org/stable/c/39c0ceedd54557bdc1542de08d22b2ed33e534e4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"39c0ceedd54557bdc1542de08d22b2ed33e534e4","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/39c0ceedd54557bdc1542de08d22b2ed33e534e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98505","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98505.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98503","title":"packet: use ubuf_info completion for TX_RING packets","status":"unfixed","project":false,"upstream":[{"sha":"9518405613863d0bf0700927a21367f5942cf058","url":"https://git.kernel.org/stable/c/9518405613863d0bf0700927a21367f5942cf058"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"9518405613863d0bf0700927a21367f5942cf058","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/9518405613863d0bf0700927a21367f5942cf058.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98503","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98503.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98473","title":"s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config","status":"not-applicable","project":false,"upstream":[{"sha":"65e05ec252a9b79e75930d3c4dd42d8877db04c5","url":"https://git.kernel.org/stable/c/65e05ec252a9b79e75930d3c4dd42d8877db04c5"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"65e05ec252a9b79e75930d3c4dd42d8877db04c5","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/65e05ec252a9b79e75930d3c4dd42d8877db04c5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98473","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98473.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98471","title":"KVM: SEV: Do cache maintenance on the source VM during intra-host migration","status":"unfixed","project":false,"upstream":[{"sha":"93de2a6a4b91b72607136dd656edf03fb399d27f","url":"https://git.kernel.org/stable/c/93de2a6a4b91b72607136dd656edf03fb399d27f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"93de2a6a4b91b72607136dd656edf03fb399d27f","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/93de2a6a4b91b72607136dd656edf03fb399d27f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98471","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98471.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98466","title":"KVM: arm64: Transfer the hyp stack pages out of the host stage-2","status":"unfixed","project":false,"upstream":[{"sha":"3a8c562892b96f35bba1e00d5e455a15963bbb92","url":"https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a8c562892b96f35bba1e00d5e455a15963bbb92","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/3a8c562892b96f35bba1e00d5e455a15963bbb92.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98466","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98466.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98458","title":"Bluetooth: ISO: release unused CIS holds after channel attach","status":"not-applicable","project":false,"upstream":[{"sha":"0fcd4dad555c96e0bd3a1b8c569f989be85c7341","url":"https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fcd4dad555c96e0bd3a1b8c569f989be85c7341","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/0fcd4dad555c96e0bd3a1b8c569f989be85c7341.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98458","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98458.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98452","title":"smb: client: clean up failed cached directory opens","status":"unfixed","project":false,"upstream":[{"sha":"d2ff5fb93ea83034025850266b5eed391f96b825","url":"https://git.kernel.org/stable/c/d2ff5fb93ea83034025850266b5eed391f96b825"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2ff5fb93ea83034025850266b5eed391f96b825","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/d2ff5fb93ea83034025850266b5eed391f96b825.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98452","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98452.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98449","title":"smb: client: delete compound mids on send failure before unlock","status":"unfixed","project":false,"upstream":[{"sha":"8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9","url":"https://git.kernel.org/stable/c/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98444","title":"xfs: drop dquot flush lock when we can't find a buffer to flush","status":"not-applicable","project":false,"upstream":[{"sha":"ffb48dccce1960a9ea24463a2f3c21d124d6b672","url":"https://git.kernel.org/stable/c/ffb48dccce1960a9ea24463a2f3c21d124d6b672"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ffb48dccce1960a9ea24463a2f3c21d124d6b672","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/ffb48dccce1960a9ea24463a2f3c21d124d6b672.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98444","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98444.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98439","title":"smb/server: cancel async requests when closing connection","status":"unfixed","project":false,"upstream":[{"sha":"4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851","url":"https://git.kernel.org/stable/c/4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98439","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98439.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98436","title":"accel/amdxdna: Disable device buffer exporting","status":"not-applicable","project":false,"upstream":[{"sha":"9480dd7ec3fcadd4217503e4bb32c16e19e4b21f","url":"https://git.kernel.org/stable/c/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"9480dd7ec3fcadd4217503e4bb32c16e19e4b21f","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98436","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98436.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98435","title":"EDAC/altera: Use parent device for devres in altr_portb_setup()","status":"unfixed","project":false,"upstream":[{"sha":"9868f5c077dfe0b606331f2e782484f91a5789a5","url":"https://git.kernel.org/stable/c/9868f5c077dfe0b606331f2e782484f91a5789a5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9868f5c077dfe0b606331f2e782484f91a5789a5","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/9868f5c077dfe0b606331f2e782484f91a5789a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98435","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98435.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98431","title":"RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency","status":"not-applicable","project":false,"upstream":[{"sha":"a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","url":"https://git.kernel.org/stable/c/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98431","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98431.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98427","title":"net/sched: codel: bound the dropping loop per dequeue call","status":"unfixed","project":false,"upstream":[{"sha":"7f4a5ec6258fd7c92633ec4b0493fc51166d9398","url":"https://git.kernel.org/stable/c/7f4a5ec6258fd7c92633ec4b0493fc51166d9398"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f4a5ec6258fd7c92633ec4b0493fc51166d9398","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7f4a5ec6258fd7c92633ec4b0493fc51166d9398.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98427","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98427.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98425","title":"wifi: mac80211: don't warn when an IBSS has no channel to scan","status":"unfixed","project":false,"upstream":[{"sha":"a7491b7efbd9136b120a12ed72af9c12121dd134","url":"https://git.kernel.org/stable/c/a7491b7efbd9136b120a12ed72af9c12121dd134"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a7491b7efbd9136b120a12ed72af9c12121dd134","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/a7491b7efbd9136b120a12ed72af9c12121dd134.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98425","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98425.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98424","title":"wifi: cfg80211: undo netns switch if renaming the wiphy fails","status":"unfixed","project":false,"upstream":[{"sha":"a41bd1938a9bfe226d444172a7e20e4bd5097960","url":"https://git.kernel.org/stable/c/a41bd1938a9bfe226d444172a7e20e4bd5097960"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"a41bd1938a9bfe226d444172a7e20e4bd5097960","lines":117,"reason":"","source":"https://github.com/torvalds/linux/commit/a41bd1938a9bfe226d444172a7e20e4bd5097960.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98420","title":"ksmbd: follow SMB2 session expiration semantics","status":"unfixed","project":false,"upstream":[{"sha":"d7fd1f98607f2cd358e583f9548bdf0173090a86","url":"https://git.kernel.org/stable/c/d7fd1f98607f2cd358e583f9548bdf0173090a86"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d7fd1f98607f2cd358e583f9548bdf0173090a86","lines":441,"reason":"","source":"https://github.com/torvalds/linux/commit/d7fd1f98607f2cd358e583f9548bdf0173090a86.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98420","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98420.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98408","title":"watchdog: rzv2h: Avoid division by zero","status":"not-applicable","project":false,"upstream":[{"sha":"6274281c41efa8dd1aa5234c59ad904ff89d7af4","url":"https://git.kernel.org/stable/c/6274281c41efa8dd1aa5234c59ad904ff89d7af4"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"6274281c41efa8dd1aa5234c59ad904ff89d7af4","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/6274281c41efa8dd1aa5234c59ad904ff89d7af4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98408","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98408.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98403","title":"s390/boot: Avoid IPL parameter append past command line","status":"unfixed","project":false,"upstream":[{"sha":"d76181dfabdaa720703167393704efacba343442","url":"https://git.kernel.org/stable/c/d76181dfabdaa720703167393704efacba343442"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d76181dfabdaa720703167393704efacba343442","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/d76181dfabdaa720703167393704efacba343442.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98403","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98403.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98401","title":"net: iptunnel: fix stale transport header during tunnel decapsulation","status":"unfixed","project":false,"upstream":[{"sha":"28a57fb2c5df4deb42a06e52fd36c14b37aa0034","url":"https://git.kernel.org/stable/c/28a57fb2c5df4deb42a06e52fd36c14b37aa0034"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"28a57fb2c5df4deb42a06e52fd36c14b37aa0034","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/28a57fb2c5df4deb42a06e52fd36c14b37aa0034.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98401","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98401.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98400","title":"s390/ipl: Fix NULL deref in kdump without re-IPL parm block","status":"unfixed","project":false,"upstream":[{"sha":"7f918871112e8e7c581e99eb8e545af4e59c8367","url":"https://git.kernel.org/stable/c/7f918871112e8e7c581e99eb8e545af4e59c8367"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f918871112e8e7c581e99eb8e545af4e59c8367","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7f918871112e8e7c581e99eb8e545af4e59c8367.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98400.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98399","title":"s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block","status":"unfixed","project":false,"upstream":[{"sha":"37f61b71cbc0caefc01022a19ee56fc2510e2e6e","url":"https://git.kernel.org/stable/c/37f61b71cbc0caefc01022a19ee56fc2510e2e6e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"37f61b71cbc0caefc01022a19ee56fc2510e2e6e","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/37f61b71cbc0caefc01022a19ee56fc2510e2e6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98399","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98399.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98394","title":"af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.","status":"unfixed","project":false,"upstream":[{"sha":"6e5ee08eb5858d175da6768d75d163817b6a9d4a","url":"https://git.kernel.org/stable/c/6e5ee08eb5858d175da6768d75d163817b6a9d4a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6e5ee08eb5858d175da6768d75d163817b6a9d4a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/6e5ee08eb5858d175da6768d75d163817b6a9d4a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98394","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98394.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98393","title":"net: ipv4: Fix UDP length overflow with PMTU discover and big MTU","status":"unfixed","project":false,"upstream":[{"sha":"b83641e0ab8b20eefcc4cdc5a059f897375291a2","url":"https://git.kernel.org/stable/c/b83641e0ab8b20eefcc4cdc5a059f897375291a2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b83641e0ab8b20eefcc4cdc5a059f897375291a2","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b83641e0ab8b20eefcc4cdc5a059f897375291a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98393","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98393.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98387","title":"s390/crypto: Fix skcipher_walk return code handling in aes_s390","status":"unfixed","project":false,"upstream":[{"sha":"15fa028589c3a2545f0bff355eff06d5844196bf","url":"https://git.kernel.org/stable/c/15fa028589c3a2545f0bff355eff06d5844196bf"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"15fa028589c3a2545f0bff355eff06d5844196bf","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/15fa028589c3a2545f0bff355eff06d5844196bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98387","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98387.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98376","title":"bpf: Use array_map_meta_equal for percpu array inner map replacement","status":"not-applicable","project":false,"upstream":[{"sha":"593980175389a05793f6060aa20e626330960395","url":"https://git.kernel.org/stable/c/593980175389a05793f6060aa20e626330960395"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"593980175389a05793f6060aa20e626330960395","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/593980175389a05793f6060aa20e626330960395.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98376","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98376.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98365","title":"RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access","status":"unfixed","project":false,"upstream":[{"sha":"d10e2a08799e858d3e71ea4169bcd018f216d444","url":"https://git.kernel.org/stable/c/d10e2a08799e858d3e71ea4169bcd018f216d444"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d10e2a08799e858d3e71ea4169bcd018f216d444","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d10e2a08799e858d3e71ea4169bcd018f216d444.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98365","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98365.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98364","title":"xfrm: hold net_device reference under RCU in bundle creation","status":"unfixed","project":false,"upstream":[{"sha":"9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","url":"https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98364","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98364.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98355","title":"RDMA/rtrs: guard against null kobj name","status":"unfixed","project":false,"upstream":[{"sha":"99c24a8968ebef0573825b5cb89d5985d51635b9","url":"https://git.kernel.org/stable/c/99c24a8968ebef0573825b5cb89d5985d51635b9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"99c24a8968ebef0573825b5cb89d5985d51635b9","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/99c24a8968ebef0573825b5cb89d5985d51635b9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98353","title":"RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables","status":"unfixed","project":false,"upstream":[{"sha":"00baeade709fb66da647e8327e8398bb532e30f7","url":"https://git.kernel.org/stable/c/00baeade709fb66da647e8327e8398bb532e30f7"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00baeade709fb66da647e8327e8398bb532e30f7","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/00baeade709fb66da647e8327e8398bb532e30f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98353","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98353.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98341","title":"wifi: cfg80211: don't free driver-owned scan requests","status":"unfixed","project":false,"upstream":[{"sha":"dab68a74e90b8e07f08ed9deaa5884857a3cfe89","url":"https://git.kernel.org/stable/c/dab68a74e90b8e07f08ed9deaa5884857a3cfe89"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"dab68a74e90b8e07f08ed9deaa5884857a3cfe89","lines":100,"reason":"","source":"https://github.com/torvalds/linux/commit/dab68a74e90b8e07f08ed9deaa5884857a3cfe89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98341","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98341.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98338","title":"wifi: cfg80211: ibss: ref BSS entry for joined event","status":"unfixed","project":false,"upstream":[{"sha":"708f9d43d6a2eb9c6b83fe62af628de9dffd9314","url":"https://git.kernel.org/stable/c/708f9d43d6a2eb9c6b83fe62af628de9dffd9314"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"708f9d43d6a2eb9c6b83fe62af628de9dffd9314","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/708f9d43d6a2eb9c6b83fe62af628de9dffd9314.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98338","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98338.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98337","title":"wifi: mac80211: don't start a ROC while scanning","status":"unfixed","project":false,"upstream":[{"sha":"733f0fde95392ed5f61a4e36aee661ea8d0e8581","url":"https://git.kernel.org/stable/c/733f0fde95392ed5f61a4e36aee661ea8d0e8581"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"733f0fde95392ed5f61a4e36aee661ea8d0e8581","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/733f0fde95392ed5f61a4e36aee661ea8d0e8581.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98335","title":"wifi: mac80211: abort chanswitch when leaving a mesh","status":"unfixed","project":false,"upstream":[{"sha":"ac7472a24bd433b81c06582835dd1d5547c10da9","url":"https://git.kernel.org/stable/c/ac7472a24bd433b81c06582835dd1d5547c10da9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac7472a24bd433b81c06582835dd1d5547c10da9","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/ac7472a24bd433b81c06582835dd1d5547c10da9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98335","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98335.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98334","title":"wifi: mac80211: reset state when starting AP fails","status":"unfixed","project":false,"upstream":[{"sha":"3f28551d0241254a75626d868041c6340285088b","url":"https://git.kernel.org/stable/c/3f28551d0241254a75626d868041c6340285088b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f28551d0241254a75626d868041c6340285088b","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/3f28551d0241254a75626d868041c6340285088b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98333","title":"wifi: mac80211: reset the LED state when ifup fails","status":"unfixed","project":false,"upstream":[{"sha":"78183e8331958fda11cd2b6850bb424a9747c4b2","url":"https://git.kernel.org/stable/c/78183e8331958fda11cd2b6850bb424a9747c4b2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"78183e8331958fda11cd2b6850bb424a9747c4b2","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/78183e8331958fda11cd2b6850bb424a9747c4b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98332","title":"wifi: mac80211: only operate on TDLS peers in the TDLS code","status":"unfixed","project":false,"upstream":[{"sha":"6f0a100df8539ce90f37c14e1945f396ca2410bc","url":"https://git.kernel.org/stable/c/6f0a100df8539ce90f37c14e1945f396ca2410bc"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f0a100df8539ce90f37c14e1945f396ca2410bc","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/6f0a100df8539ce90f37c14e1945f396ca2410bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98332","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98332.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98330","title":"wifi: cfg80211: get the wiphy out of a dying network namespace","status":"unfixed","project":false,"upstream":[{"sha":"4635b1a1c1d693178a537446a6e09963f0fdae52","url":"https://git.kernel.org/stable/c/4635b1a1c1d693178a537446a6e09963f0fdae52"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4635b1a1c1d693178a537446a6e09963f0fdae52","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/4635b1a1c1d693178a537446a6e09963f0fdae52.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98330","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98330.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98329","title":"wifi: mac80211: don't allow injecting frames wider than the chanctx","status":"unfixed","project":false,"upstream":[{"sha":"e14bf37bb2b3853012ff160131d1c6233f7a9cc9","url":"https://git.kernel.org/stable/c/e14bf37bb2b3853012ff160131d1c6233f7a9cc9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e14bf37bb2b3853012ff160131d1c6233f7a9cc9","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/e14bf37bb2b3853012ff160131d1c6233f7a9cc9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98329","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98329.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98327","title":"wifi: mac80211: mesh: reset the CSA state when leaving","status":"unfixed","project":false,"upstream":[{"sha":"860134b3af77970e006feab7e5decb8c84771c7f","url":"https://git.kernel.org/stable/c/860134b3af77970e006feab7e5decb8c84771c7f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"860134b3af77970e006feab7e5decb8c84771c7f","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/860134b3af77970e006feab7e5decb8c84771c7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98327","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98327.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98321","title":"netfilter: nf_nat: unregister and release hooks on error","status":"unfixed","project":false,"upstream":[{"sha":"cbdd39ce42530a193c56beb206a3356cb6d01016","url":"https://git.kernel.org/stable/c/cbdd39ce42530a193c56beb206a3356cb6d01016"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cbdd39ce42530a193c56beb206a3356cb6d01016","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/cbdd39ce42530a193c56beb206a3356cb6d01016.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98321","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98321.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98318","title":"smb: client: validate absolute native symlink targets before NT fixups","status":"not-applicable","project":false,"upstream":[{"sha":"23c240d9509e15f72e4112fc95f0160ab32ec430","url":"https://git.kernel.org/stable/c/23c240d9509e15f72e4112fc95f0160ab32ec430"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"23c240d9509e15f72e4112fc95f0160ab32ec430","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/23c240d9509e15f72e4112fc95f0160ab32ec430.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98318","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98318.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98317","title":"neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.","status":"unfixed","project":false,"upstream":[{"sha":"6d79b223ec44ada58ad37db42f539b60985a7722","url":"https://git.kernel.org/stable/c/6d79b223ec44ada58ad37db42f539b60985a7722"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6d79b223ec44ada58ad37db42f539b60985a7722","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/6d79b223ec44ada58ad37db42f539b60985a7722.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98313","title":"drm/msm/dp: skip PUSH_IDLE when the link was never enabled","status":"unfixed","project":false,"upstream":[{"sha":"e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","url":"https://git.kernel.org/stable/c/e249a6e2a130c08bb4d8b0a55cbe29754307e5c9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/e249a6e2a130c08bb4d8b0a55cbe29754307e5c9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98309","title":"drm/vc4: Use managed KMS polling to fix UAF on unbind","status":"unfixed","project":false,"upstream":[{"sha":"073a30d75f309812ed61af134f24ffef4107b13a","url":"https://git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"073a30d75f309812ed61af134f24ffef4107b13a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/073a30d75f309812ed61af134f24ffef4107b13a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98309","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98309.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98307","title":"wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()","status":"unfixed","project":false,"upstream":[{"sha":"820b8cff81c796ba20573e04722ab62500713f97","url":"https://git.kernel.org/stable/c/820b8cff81c796ba20573e04722ab62500713f97"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"820b8cff81c796ba20573e04722ab62500713f97","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/820b8cff81c796ba20573e04722ab62500713f97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98307","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98307.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98304","title":"net: bcmgenet: restore the hardware filters on open","status":"unfixed","project":false,"upstream":[{"sha":"23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","url":"https://git.kernel.org/stable/c/23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98304","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98304.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98297","title":"Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained","status":"queued","project":false,"upstream":[{"sha":"6610c6fe4b8936c232048e6049bf77c70a6f759c","url":"https://git.kernel.org/stable/c/6610c6fe4b8936c232048e6049bf77c70a6f759c"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/bluetooth-hci_core-fix-queuing-tx_work-after-workque.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"unknown","patches":[{"sha":"6610c6fe4b8936c232048e6049bf77c70a6f759c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98297.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98296","title":"Bluetooth: btintel_pcie: validate TX skb length in send_sync","status":"not-applicable","project":false,"upstream":[{"sha":"4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","url":"https://git.kernel.org/stable/c/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98296","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98296.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98295","title":"Bluetooth: coredump: Quiesce dump work on unregister","status":"unfixed","project":false,"upstream":[{"sha":"d236517c264e41dc09833c708ef23bccb7a91219","url":"https://git.kernel.org/stable/c/d236517c264e41dc09833c708ef23bccb7a91219"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d236517c264e41dc09833c708ef23bccb7a91219","lines":128,"reason":"","source":"https://github.com/torvalds/linux/commit/d236517c264e41dc09833c708ef23bccb7a91219.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98295","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98295.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98294","title":"Bluetooth: hci_qca: Do not write to the serial port after it is closed","status":"unfixed","project":false,"upstream":[{"sha":"4e93c65f87825e1e012bce56615320aeb123815d","url":"https://git.kernel.org/stable/c/4e93c65f87825e1e012bce56615320aeb123815d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4e93c65f87825e1e012bce56615320aeb123815d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/4e93c65f87825e1e012bce56615320aeb123815d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98294","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98294.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98292","title":"Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access","status":"unfixed","project":false,"upstream":[{"sha":"8879e3e0a84a86954c855caceead4867e74a9a27","url":"https://git.kernel.org/stable/c/8879e3e0a84a86954c855caceead4867e74a9a27"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8879e3e0a84a86954c855caceead4867e74a9a27","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/8879e3e0a84a86954c855caceead4867e74a9a27.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98292","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98292.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98289","title":"af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().","status":"unfixed","project":false,"upstream":[{"sha":"4a4263dfeabad72f95e8ab6e15146861fa4144dd","url":"https://git.kernel.org/stable/c/4a4263dfeabad72f95e8ab6e15146861fa4144dd"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4a4263dfeabad72f95e8ab6e15146861fa4144dd","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/4a4263dfeabad72f95e8ab6e15146861fa4144dd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98288","title":"net: stmmac: fix TSO header length truncation","status":"unfixed","project":false,"upstream":[{"sha":"15989abd74f16f44bf953d056b95f1d2fda9b0cd","url":"https://git.kernel.org/stable/c/15989abd74f16f44bf953d056b95f1d2fda9b0cd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"15989abd74f16f44bf953d056b95f1d2fda9b0cd","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/15989abd74f16f44bf953d056b95f1d2fda9b0cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98286","title":"drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown","status":"unfixed","project":false,"upstream":[{"sha":"c391a40f71886b28c082b47270f0e856fa3e1150","url":"https://git.kernel.org/stable/c/c391a40f71886b28c082b47270f0e856fa3e1150"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c391a40f71886b28c082b47270f0e856fa3e1150","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/c391a40f71886b28c082b47270f0e856fa3e1150.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98286","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98286.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98285","title":"net: bridge: vlan: fix bugs caused by switchdev deletion errors","status":"unfixed","project":false,"upstream":[{"sha":"2842ce397dd09882530b42f7fdb0c855767eb24e","url":"https://git.kernel.org/stable/c/2842ce397dd09882530b42f7fdb0c855767eb24e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2842ce397dd09882530b42f7fdb0c855767eb24e","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/2842ce397dd09882530b42f7fdb0c855767eb24e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98285","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98285.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98284","title":"netlink: do not free nlk->groups while lockless readers can use it","status":"unfixed","project":false,"upstream":[{"sha":"ceac0de741bfb47ca255eee075257b3bb31f0651","url":"https://git.kernel.org/stable/c/ceac0de741bfb47ca255eee075257b3bb31f0651"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ceac0de741bfb47ca255eee075257b3bb31f0651","lines":101,"reason":"","source":"https://github.com/torvalds/linux/commit/ceac0de741bfb47ca255eee075257b3bb31f0651.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98284","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98284.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98279","title":"btrfs: handle lack of space when cleaning up verity items","status":"unfixed","project":false,"upstream":[{"sha":"76bf149cd0298544631e756670b89c399c7acbca","url":"https://git.kernel.org/stable/c/76bf149cd0298544631e756670b89c399c7acbca"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"76bf149cd0298544631e756670b89c399c7acbca","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/76bf149cd0298544631e756670b89c399c7acbca.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98279","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98279.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98277","title":"eth: fbnic: ring the doorbell if a burst ends in a drop","status":"not-applicable","project":false,"upstream":[{"sha":"490599ab23134962a6d18a024e84541d77bdb999","url":"https://git.kernel.org/stable/c/490599ab23134962a6d18a024e84541d77bdb999"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"490599ab23134962a6d18a024e84541d77bdb999","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/490599ab23134962a6d18a024e84541d77bdb999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98277","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98277.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98273","title":"x86/kprobes: Fix crash when probing CS CALL instructions","status":"unfixed","project":false,"upstream":[{"sha":"a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","url":"https://git.kernel.org/stable/c/a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98273","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98273.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98271","title":"net: skbuff: do not leave stale header offsets after pskb_carve()","status":"unfixed","project":false,"upstream":[{"sha":"a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","url":"https://git.kernel.org/stable/c/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98271","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98271.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98269","title":"btrfs: abort transaction on failure to update inode for hole punching and reflinking","status":"unfixed","project":false,"upstream":[{"sha":"97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","url":"https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98269","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98269.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98266","title":"ALSA: core: Fix potential UAF after asynchronous card release","status":"unfixed","project":false,"upstream":[{"sha":"fd95e68df6fe66344161a1329cbe5e5805e7b704","url":"https://git.kernel.org/stable/c/fd95e68df6fe66344161a1329cbe5e5805e7b704"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd95e68df6fe66344161a1329cbe5e5805e7b704","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/fd95e68df6fe66344161a1329cbe5e5805e7b704.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98266","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98266.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98254","title":"swiotlb: use the adjusted address for the highmem page lookup","status":"unfixed","project":false,"upstream":[{"sha":"b7d7914a9ae3097e63d113007e4fb44d33d515b1","url":"https://git.kernel.org/stable/c/b7d7914a9ae3097e63d113007e4fb44d33d515b1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b7d7914a9ae3097e63d113007e4fb44d33d515b1","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/b7d7914a9ae3097e63d113007e4fb44d33d515b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98254","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98254.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98248","title":"arm64: percpu: Fix LSE operations on {8,16}-bit types","status":"unfixed","project":false,"upstream":[{"sha":"8cf2093f5372952a9ebc805c418d45df7112cd14","url":"https://git.kernel.org/stable/c/8cf2093f5372952a9ebc805c418d45df7112cd14"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8cf2093f5372952a9ebc805c418d45df7112cd14","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/8cf2093f5372952a9ebc805c418d45df7112cd14.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98248","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98248.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98229","title":"xfrm: save input state data before secpath resets","status":"unfixed","project":false,"upstream":[{"sha":"3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","url":"https://git.kernel.org/stable/c/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98229","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98229.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98228","title":"mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ","status":"not-applicable","project":false,"upstream":[{"sha":"bbc448c541ed90d52f9ec22f17394304e3bf170e","url":"https://git.kernel.org/stable/c/bbc448c541ed90d52f9ec22f17394304e3bf170e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"bbc448c541ed90d52f9ec22f17394304e3bf170e","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/bbc448c541ed90d52f9ec22f17394304e3bf170e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98228","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98228.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98222","title":"KEYS: encrypted: fix integer overflow of datablob_len","status":"unfixed","project":false,"upstream":[{"sha":"8697c431e297eb0d0ab13dda6bc172b48a34f05c","url":"https://git.kernel.org/stable/c/8697c431e297eb0d0ab13dda6bc172b48a34f05c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8697c431e297eb0d0ab13dda6bc172b48a34f05c","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/8697c431e297eb0d0ab13dda6bc172b48a34f05c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98222","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98222.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98212","title":"mmc: hsq: Fix use-after-free in retry work","status":"unfixed","project":false,"upstream":[{"sha":"5d132990475f02cfa1debe03d50b479432864ebd","url":"https://git.kernel.org/stable/c/5d132990475f02cfa1debe03d50b479432864ebd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5d132990475f02cfa1debe03d50b479432864ebd","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/5d132990475f02cfa1debe03d50b479432864ebd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98212","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98212.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98211","title":"mmc: mmci: Fix use-after-free in busy-timeout work","status":"not-applicable","project":false,"upstream":[{"sha":"2b19cf3e50cddaff07b657dae1a8f30f06032852","url":"https://git.kernel.org/stable/c/2b19cf3e50cddaff07b657dae1a8f30f06032852"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b19cf3e50cddaff07b657dae1a8f30f06032852","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/2b19cf3e50cddaff07b657dae1a8f30f06032852.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98182","title":"wifi: mac80211: refuse to make a monitor active when it has no queue","status":"unfixed","project":false,"upstream":[{"sha":"2b04d6556964ae9f89819b86a0a7801e39c3aae5","url":"https://git.kernel.org/stable/c/2b04d6556964ae9f89819b86a0a7801e39c3aae5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b04d6556964ae9f89819b86a0a7801e39c3aae5","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/2b04d6556964ae9f89819b86a0a7801e39c3aae5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98182","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98182.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98180","title":"drm/msm: RCU-free the scheduler-containing ring and VM objects","status":"unfixed","project":false,"upstream":[{"sha":"01c8d1f385f788f1bbbbb7687c4386d614281218","url":"https://git.kernel.org/stable/c/01c8d1f385f788f1bbbbb7687c4386d614281218"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"01c8d1f385f788f1bbbbb7687c4386d614281218","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/01c8d1f385f788f1bbbbb7687c4386d614281218.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98180","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98180.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98179","title":"drm/amdgpu: fix rmmio iounmap skipped on device removal","status":"unfixed","project":false,"upstream":[{"sha":"5155002b03b24ba3ef91c5c313b8cf0171b24904","url":"https://git.kernel.org/stable/c/5155002b03b24ba3ef91c5c313b8cf0171b24904"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5155002b03b24ba3ef91c5c313b8cf0171b24904","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/5155002b03b24ba3ef91c5c313b8cf0171b24904.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98179","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98179.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98177","title":"drm/amdkfd: Avoid integer underflow in EOP ring size calculation.","status":"unfixed","project":false,"upstream":[{"sha":"8ee521b8b189799e361d4233c5180ba56656d4d4","url":"https://git.kernel.org/stable/c/8ee521b8b189799e361d4233c5180ba56656d4d4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ee521b8b189799e361d4233c5180ba56656d4d4","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/8ee521b8b189799e361d4233c5180ba56656d4d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98177","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98177.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98176","title":"drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc","status":"unfixed","project":false,"upstream":[{"sha":"c883d0a132d430ef7ebb23fd94323be94d0fbdb8","url":"https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c883d0a132d430ef7ebb23fd94323be94d0fbdb8","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/c883d0a132d430ef7ebb23fd94323be94d0fbdb8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98176","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98176.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98175","title":"smb: client: cancel reconnect work in clean_demultiplex_info()","status":"unfixed","project":false,"upstream":[{"sha":"c65eae6f61d1778ff7a82e4aae4080e26f486af1","url":"https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c65eae6f61d1778ff7a82e4aae4080e26f486af1","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/c65eae6f61d1778ff7a82e4aae4080e26f486af1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98175","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98175.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98174","title":"smb: client: fix rlist race and missing initialization","status":"unfixed","project":false,"upstream":[{"sha":"5f270f091256da1338c3631083e15d7f83cc05e1","url":"https://git.kernel.org/stable/c/5f270f091256da1338c3631083e15d7f83cc05e1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5f270f091256da1338c3631083e15d7f83cc05e1","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/5f270f091256da1338c3631083e15d7f83cc05e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98164","title":"KVM: x86/mmu: Check write tracking in all address spaces","status":"backported","project":true,"upstream":[{"sha":"0f38453cdb2e17566ccb7c0f3dabd5bd21caca26","url":"https://git.kernel.org/stable/c/0f38453cdb2e17566ccb7c0f3dabd5bd21caca26"}],"evidence":[{"url":"https://git.kernel.org/stable/c/09aa68552d2542cc6c23edd1568ac265dc5d886f","label":"09aa68552d25","date":"2026-09-02T14:28:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0f38453cdb2e17566ccb7c0f3dabd5bd21caca26","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98164","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98164.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98162","title":"smb/server: fix tree connection leak in smb2_tree_connect()","status":"unfixed","project":false,"upstream":[{"sha":"39f2032096715daae5f6fd0f587ca7a474b019df","url":"https://git.kernel.org/stable/c/39f2032096715daae5f6fd0f587ca7a474b019df"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"39f2032096715daae5f6fd0f587ca7a474b019df","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/39f2032096715daae5f6fd0f587ca7a474b019df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98162","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98162.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98161","title":"nvdimm: pmem: keep PREFLUSH before data writes","status":"unfixed","project":false,"upstream":[{"sha":"c644a2f8fef5618fcf453c591177700fd07dd024","url":"https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c644a2f8fef5618fcf453c591177700fd07dd024","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/c644a2f8fef5618fcf453c591177700fd07dd024.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98156","title":"drm/virtio: use the DMA API for resource backing on Xen","status":"unfixed","project":false,"upstream":[{"sha":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","url":"https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98156.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98153","title":"nvme: fix racy access to FDP placement id array","status":"not-applicable","project":false,"upstream":[{"sha":"56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","url":"https://git.kernel.org/stable/c/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98153","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98153.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98148","title":"drm/gud: validate GUD_ROTATION_0 is present in supported rotations","status":"unfixed","project":false,"upstream":[{"sha":"cb732d027aa18e1fcf9d2797f47d20b179ebc59c","url":"https://git.kernel.org/stable/c/cb732d027aa18e1fcf9d2797f47d20b179ebc59c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cb732d027aa18e1fcf9d2797f47d20b179ebc59c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/cb732d027aa18e1fcf9d2797f47d20b179ebc59c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98148","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98148.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98144","title":"accel/amdxdna: put the chained BO when its mapping fails","status":"not-applicable","project":false,"upstream":[{"sha":"7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","url":"https://git.kernel.org/stable/c/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98144","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98144.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98142","title":"drm/cirrus-qemu: Validate BAR0 size during probe","status":"unfixed","project":false,"upstream":[{"sha":"92312d333bf700798f92f30406c721bce87506f3","url":"https://git.kernel.org/stable/c/92312d333bf700798f92f30406c721bce87506f3"}],"evidence":[],"submission_lore":[],"basis":"cirrus_pci_probe() supports the Cirrus 5446 QEMU PCI ID and maps BAR0 without verifying its length is at least CIRRUS_VRAM_SIZE, preserving the short-BAR access bug.","review":{"id":"CVE-2026-98142","series":"6.1.y","upstream":["92312d333bf700798f92f30406c721bce87506f3"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"cirrus_pci_probe() supports the Cirrus 5446 QEMU PCI ID and maps BAR0 without verifying its length is at least CIRRUS_VRAM_SIZE, preserving the short-BAR access bug.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/tiny/cirrus.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/tiny/cirrus.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n551"},{"label":"Upstream fix 92312d333bf7","url":"https://git.kernel.org/stable/c/92312d333bf700798f92f30406c721bce87506f3"}]},"size":{"status":"within-limit","patches":[{"sha":"92312d333bf700798f92f30406c721bce87506f3","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/92312d333bf700798f92f30406c721bce87506f3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98142","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98142.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98131","title":"net: stmmac: fix dma mapping leak in stmmac_tso_xmit()","status":"unfixed","project":false,"upstream":[{"sha":"a5d946466a95621fa2769720d59ea336003aa1a5","url":"https://git.kernel.org/stable/c/a5d946466a95621fa2769720d59ea336003aa1a5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"a5d946466a95621fa2769720d59ea336003aa1a5","lines":120,"reason":"","source":"https://github.com/torvalds/linux/commit/a5d946466a95621fa2769720d59ea336003aa1a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98131","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98131.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98127","title":"smb/client: validate new EOF for insert range","status":"unfixed","project":false,"upstream":[{"sha":"1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","url":"https://git.kernel.org/stable/c/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98127","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98127.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98126","title":"smb/client: validate new EOF for zero range","status":"unfixed","project":false,"upstream":[{"sha":"88972e35750792e717af287dc71f42a03b5cbce4","url":"https://git.kernel.org/stable/c/88972e35750792e717af287dc71f42a03b5cbce4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"88972e35750792e717af287dc71f42a03b5cbce4","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/88972e35750792e717af287dc71f42a03b5cbce4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98126","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98126.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98125","title":"smb/client: fix stale page cache in insert/collapse range","status":"unfixed","project":false,"upstream":[{"sha":"01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","url":"https://git.kernel.org/stable/c/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98124","title":"smb/client: invalidate fscache for fallocate range operations","status":"unfixed","project":false,"upstream":[{"sha":"448ba0ae65ca61064183564d2983c9aa59bd6ba7","url":"https://git.kernel.org/stable/c/448ba0ae65ca61064183564d2983c9aa59bd6ba7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"448ba0ae65ca61064183564d2983c9aa59bd6ba7","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/448ba0ae65ca61064183564d2983c9aa59bd6ba7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98124","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98124.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98119","title":"netfs: break unbuffered write when netfs_alloc_subrequest() fails","status":"not-applicable","project":false,"upstream":[{"sha":"8fb45a934661419c04a44d4cfea1e0df7dcf2805","url":"https://git.kernel.org/stable/c/8fb45a934661419c04a44d4cfea1e0df7dcf2805"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8fb45a934661419c04a44d4cfea1e0df7dcf2805","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/8fb45a934661419c04a44d4cfea1e0df7dcf2805.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98119","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98119.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98118","title":"netfs: Fix readahead synchronisation issues by loading all folios upfront","status":"not-applicable","project":false,"upstream":[{"sha":"fed0b33e6c584986ba70018ec9f9787a98216e64","url":"https://git.kernel.org/stable/c/fed0b33e6c584986ba70018ec9f9787a98216e64"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"fed0b33e6c584986ba70018ec9f9787a98216e64","lines":362,"reason":"","source":"https://github.com/torvalds/linux/commit/fed0b33e6c584986ba70018ec9f9787a98216e64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98115","title":"ksmbd: safely drain sessions during logoff","status":"not-applicable","project":false,"upstream":[{"sha":"d12168084c8c1b6d883c8eca5853929ac5136a9e","url":"https://git.kernel.org/stable/c/d12168084c8c1b6d883c8eca5853929ac5136a9e"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d12168084c8c1b6d883c8eca5853929ac5136a9e","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/d12168084c8c1b6d883c8eca5853929ac5136a9e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98114","title":"ksmbd: propagate DACL parsing errors","status":"unfixed","project":false,"upstream":[{"sha":"c61dc7b1b4a3234b4aa3965502908a292238805c","url":"https://git.kernel.org/stable/c/c61dc7b1b4a3234b4aa3965502908a292238805c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c61dc7b1b4a3234b4aa3965502908a292238805c","lines":147,"reason":"","source":"https://github.com/torvalds/linux/commit/c61dc7b1b4a3234b4aa3965502908a292238805c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98114","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98114.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98111","title":"Bluetooth: btintel: validate version TLV value lengths","status":"unfixed","project":false,"upstream":[{"sha":"a086c0892969bf8a0151b0f12bd14a68827c88b2","url":"https://git.kernel.org/stable/c/a086c0892969bf8a0151b0f12bd14a68827c88b2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a086c0892969bf8a0151b0f12bd14a68827c88b2","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/a086c0892969bf8a0151b0f12bd14a68827c88b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98111","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98111.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98107","title":"Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect","status":"unfixed","project":false,"upstream":[{"sha":"56c2b5831d39dc84aad2573dc3e197af1a872a05","url":"https://git.kernel.org/stable/c/56c2b5831d39dc84aad2573dc3e197af1a872a05"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"56c2b5831d39dc84aad2573dc3e197af1a872a05","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/56c2b5831d39dc84aad2573dc3e197af1a872a05.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98107","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98107.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98106","title":"drm/pagemap: Prevent double migration of device pages","status":"not-applicable","project":false,"upstream":[{"sha":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","url":"https://git.kernel.org/stable/c/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","lines":204,"reason":"","source":"https://github.com/torvalds/linux/commit/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98106","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98106.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98103","title":"igmp: convert struct ip_sf_list to RCU","status":"unfixed","project":false,"upstream":[{"sha":"2987ee196c88dbde0463dc87d5fb209c684e34a2","url":"https://git.kernel.org/stable/c/2987ee196c88dbde0463dc87d5fb209c684e34a2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2987ee196c88dbde0463dc87d5fb209c684e34a2","lines":490,"reason":"","source":"https://github.com/torvalds/linux/commit/2987ee196c88dbde0463dc87d5fb209c684e34a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98102","title":"ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()","status":"unfixed","project":false,"upstream":[{"sha":"93b49239840b91313adbd77b8b52993eff2d08c1","url":"https://git.kernel.org/stable/c/93b49239840b91313adbd77b8b52993eff2d08c1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"93b49239840b91313adbd77b8b52993eff2d08c1","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/93b49239840b91313adbd77b8b52993eff2d08c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98101","title":"ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()","status":"unfixed","project":false,"upstream":[{"sha":"c073d1b070f171d206b19c98d71739a97f15b3f1","url":"https://git.kernel.org/stable/c/c073d1b070f171d206b19c98d71739a97f15b3f1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c073d1b070f171d206b19c98d71739a97f15b3f1","lines":147,"reason":"","source":"https://github.com/torvalds/linux/commit/c073d1b070f171d206b19c98d71739a97f15b3f1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98099","title":"ipv6: mcast: use rcu_assign_pointer() for __rcu list updates","status":"unfixed","project":false,"upstream":[{"sha":"0c8f56c583c3250408367880c98e4d6fbc929315","url":"https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0c8f56c583c3250408367880c98e4d6fbc929315","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/0c8f56c583c3250408367880c98e4d6fbc929315.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98099","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98099.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98097","title":"tipc: Dont send random pad bytes in RESET/ACTIVATE messages","status":"unfixed","project":false,"upstream":[{"sha":"81c600c26302a27852ed8b19c5f2f647ea3555c9","url":"https://git.kernel.org/stable/c/81c600c26302a27852ed8b19c5f2f647ea3555c9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"81c600c26302a27852ed8b19c5f2f647ea3555c9","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/81c600c26302a27852ed8b19c5f2f647ea3555c9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98087","title":"sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate","status":"unfixed","project":false,"upstream":[{"sha":"dae5c0292080dd7b9c7d784268dcf443f1f3d15e","url":"https://git.kernel.org/stable/c/dae5c0292080dd7b9c7d784268dcf443f1f3d15e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"dae5c0292080dd7b9c7d784268dcf443f1f3d15e","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/dae5c0292080dd7b9c7d784268dcf443f1f3d15e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98087","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98087.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98085","title":"bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge","status":"unfixed","project":false,"upstream":[{"sha":"387b1baefbb776e3f48dc2261e77a49213f470f7","url":"https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7"}],"evidence":[],"submission_lore":[],"basis":"check_ld_abs models the hidden subprogram-exit branch, but backtrack_insn returns early when R0 is absent from reg_mask before reaching the ABS/IND ENOTSUPP fallback. On that exit-edge history, precision backtracking therefore continues without switching to the parent frame; __mark_chain_precision keeps a fixed frame while traversing states. The ENOTSUPP fallback only covers the case where R0 itself is tracked, so it does not make the branch safe.","review":{"id":"CVE-2026-98085","series":"6.1.y","upstream":["387b1baefbb776e3f48dc2261e77a49213f470f7"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"check_ld_abs models the hidden subprogram-exit branch, but backtrack_insn returns early when R0 is absent from reg_mask before reaching the ABS/IND ENOTSUPP fallback. On that exit-edge history, precision backtracking therefore continues without switching to the parent frame; __mark_chain_precision keeps a fixed frame while traversing states. The ENOTSUPP fallback only covers the case where R0 itself is tracked, so it does not make the branch safe.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n10681"},{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n10681"},{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n10681"},{"label":"Upstream fix 387b1baefbb7","url":"https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7"}]},"size":{"status":"within-limit","patches":[{"sha":"387b1baefbb776e3f48dc2261e77a49213f470f7","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/387b1baefbb776e3f48dc2261e77a49213f470f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98084","title":"bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks","status":"not-applicable","project":false,"upstream":[{"sha":"e3e4f66cc4b72333d0886ae2673c360248987889","url":"https://git.kernel.org/stable/c/e3e4f66cc4b72333d0886ae2673c360248987889"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e3e4f66cc4b72333d0886ae2673c360248987889","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/e3e4f66cc4b72333d0886ae2673c360248987889.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98084","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98084.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98081","title":"btrfs: zoned: finish active block group cleanup if call_zone_finish() fails","status":"unfixed","project":false,"upstream":[{"sha":"a18a6b93a2843b9d103d3456bbd4b3f90282a379","url":"https://git.kernel.org/stable/c/a18a6b93a2843b9d103d3456bbd4b3f90282a379"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a18a6b93a2843b9d103d3456bbd4b3f90282a379","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/a18a6b93a2843b9d103d3456bbd4b3f90282a379.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98081","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98081.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98079","title":"btrfs: zstd: fix lost wakeup when waiting for a workspace","status":"unfixed","project":false,"upstream":[{"sha":"2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","url":"https://git.kernel.org/stable/c/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98073","title":"net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().","status":"unfixed","project":false,"upstream":[{"sha":"debac3a20dec524a59625cf10fa2f18571127824","url":"https://git.kernel.org/stable/c/debac3a20dec524a59625cf10fa2f18571127824"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"debac3a20dec524a59625cf10fa2f18571127824","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/debac3a20dec524a59625cf10fa2f18571127824.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98067","title":"erofs: disable LZ4 rolling decompression for now","status":"unfixed","project":false,"upstream":[{"sha":"82e664cf1219c459c33aae931b222cf951af9cb7","url":"https://git.kernel.org/stable/c/82e664cf1219c459c33aae931b222cf951af9cb7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"82e664cf1219c459c33aae931b222cf951af9cb7","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/82e664cf1219c459c33aae931b222cf951af9cb7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98067","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98067.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98058","title":"bpf: Mark syscall helpers as sleepable","status":"unfixed","project":false,"upstream":[{"sha":"d05524794240b52fdc3b6c1220dd05505715824d","url":"https://git.kernel.org/stable/c/d05524794240b52fdc3b6c1220dd05505715824d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d05524794240b52fdc3b6c1220dd05505715824d","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/d05524794240b52fdc3b6c1220dd05505715824d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98058","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98058.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98056","title":"nvme: remove stale namespaces by NSID range during scan","status":"unfixed","project":false,"upstream":[{"sha":"4ed7f3d7d435bf5b63da2814dc9270f5ba896011","url":"https://git.kernel.org/stable/c/4ed7f3d7d435bf5b63da2814dc9270f5ba896011"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4ed7f3d7d435bf5b63da2814dc9270f5ba896011","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/4ed7f3d7d435bf5b63da2814dc9270f5ba896011.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98056","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98056.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98049","title":"bpf: zero extend the result of an arena 32-bit cmpxchg","status":"not-applicable","project":false,"upstream":[{"sha":"4814ed6406f3493bd554ad046da5f7fc04833571","url":"https://git.kernel.org/stable/c/4814ed6406f3493bd554ad046da5f7fc04833571"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"4814ed6406f3493bd554ad046da5f7fc04833571","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/4814ed6406f3493bd554ad046da5f7fc04833571.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98049","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98049.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98044","title":"bpf: Reject legacy packet loads from callbacks","status":"unfixed","project":false,"upstream":[{"sha":"e7d28823c662128caae63f14e16bd394916c139b","url":"https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e7d28823c662128caae63f14e16bd394916c139b","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/e7d28823c662128caae63f14e16bd394916c139b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98043","title":"bpf: Don't infer non-NULL from a pointer with an unbounded offset","status":"unfixed","project":false,"upstream":[{"sha":"67b529f521a6676cdfc78b91b0217d7eaa84216b","url":"https://git.kernel.org/stable/c/67b529f521a6676cdfc78b91b0217d7eaa84216b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"67b529f521a6676cdfc78b91b0217d7eaa84216b","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/67b529f521a6676cdfc78b91b0217d7eaa84216b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98041","title":"bpf: Don't predict JMP32 pointer vs zero comparisons","status":"unfixed","project":false,"upstream":[{"sha":"e51179a4e09846f8fd0f26a05068520de2b301bf","url":"https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e51179a4e09846f8fd0f26a05068520de2b301bf","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/e51179a4e09846f8fd0f26a05068520de2b301bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98041","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98041.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98034","title":"bpf: Mark NULL kptr stores precise","status":"unfixed","project":false,"upstream":[{"sha":"ecdc5043794c9184aa8e6c814603899479c46b35","url":"https://git.kernel.org/stable/c/ecdc5043794c9184aa8e6c814603899479c46b35"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ecdc5043794c9184aa8e6c814603899479c46b35","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/ecdc5043794c9184aa8e6c814603899479c46b35.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98034","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98034.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98033","title":"bpf: Preserve inner map identity in callback frames","status":"unfixed","project":false,"upstream":[{"sha":"b90c5d770dad910fb89e6c1b15052a8a1e8db752","url":"https://git.kernel.org/stable/c/b90c5d770dad910fb89e6c1b15052a8a1e8db752"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b90c5d770dad910fb89e6c1b15052a8a1e8db752","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/b90c5d770dad910fb89e6c1b15052a8a1e8db752.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98033","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98033.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98026","title":"net: bridge: mcast: properly convert mglist to rcu","status":"unfixed","project":false,"upstream":[{"sha":"4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","url":"https://git.kernel.org/stable/c/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98021","title":"net: reject oversized tx_queue_len at netlink parse time","status":"unfixed","project":false,"upstream":[{"sha":"1aa9e143bf51405665a793d4cc925e1c4f0c5922","url":"https://git.kernel.org/stable/c/1aa9e143bf51405665a793d4cc925e1c4f0c5922"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1aa9e143bf51405665a793d4cc925e1c4f0c5922","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/1aa9e143bf51405665a793d4cc925e1c4f0c5922.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98021","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98021.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98019","title":"bpf: mark a NULL call argument precise","status":"unfixed","project":false,"upstream":[{"sha":"1a3a10b030c96ea88868ccc060a16827c01eaa5a","url":"https://git.kernel.org/stable/c/1a3a10b030c96ea88868ccc060a16827c01eaa5a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a3a10b030c96ea88868ccc060a16827c01eaa5a","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/1a3a10b030c96ea88868ccc060a16827c01eaa5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98019","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98019.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98003","title":"iommu/amd: Do not reallocate GA log buffers on resume","status":"unfixed","project":false,"upstream":[{"sha":"00a7dd64888d6dd72110b40e2824a088cf7b7386","url":"https://git.kernel.org/stable/c/00a7dd64888d6dd72110b40e2824a088cf7b7386"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"00a7dd64888d6dd72110b40e2824a088cf7b7386","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/00a7dd64888d6dd72110b40e2824a088cf7b7386.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98003","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98003.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97997","title":"virtio_ring: fix stale descriptor flags after a failed packed add","status":"unfixed","project":false,"upstream":[{"sha":"75d276e5bb68778b2916f98a2bc30f142ebadc64","url":"https://git.kernel.org/stable/c/75d276e5bb68778b2916f98a2bc30f142ebadc64"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"75d276e5bb68778b2916f98a2bc30f142ebadc64","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/75d276e5bb68778b2916f98a2bc30f142ebadc64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97997","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97997.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97994","title":"vhost/vdpa: reject VRING_NUM larger than device max","status":"unfixed","project":false,"upstream":[{"sha":"ccb1dc7c527f8c925925cf92afc76ae590dac311","url":"https://git.kernel.org/stable/c/ccb1dc7c527f8c925925cf92afc76ae590dac311"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ccb1dc7c527f8c925925cf92afc76ae590dac311","lines":81,"reason":"","source":"https://github.com/torvalds/linux/commit/ccb1dc7c527f8c925925cf92afc76ae590dac311.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97994","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97994.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97992","title":"vhost-vdpa: protect config_ctx from being freed under the config callback","status":"unfixed","project":false,"upstream":[{"sha":"62be4e3e5f5f947fbf765b914cebdc478f715d12","url":"https://git.kernel.org/stable/c/62be4e3e5f5f947fbf765b914cebdc478f715d12"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"62be4e3e5f5f947fbf765b914cebdc478f715d12","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/62be4e3e5f5f947fbf765b914cebdc478f715d12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97992","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97992.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97990","title":"vdpa_sim_net: check TX pull result before RX copy","status":"unfixed","project":false,"upstream":[{"sha":"0d195797a80b77f2ec56718cd26d3ee65d0093e8","url":"https://git.kernel.org/stable/c/0d195797a80b77f2ec56718cd26d3ee65d0093e8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0d195797a80b77f2ec56718cd26d3ee65d0093e8","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/0d195797a80b77f2ec56718cd26d3ee65d0093e8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97989","title":"vduse: validate virtqueue alignment","status":"unfixed","project":false,"upstream":[{"sha":"fa2c25b4add57888acfa89e398389e267bff3dcf","url":"https://git.kernel.org/stable/c/fa2c25b4add57888acfa89e398389e267bff3dcf"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fa2c25b4add57888acfa89e398389e267bff3dcf","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/fa2c25b4add57888acfa89e398389e267bff3dcf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97988","title":"vhost: invalidate vring access on IOTLB transitions","status":"unfixed","project":false,"upstream":[{"sha":"e4f4761879a230aa59e569102a6ab9851847d833","url":"https://git.kernel.org/stable/c/e4f4761879a230aa59e569102a6ab9851847d833"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"e4f4761879a230aa59e569102a6ab9851847d833","lines":104,"reason":"","source":"https://github.com/torvalds/linux/commit/e4f4761879a230aa59e569102a6ab9851847d833.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97985","title":"af_unix: Update last skb marker in manage_oob().","status":"unfixed","project":false,"upstream":[{"sha":"94fd4debd2e3a69cf93e766c8b328a810c228119","url":"https://git.kernel.org/stable/c/94fd4debd2e3a69cf93e766c8b328a810c228119"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"94fd4debd2e3a69cf93e766c8b328a810c228119","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/94fd4debd2e3a69cf93e766c8b328a810c228119.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97985","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97985.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97984","title":"net: ipv6: Fix UDP length overflow with PMTU discover and big MTU","status":"unfixed","project":false,"upstream":[{"sha":"0ae10b6be49b425827659b23bcce498f80eb7182","url":"https://git.kernel.org/stable/c/0ae10b6be49b425827659b23bcce498f80eb7182"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0ae10b6be49b425827659b23bcce498f80eb7182","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0ae10b6be49b425827659b23bcce498f80eb7182.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97984","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97984.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97978","title":"eth: ice: don't dereference pointers from TP_printk()","status":"unfixed","project":false,"upstream":[{"sha":"b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","url":"https://git.kernel.org/stable/c/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","lines":88,"reason":"","source":"https://github.com/torvalds/linux/commit/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97978","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97978.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97975","title":"Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()","status":"unfixed","project":false,"upstream":[{"sha":"9b851b09b392da68bd715601f10a5adb2d8d19b8","url":"https://git.kernel.org/stable/c/9b851b09b392da68bd715601f10a5adb2d8d19b8"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9b851b09b392da68bd715601f10a5adb2d8d19b8","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/9b851b09b392da68bd715601f10a5adb2d8d19b8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97965","title":"vxlan: initialize _md in vxlan_xmit_one()","status":"unfixed","project":false,"upstream":[{"sha":"be83178bfc44588f6e3adb827ed874c683193466","url":"https://git.kernel.org/stable/c/be83178bfc44588f6e3adb827ed874c683193466"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"be83178bfc44588f6e3adb827ed874c683193466","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/be83178bfc44588f6e3adb827ed874c683193466.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97965","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97965.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97953","title":"net: stmmac: fix TX descriptor availability check for TSO traffic","status":"unfixed","project":false,"upstream":[{"sha":"5e38d732ec67a5b1f9a56e6c73add480c4b6030a","url":"https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5e38d732ec67a5b1f9a56e6c73add480c4b6030a","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/5e38d732ec67a5b1f9a56e6c73add480c4b6030a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97953","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97953.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97950","title":"configfs: pin the symlink target's dirent instead of chasing ->ci_dentry","status":"unfixed","project":false,"upstream":[{"sha":"a7c1290eef60711c10289c056ad32ed1f2b47b12","url":"https://git.kernel.org/stable/c/a7c1290eef60711c10289c056ad32ed1f2b47b12"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a7c1290eef60711c10289c056ad32ed1f2b47b12","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/a7c1290eef60711c10289c056ad32ed1f2b47b12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97950","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97950.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97949","title":"configfs: unhash the dentry before dropping the item in rmdir","status":"unfixed","project":false,"upstream":[{"sha":"f06c2d26d1999d37e93299db0ecead04ca7d0b9f","url":"https://git.kernel.org/stable/c/f06c2d26d1999d37e93299db0ecead04ca7d0b9f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f06c2d26d1999d37e93299db0ecead04ca7d0b9f","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/f06c2d26d1999d37e93299db0ecead04ca7d0b9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97938","title":"reboot: fix cad_pid use-after-free race","status":"unfixed","project":false,"upstream":[{"sha":"5a88f78df753993469dab4d1831f8fb4256a9468","url":"https://git.kernel.org/stable/c/5a88f78df753993469dab4d1831f8fb4256a9468"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5a88f78df753993469dab4d1831f8fb4256a9468","lines":92,"reason":"","source":"https://github.com/torvalds/linux/commit/5a88f78df753993469dab4d1831f8fb4256a9468.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97933","title":"tracing: Take trace_array reference when opening a tracer options file","status":"unfixed","project":false,"upstream":[{"sha":"ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","url":"https://git.kernel.org/stable/c/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97933","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97933.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97929","title":"ALSA: usbusx2y: validate URB actual_length in interrupt callback","status":"unfixed","project":false,"upstream":[{"sha":"8f5ef203abda9dd36b2af473c7b737d544f807bd","url":"https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f5ef203abda9dd36b2af473c7b737d544f807bd","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/8f5ef203abda9dd36b2af473c7b737d544f807bd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97918","title":"tracing: Undo the registration when enabling the histogram trigger fails","status":"unfixed","project":false,"upstream":[{"sha":"92383cef66791a0c63a2f27755cadbdb2fbf270b","url":"https://git.kernel.org/stable/c/92383cef66791a0c63a2f27755cadbdb2fbf270b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"92383cef66791a0c63a2f27755cadbdb2fbf270b","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/92383cef66791a0c63a2f27755cadbdb2fbf270b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97906","title":"bootconfig: Fix integer overflow in initrd size check","status":"unfixed","project":false,"upstream":[{"sha":"7812d6dab0698001e50e8c2f901e17da3eb6f429","url":"https://git.kernel.org/stable/c/7812d6dab0698001e50e8c2f901e17da3eb6f429"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7812d6dab0698001e50e8c2f901e17da3eb6f429","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7812d6dab0698001e50e8c2f901e17da3eb6f429.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97619","title":"io_uring/rw: end write accounting from ->ki_complete","status":"unfixed","project":false,"upstream":[{"sha":"796aa0547557e63338657ed1c487906f9fac4c73","url":"https://git.kernel.org/stable/c/796aa0547557e63338657ed1c487906f9fac4c73"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"796aa0547557e63338657ed1c487906f9fac4c73","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/796aa0547557e63338657ed1c487906f9fac4c73.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97619","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97619.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97600","title":"ieee802154: cc2520: fix FIFOP work use-after-free","status":"unfixed","project":false,"upstream":[{"sha":"ff5891b266a7fc6a062710836be84f1cc19338b5","url":"https://git.kernel.org/stable/c/ff5891b266a7fc6a062710836be84f1cc19338b5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ff5891b266a7fc6a062710836be84f1cc19338b5","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/ff5891b266a7fc6a062710836be84f1cc19338b5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97600","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97600.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97566","title":"mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0","status":"queued","project":false,"upstream":[{"sha":"2ac7d6e620764f1fc79eb4edd3610a7a661981ca","url":"https://git.kernel.org/stable/c/2ac7d6e620764f1fc79eb4edd3610a7a661981ca"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/mptcp-pm-kernel-drop-pending-add_addr-when-removing-.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"Removing address ID zero deletes subflows but leaves pending ADD_ADDR state and the signaled counter intact.","review":{"id":"CVE-2026-97566","series":"6.1.y","upstream":["2ac7d6e620764f1fc79eb4edd3610a7a661981ca"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"Removing address ID zero deletes subflows but leaves pending ADD_ADDR state and the signaled counter intact.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: net/mptcp/pm_netlink.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/mptcp/pm_netlink.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1712"},{"label":"Upstream fix 2ac7d6e62076","url":"https://git.kernel.org/stable/c/2ac7d6e620764f1fc79eb4edd3610a7a661981ca"}]},"size":{"status":"unknown","patches":[{"sha":"2ac7d6e620764f1fc79eb4edd3610a7a661981ca","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97566","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97566.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97565","title":"smb: client: reject short READ responses in CIFSSMBRead()","status":"unfixed","project":false,"upstream":[{"sha":"e6142a8bfc230c7263eb8b0475249c958ce49367","url":"https://git.kernel.org/stable/c/e6142a8bfc230c7263eb8b0475249c958ce49367"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e6142a8bfc230c7263eb8b0475249c958ce49367","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/e6142a8bfc230c7263eb8b0475249c958ce49367.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97565","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97565.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97563","title":"smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()","status":"unfixed","project":false,"upstream":[{"sha":"5be5bdda5863eacc964b609ba927764f253431b3","url":"https://git.kernel.org/stable/c/5be5bdda5863eacc964b609ba927764f253431b3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5be5bdda5863eacc964b609ba927764f253431b3","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/5be5bdda5863eacc964b609ba927764f253431b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97563","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97563.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97562","title":"smb: client: pin DFS superblock in iterator callback","status":"unfixed","project":false,"upstream":[{"sha":"d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","url":"https://git.kernel.org/stable/c/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97562","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97562.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97538","title":"hwmon: (asus_rog_ryujin) Validate HID report lengths","status":"not-applicable","project":false,"upstream":[{"sha":"8042312e73c50de82634ce63eae7cf219464b481","url":"https://git.kernel.org/stable/c/8042312e73c50de82634ce63eae7cf219464b481"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8042312e73c50de82634ce63eae7cf219464b481","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/8042312e73c50de82634ce63eae7cf219464b481.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97526","title":"s390/pai: Support CPU hotplug for PMU PAI","status":"not-applicable","project":false,"upstream":[{"sha":"9ecc4d033879f7761f2df07e20cd2fbec00fd90b","url":"https://git.kernel.org/stable/c/9ecc4d033879f7761f2df07e20cd2fbec00fd90b"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"9ecc4d033879f7761f2df07e20cd2fbec00fd90b","lines":292,"reason":"","source":"https://github.com/torvalds/linux/commit/9ecc4d033879f7761f2df07e20cd2fbec00fd90b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97526","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97526.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97515","title":"i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845","status":"unfixed","project":false,"upstream":[{"sha":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","url":"https://git.kernel.org/stable/c/1effa3adfe53cb2bb28bf5640a676b791d5ab405"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/1effa3adfe53cb2bb28bf5640a676b791d5ab405.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97515","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97515.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97499","title":"coresight: perf: Retrieve path and source from event data","status":"unfixed","project":false,"upstream":[{"sha":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","url":"https://git.kernel.org/stable/c/f37bc31447c0ddafedb25e3c4a4f4e2284034247"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","lines":229,"reason":"","source":"https://github.com/torvalds/linux/commit/f37bc31447c0ddafedb25e3c4a4f4e2284034247.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97496","title":"drm/amdkfd: Fix OOB memory exposure in get_wave_state()","status":"unfixed","project":false,"upstream":[{"sha":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","url":"https://git.kernel.org/stable/c/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97496","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97496.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97424","title":"drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq","status":"unfixed","project":false,"upstream":[{"sha":"e3829992dd9fa0a82511af4f01733fc854cd15a5","url":"https://git.kernel.org/stable/c/e3829992dd9fa0a82511af4f01733fc854cd15a5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"e3829992dd9fa0a82511af4f01733fc854cd15a5","lines":131,"reason":"","source":"https://github.com/torvalds/linux/commit/e3829992dd9fa0a82511af4f01733fc854cd15a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93799","title":"wifi: iwlwifi: mvm: validate sta_id in BA window status notif","status":"unfixed","project":false,"upstream":[{"sha":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","url":"https://git.kernel.org/stable/c/6aa77efaea9efea92e3090c35ad348fd759a3cf3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/6aa77efaea9efea92e3090c35ad348fd759a3cf3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93796","title":"wifi: iwlwifi: pcie: null RX pointers after free","status":"queued","project":false,"upstream":[{"sha":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","url":"https://git.kernel.org/stable/c/2c79d7a7b583050c9f58041465cb46fe3483ab5d"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/wifi-iwlwifi-pcie-null-rx-pointers-after-free.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"iwl_pcie_rx_free frees RX allocations but leaves most pointers non-NULL, so repeated teardown can reuse freed pointers.","review":{"id":"CVE-2026-93796","series":"6.1.y","upstream":["2c79d7a7b583050c9f58041465cb46fe3483ab5d"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"iwl_pcie_rx_free frees RX allocations but leaves most pointers non-NULL, so repeated teardown can reuse freed pointers.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/wireless/intel/iwlwifi/pcie/rx.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi/pcie/rx.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1193"},{"label":"Upstream fix 2c79d7a7b583","url":"https://git.kernel.org/stable/c/2c79d7a7b583050c9f58041465cb46fe3483ab5d"}]},"size":{"status":"unknown","patches":[{"sha":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93796","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93796.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93276","title":"phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator","status":"not-applicable","project":false,"upstream":[{"sha":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","url":"https://git.kernel.org/stable/c/49c9b71b45081e5e5eeb507a2d6edb80d332dc59"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/49c9b71b45081e5e5eeb507a2d6edb80d332dc59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93276","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93276.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93270","title":"bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn","status":"not-applicable","project":false,"upstream":[{"sha":"7a0855e73757ee9cf25ba635a1c735018ecba742","url":"https://git.kernel.org/stable/c/7a0855e73757ee9cf25ba635a1c735018ecba742"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"7a0855e73757ee9cf25ba635a1c735018ecba742","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/7a0855e73757ee9cf25ba635a1c735018ecba742.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93270","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93270.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93244","title":"drm/sysfb: simpledrm: Improve stride validation","status":"queued","project":false,"upstream":[{"sha":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","url":"https://git.kernel.org/stable/c/df6533f11688aa30be3bb883c7637f4ffdbb7cbd"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-sysfb-simpledrm-improve-stride-validation.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"simpledrm_device_create() narrows computed minimum pitch to int without rejecting values above INT_MAX; validated input stride does not bound this computed pitch.","review":{"id":"CVE-2026-93244","series":"6.1.y","upstream":["df6533f11688aa30be3bb883c7637f4ffdbb7cbd"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"simpledrm_device_create() narrows computed minimum pitch to int without rejecting values above INT_MAX; validated input stride does not bound this computed pitch.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/tiny/simpledrm.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/tiny/simpledrm.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n629"},{"label":"Upstream fix df6533f11688","url":"https://git.kernel.org/stable/c/df6533f11688aa30be3bb883c7637f4ffdbb7cbd"}]},"size":{"status":"unknown","patches":[{"sha":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93244","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93244.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93238","title":"s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap","status":"unfixed","project":false,"upstream":[{"sha":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","url":"https://git.kernel.org/stable/c/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93238","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93238.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93237","title":"LoongArch: Add DIRECT_MAP_PHYSMEM_END definition","status":"not-applicable","project":false,"upstream":[{"sha":"2677f97a67fdbc62a82ce1faa67791f54451d36f","url":"https://git.kernel.org/stable/c/2677f97a67fdbc62a82ce1faa67791f54451d36f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"2677f97a67fdbc62a82ce1faa67791f54451d36f","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/2677f97a67fdbc62a82ce1faa67791f54451d36f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93235","title":"f2fs: fix to zero post-EOF data when extending file size","status":"unfixed","project":false,"upstream":[{"sha":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","url":"https://git.kernel.org/stable/c/5eced87b7d19dbc76ebdddaf322046f9ac582fcb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/5eced87b7d19dbc76ebdddaf322046f9ac582fcb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93235","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93235.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93221","title":"nfsd: convert nfsd_net boolean flags to unsigned long flags word","status":"unfixed","project":false,"upstream":[{"sha":"11a5fe42e1811f793e04ef885b639ea7668f439d","url":"https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"11a5fe42e1811f793e04ef885b639ea7668f439d","lines":276,"reason":"","source":"https://github.com/torvalds/linux/commit/11a5fe42e1811f793e04ef885b639ea7668f439d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93221","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93221.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93216","title":"mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()","status":"unfixed","project":false,"upstream":[{"sha":"90f095b816e25c6a9e4446d299bac5007fdcb3df","url":"https://git.kernel.org/stable/c/90f095b816e25c6a9e4446d299bac5007fdcb3df"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"90f095b816e25c6a9e4446d299bac5007fdcb3df","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/90f095b816e25c6a9e4446d299bac5007fdcb3df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93216","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93216.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93184","title":"ASoC: fsl_audmix: rework runtime PM handling in probe","status":"unfixed","project":false,"upstream":[{"sha":"3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71","url":"https://git.kernel.org/stable/c/3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71","lines":59,"reason":"","source":"https://github.com/torvalds/linux/commit/3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93184","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93184.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93181","title":"perf/x86/intel/uncore: Fix uncore_box ref/unref ordering","status":"not-applicable","project":false,"upstream":[{"sha":"174f0582e38abe03b88e15f04bfe58490f88cb19","url":"https://git.kernel.org/stable/c/174f0582e38abe03b88e15f04bfe58490f88cb19"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"174f0582e38abe03b88e15f04bfe58490f88cb19","lines":108,"reason":"","source":"https://github.com/torvalds/linux/commit/174f0582e38abe03b88e15f04bfe58490f88cb19.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93181","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93181.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93155","title":"crypto: keembay - Fix AEAD unregister count in error path","status":"queued","project":false,"upstream":[{"sha":"e264401ce4776a288524e5b87593d4d864147115","url":"https://git.kernel.org/stable/c/e264401ce4776a288524e5b87593d4d864147115"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/crypto-keembay-fix-aead-unregister-count-in-error-pa.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"register_aes_algs uses skcipher ARRAY_SIZE for AEAD unregister","review":{"id":"CVE-2026-93155","series":"6.1.y","upstream":["e264401ce4776a288524e5b87593d4d864147115"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"register_aes_algs uses skcipher ARRAY_SIZE for AEAD unregister","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/crypto/keembay/keembay-ocs-aes-core.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/crypto/keembay/keembay-ocs-aes-core.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1551"},{"label":"Upstream fix e264401ce477","url":"https://git.kernel.org/stable/c/e264401ce4776a288524e5b87593d4d864147115"}]},"size":{"status":"unknown","patches":[{"sha":"e264401ce4776a288524e5b87593d4d864147115","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93155","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93155.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93154","title":"RDMA/irdma: Add refcounting to user ring MRs","status":"unfixed","project":false,"upstream":[{"sha":"f67d8a08f60c9217df6d40da56422d2049f5e334","url":"https://git.kernel.org/stable/c/f67d8a08f60c9217df6d40da56422d2049f5e334"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"f67d8a08f60c9217df6d40da56422d2049f5e334","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/f67d8a08f60c9217df6d40da56422d2049f5e334.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93154","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93154.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93135","title":"bpf: Reject programs with inlined helpers if JIT is not available","status":"not-applicable","project":false,"upstream":[{"sha":"f1c27922576edccb99d0257827d09bd05c0304a6","url":"https://git.kernel.org/stable/c/f1c27922576edccb99d0257827d09bd05c0304a6"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"f1c27922576edccb99d0257827d09bd05c0304a6","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/f1c27922576edccb99d0257827d09bd05c0304a6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93135","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93135.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93123","title":"serial: qcom-geni: do not advance stale DMA completions","status":"not-applicable","project":false,"upstream":[{"sha":"7ea38c49e7178960926657863299face6dc0e1b0","url":"https://git.kernel.org/stable/c/7ea38c49e7178960926657863299face6dc0e1b0"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"7ea38c49e7178960926657863299face6dc0e1b0","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/7ea38c49e7178960926657863299face6dc0e1b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93100","title":"fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()","status":"queued","project":false,"upstream":[{"sha":"f5bcf539484d2d604c2f2330e09487ea090b21c7","url":"https://git.kernel.org/stable/c/f5bcf539484d2d604c2f2330e09487ea090b21c7"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/fs-resctrl-prevent-use-after-free-in-rdtgroup_kn_put.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"rdtgroup_kn_unlock decrements then reads flags outside rdtgroup_mutex","review":{"id":"CVE-2026-93100","series":"6.1.y","upstream":["f5bcf539484d2d604c2f2330e09487ea090b21c7"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"rdtgroup_kn_unlock decrements then reads flags outside rdtgroup_mutex","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: arch/x86/kernel/cpu/resctrl/rdtgroup.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/cpu/resctrl/rdtgroup.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n532"},{"label":"Upstream fix f5bcf539484d","url":"https://git.kernel.org/stable/c/f5bcf539484d2d604c2f2330e09487ea090b21c7"}]},"size":{"status":"unknown","patches":[{"sha":"f5bcf539484d2d604c2f2330e09487ea090b21c7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93100","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93100.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93099","title":"fs/resctrl: Fix UAF from worker threads when domains are removed","status":"unfixed","project":false,"upstream":[{"sha":"2566b5cd6a275c124e8f154fef6e815f92ec8d5c","url":"https://git.kernel.org/stable/c/2566b5cd6a275c124e8f154fef6e815f92ec8d5c"}],"evidence":[],"submission_lore":[],"basis":"domain offline path uses non-synchronous delayed-work cancellation","review":{"id":"CVE-2026-93099","series":"6.1.y","upstream":["2566b5cd6a275c124e8f154fef6e815f92ec8d5c"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"domain offline path uses non-synchronous delayed-work cancellation","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: arch/x86/kernel/cpu/resctrl/monitor.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/cpu/resctrl/monitor.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 2566b5cd6a27","url":"https://git.kernel.org/stable/c/2566b5cd6a275c124e8f154fef6e815f92ec8d5c"}]},"size":{"status":"over-limit","patches":[{"sha":"2566b5cd6a275c124e8f154fef6e815f92ec8d5c","lines":199,"reason":"","source":"https://github.com/torvalds/linux/commit/2566b5cd6a275c124e8f154fef6e815f92ec8d5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93099","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93099.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93093","title":"firmware: arm_scmi: Publish channel state before callbacks","status":"queued","project":false,"upstream":[{"sha":"0314900dcdde044af0208fed212035dbfaa55843","url":"https://git.kernel.org/stable/c/0314900dcdde044af0208fed212035dbfaa55843"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/firmware-arm_scmi-publish-channel-state-before-callb.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"0314900dcdde044af0208fed212035dbfaa55843","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93093","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93093.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93091","title":"firmware: arm_scmi: Quiesce notifications before teardown","status":"unfixed","project":false,"upstream":[{"sha":"8e49055d0d495c9c07575ad8e111d9eaf0efb13f","url":"https://git.kernel.org/stable/c/8e49055d0d495c9c07575ad8e111d9eaf0efb13f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8e49055d0d495c9c07575ad8e111d9eaf0efb13f","lines":86,"reason":"","source":"https://github.com/torvalds/linux/commit/8e49055d0d495c9c07575ad8e111d9eaf0efb13f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93091","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93091.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93083","title":"firmware: arm_scmi: Unwind TX receiver mailbox setup failure","status":"not-applicable","project":false,"upstream":[{"sha":"6f7c06744d53dc8e047725d411d7f915d9ec35ae","url":"https://git.kernel.org/stable/c/6f7c06744d53dc8e047725d411d7f915d9ec35ae"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f7c06744d53dc8e047725d411d7f915d9ec35ae","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/6f7c06744d53dc8e047725d411d7f915d9ec35ae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93083","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93083.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93072","title":"irqchip/renesas-irqc: Fix generic interrupt chip leak on remove","status":"unfixed","project":false,"upstream":[{"sha":"616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba","url":"https://git.kernel.org/stable/c/616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93072","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93072.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93047","title":"drm/v3d: Associate BOs with every job that accesses them","status":"unfixed","project":false,"upstream":[{"sha":"fa98563ab00dbe62fcedfef6bdd34ded7a860d9f","url":"https://git.kernel.org/stable/c/fa98563ab00dbe62fcedfef6bdd34ded7a860d9f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"fa98563ab00dbe62fcedfef6bdd34ded7a860d9f","lines":175,"reason":"","source":"https://github.com/torvalds/linux/commit/fa98563ab00dbe62fcedfef6bdd34ded7a860d9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93047","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93047.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93044","title":"bpf: Disallow interpreter fallback for arena-related insns","status":"not-applicable","project":false,"upstream":[{"sha":"34746b5a84ec37c0ea2bf6808c65c5ed8790eb51","url":"https://git.kernel.org/stable/c/34746b5a84ec37c0ea2bf6808c65c5ed8790eb51"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"34746b5a84ec37c0ea2bf6808c65c5ed8790eb51","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/34746b5a84ec37c0ea2bf6808c65c5ed8790eb51.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92518","title":"riscv, bpf: Fix kernel stack corruption in tailcall with CFI","status":"not-applicable","project":false,"upstream":[{"sha":"52fb1756ea1d2759dfef2d86245be00b05dac3a2","url":"https://git.kernel.org/stable/c/52fb1756ea1d2759dfef2d86245be00b05dac3a2"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"52fb1756ea1d2759dfef2d86245be00b05dac3a2","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/52fb1756ea1d2759dfef2d86245be00b05dac3a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92518","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92518.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92500","title":"ext4: use fsdata to track inline data write state and fix race","status":"unfixed","project":false,"upstream":[{"sha":"7edbb323bab2b2a609016014caafdb651c898249","url":"https://git.kernel.org/stable/c/7edbb323bab2b2a609016014caafdb651c898249"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7edbb323bab2b2a609016014caafdb651c898249","lines":95,"reason":"","source":"https://github.com/torvalds/linux/commit/7edbb323bab2b2a609016014caafdb651c898249.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92500","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92500.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92499","title":"ext4: validate readdir offset before accessing dirent","status":"unfixed","project":false,"upstream":[{"sha":"bc4b7b0414c33b2c8898eb04386df0d21a13dad8","url":"https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"bc4b7b0414c33b2c8898eb04386df0d21a13dad8","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/bc4b7b0414c33b2c8898eb04386df0d21a13dad8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92493","title":"cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active","status":"unfixed","project":false,"upstream":[{"sha":"8d31bb1451643f328db0cea0e21e63ef54b4faf2","url":"https://git.kernel.org/stable/c/8d31bb1451643f328db0cea0e21e63ef54b4faf2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8d31bb1451643f328db0cea0e21e63ef54b4faf2","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/8d31bb1451643f328db0cea0e21e63ef54b4faf2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90401","title":"md: remove REQ_NOWAIT support from raid1/10/456","status":"unfixed","project":false,"upstream":[{"sha":"3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","url":"https://git.kernel.org/stable/c/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","lines":588,"reason":"","source":"https://github.com/torvalds/linux/commit/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90401","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90401.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90397","title":"firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published","status":"not-applicable","project":false,"upstream":[{"sha":"966d23c7e68ea32679275a7e3d2383181002c868","url":"https://git.kernel.org/stable/c/966d23c7e68ea32679275a7e3d2383181002c868"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"966d23c7e68ea32679275a7e3d2383181002c868","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/966d23c7e68ea32679275a7e3d2383181002c868.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90397","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90397.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90389","title":"md: scope memalloc_noio to allocation critical sections","status":"unfixed","project":false,"upstream":[{"sha":"bace2010dd7ac07bc980575afb135c406730a7fe","url":"https://git.kernel.org/stable/c/bace2010dd7ac07bc980575afb135c406730a7fe"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"bace2010dd7ac07bc980575afb135c406730a7fe","lines":306,"reason":"","source":"https://github.com/torvalds/linux/commit/bace2010dd7ac07bc980575afb135c406730a7fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90389","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90389.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90379","title":"wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash","status":"unfixed","project":false,"upstream":[{"sha":"915672c5ae32deeb72f4572856d123f314791136","url":"https://git.kernel.org/stable/c/915672c5ae32deeb72f4572856d123f314791136"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"915672c5ae32deeb72f4572856d123f314791136","lines":227,"reason":"","source":"https://github.com/torvalds/linux/commit/915672c5ae32deeb72f4572856d123f314791136.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90379","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90379.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90375","title":"wifi: mt76: fix non-AQL packet accounting for MLO stations","status":"queued","project":false,"upstream":[{"sha":"8ae659743ba936b22ecb4620815887728e2820d6","url":"https://git.kernel.org/stable/c/8ae659743ba936b22ecb4620815887728e2820d6"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/wifi-mt76-fix-non-aql-packet-accounting-for-mlo-stat.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The mt76 code in these targets predates the affected MLO station accounting path; 6.1 has no mac80211 MLO and neither target has the mt76 MLO path changed upstream. Applying fragments would be a no-op or would import later MLO infrastructure.","review":{"id":"CVE-2026-90375","series":"6.1.y","upstream":["8ae659743ba936b22ecb4620815887728e2820d6"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The mt76 code in these targets predates the affected MLO station accounting path; 6.1 has no mac80211 MLO and neither target has the mt76 MLO path changed upstream. Applying fragments would be a no-op or would import later MLO infrastructure.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"8ae659743ba936b22ecb4620815887728e2820d6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90375","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90375.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90373","title":"wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear","status":"not-applicable","project":false,"upstream":[{"sha":"6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba","url":"https://git.kernel.org/stable/c/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90373","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90373.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90359","title":"bpf: Reject >8 byte return values on return-reading trampoline paths","status":"unfixed","project":false,"upstream":[{"sha":"c48796aa6c392cde93946e5d5a9a1f1b1cf72feb","url":"https://git.kernel.org/stable/c/c48796aa6c392cde93946e5d5a9a1f1b1cf72feb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c48796aa6c392cde93946e5d5a9a1f1b1cf72feb","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/c48796aa6c392cde93946e5d5a9a1f1b1cf72feb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90359","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90359.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90333","title":"dm-integrity: replace forgeable discard filler with a keyed sector marker","status":"unfixed","project":false,"upstream":[{"sha":"68c5c42567bc462139128968ebbfadd0aefff519","url":"https://git.kernel.org/stable/c/68c5c42567bc462139128968ebbfadd0aefff519"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"68c5c42567bc462139128968ebbfadd0aefff519","lines":357,"reason":"","source":"https://github.com/torvalds/linux/commit/68c5c42567bc462139128968ebbfadd0aefff519.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90321","title":"ocfs2: validate inline xattrs during inode block validation","status":"unfixed","project":false,"upstream":[{"sha":"8914a3330b72378136c2c02d6328a826f6abdad7","url":"https://git.kernel.org/stable/c/8914a3330b72378136c2c02d6328a826f6abdad7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8914a3330b72378136c2c02d6328a826f6abdad7","lines":164,"reason":"","source":"https://github.com/torvalds/linux/commit/8914a3330b72378136c2c02d6328a826f6abdad7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90321","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90321.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90320","title":"ocfs2: validate external xattr entries when reading metadata","status":"unfixed","project":false,"upstream":[{"sha":"2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6","url":"https://git.kernel.org/stable/c/2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6","lines":121,"reason":"","source":"https://github.com/torvalds/linux/commit/2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90320","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90320.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90317","title":"bpf: Invalidate RCU pointers after final spin unlock","status":"not-applicable","project":false,"upstream":[{"sha":"180c7000712db77063b3a26f4c97e7dd9038f449","url":"https://git.kernel.org/stable/c/180c7000712db77063b3a26f4c97e7dd9038f449"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"180c7000712db77063b3a26f4c97e7dd9038f449","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/180c7000712db77063b3a26f4c97e7dd9038f449.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90315","title":"PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers","status":"unfixed","project":false,"upstream":[{"sha":"747b9bbbbdfdee51aee2456388f9b94b5086de4d","url":"https://git.kernel.org/stable/c/747b9bbbbdfdee51aee2456388f9b94b5086de4d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"747b9bbbbdfdee51aee2456388f9b94b5086de4d","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/747b9bbbbdfdee51aee2456388f9b94b5086de4d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90306","title":"ARM: 9481/2: breakpoint: CFI breakpoints only on demand","status":"not-applicable","project":false,"upstream":[{"sha":"8ed9bff906cf8036531d1559f10e82733a52b41f","url":"https://git.kernel.org/stable/c/8ed9bff906cf8036531d1559f10e82733a52b41f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ed9bff906cf8036531d1559f10e82733a52b41f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8ed9bff906cf8036531d1559f10e82733a52b41f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90306","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90306.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90265","title":"btrfs: defrag: fix deadlock between defrag and delalloc space reservation","status":"queued","project":false,"upstream":[{"sha":"ba02eab28041f9a4bbe9fc90c7249644fef6de0f","url":"https://git.kernel.org/stable/c/ba02eab28041f9a4bbe9fc90c7249644fef6de0f"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/btrfs-defrag-fix-deadlock-between-defrag-and-delallo.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"defrag_one_range reserves delalloc while prior target folios remain locked/dirty","review":{"id":"CVE-2026-90265","series":"6.1.y","upstream":["ba02eab28041f9a4bbe9fc90c7249644fef6de0f"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"defrag_one_range reserves delalloc while prior target folios remain locked/dirty","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/btrfs/ioctl.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/btrfs/ioctl.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1665"},{"label":"Upstream fix ba02eab28041","url":"https://git.kernel.org/stable/c/ba02eab28041f9a4bbe9fc90c7249644fef6de0f"}]},"size":{"status":"unknown","patches":[{"sha":"ba02eab28041f9a4bbe9fc90c7249644fef6de0f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90265","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90265.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90261","title":"btrfs: zoned: flush active metadata block group at btree_writepages() start","status":"not-applicable","project":false,"upstream":[{"sha":"ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b","url":"https://git.kernel.org/stable/c/ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b","lines":132,"reason":"","source":"https://github.com/torvalds/linux/commit/ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90261","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90261.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90256","title":"Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind","status":"not-applicable","project":false,"upstream":[{"sha":"2b66c83ff1751d6bd3201b3017206262ab46dc05","url":"https://git.kernel.org/stable/c/2b66c83ff1751d6bd3201b3017206262ab46dc05"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b66c83ff1751d6bd3201b3017206262ab46dc05","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/2b66c83ff1751d6bd3201b3017206262ab46dc05.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90256","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90256.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90237","title":"netfilter: nft_ct: move custom expectation support to helper","status":"unfixed","project":false,"upstream":[{"sha":"3679da4ad8be84cddaf40bc307fef1fe13e051ff","url":"https://git.kernel.org/stable/c/3679da4ad8be84cddaf40bc307fef1fe13e051ff"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3679da4ad8be84cddaf40bc307fef1fe13e051ff","lines":260,"reason":"","source":"https://github.com/torvalds/linux/commit/3679da4ad8be84cddaf40bc307fef1fe13e051ff.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90230","title":"nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()","status":"unfixed","project":false,"upstream":[{"sha":"5bb96cc218835769ab74ec7f3ea2bf81fbffe955","url":"https://git.kernel.org/stable/c/5bb96cc218835769ab74ec7f3ea2bf81fbffe955"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5bb96cc218835769ab74ec7f3ea2bf81fbffe955","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/5bb96cc218835769ab74ec7f3ea2bf81fbffe955.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90230","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90230.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90227","title":"nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()","status":"unfixed","project":false,"upstream":[{"sha":"b53d495c7f0db46b6748b5ade48371a10dd5d3bc","url":"https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b53d495c7f0db46b6748b5ade48371a10dd5d3bc","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/b53d495c7f0db46b6748b5ade48371a10dd5d3bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90227","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90227.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90220","title":"ALSA: seq: Don't leak the extension cell pointer in the bounce payload","status":"queued","project":false,"upstream":[{"sha":"59e1592d3c270ff4642d5d6dc55c545306eb0693","url":"https://git.kernel.org/stable/c/59e1592d3c270ff4642d5d6dc55c545306eb0693"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/alsa-seq-don-t-leak-the-extension-cell-pointer-in-th.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"59e1592d3c270ff4642d5d6dc55c545306eb0693","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/59e1592d3c270ff4642d5d6dc55c545306eb0693.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90220","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90220.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90217","title":"bpf: Compare iterator types during state pruning","status":"not-applicable","project":false,"upstream":[{"sha":"83608e303b95d07afba1c15da0b5d9e513c2f15a","url":"https://git.kernel.org/stable/c/83608e303b95d07afba1c15da0b5d9e513c2f15a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"83608e303b95d07afba1c15da0b5d9e513c2f15a","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/83608e303b95d07afba1c15da0b5d9e513c2f15a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90211","title":"bpf, s390: Clear fetch destination on faulting arena atomic","status":"not-applicable","project":false,"upstream":[{"sha":"cc3e12330599f097f0e1f792435686ddc276f26d","url":"https://git.kernel.org/stable/c/cc3e12330599f097f0e1f792435686ddc276f26d"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"cc3e12330599f097f0e1f792435686ddc276f26d","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/cc3e12330599f097f0e1f792435686ddc276f26d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90199","title":"fs/ntfs3: reject out-of-range evcn in mi_enum_attr()","status":"unfixed","project":false,"upstream":[{"sha":"20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3","url":"https://git.kernel.org/stable/c/20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90199","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90199.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90154","title":"ksmbd: scope session state changes to bound connections","status":"unfixed","project":false,"upstream":[{"sha":"c50e628122aed077695669e25b842e778511a43d","url":"https://git.kernel.org/stable/c/c50e628122aed077695669e25b842e778511a43d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c50e628122aed077695669e25b842e778511a43d","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/c50e628122aed077695669e25b842e778511a43d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90154","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90154.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90129","title":"virtio_balloon: quiesce balloon work before device shutdown","status":"not-applicable","project":false,"upstream":[{"sha":"7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","url":"https://git.kernel.org/stable/c/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90119","title":"ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup","status":"unfixed","project":false,"upstream":[{"sha":"d736eba9c453fedce664fdf592c8b71ecff1932b","url":"https://git.kernel.org/stable/c/d736eba9c453fedce664fdf592c8b71ecff1932b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d736eba9c453fedce664fdf592c8b71ecff1932b","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/d736eba9c453fedce664fdf592c8b71ecff1932b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90119","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90119.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90098","title":"net: sparx5: fix sleep in atomic context in MAC table access","status":"unfixed","project":false,"upstream":[{"sha":"b62793a7baeea9cf20209c9fd2e333311aaf3b8d","url":"https://git.kernel.org/stable/c/b62793a7baeea9cf20209c9fd2e333311aaf3b8d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b62793a7baeea9cf20209c9fd2e333311aaf3b8d","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/b62793a7baeea9cf20209c9fd2e333311aaf3b8d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90098","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90098.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90060","title":"ALSA: control: Don't add invalid kcontrols to LED layer","status":"backported","project":false,"upstream":[{"sha":"74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11","url":"https://git.kernel.org/stable/c/74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6e152cbfac3a2a62f79df7d23d621917c20367eb","label":"6e152cbfac3a","date":"2026-09-14T13:25:52+02:00","lore":["https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90060","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90060.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90040","title":"KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped","status":"not-applicable","project":false,"upstream":[{"sha":"d1a3c216233413f57f5341a9b878b7e2dde7e785","url":"https://git.kernel.org/stable/c/d1a3c216233413f57f5341a9b878b7e2dde7e785"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"d1a3c216233413f57f5341a9b878b7e2dde7e785","lines":242,"reason":"","source":"https://github.com/torvalds/linux/commit/d1a3c216233413f57f5341a9b878b7e2dde7e785.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90040","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90040.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90036","title":"NFSD: Prevent client use-after-free during blocked-lock reaping","status":"unfixed","project":false,"upstream":[{"sha":"9026932ac8be4d0ae01db47f23619a98cc57b671","url":"https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9026932ac8be4d0ae01db47f23619a98cc57b671","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/9026932ac8be4d0ae01db47f23619a98cc57b671.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90036","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90036.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90027","title":"usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop","status":"not-applicable","project":false,"upstream":[{"sha":"263f7d61a4201cde16849b2d016251806e7418be","url":"https://git.kernel.org/stable/c/263f7d61a4201cde16849b2d016251806e7418be"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"263f7d61a4201cde16849b2d016251806e7418be","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/263f7d61a4201cde16849b2d016251806e7418be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90027","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90027.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89944","title":"ASoC: hdac_hda: Fix hlink refcount leak on component registration failure","status":"queued","project":false,"upstream":[{"sha":"6ad4892c4f5cb437a928a02f5b7d37d496aa9268","url":"https://git.kernel.org/stable/c/6ad4892c4f5cb437a928a02f5b7d37d496aa9268"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/asoc-hdac_hda-fix-hlink-refcount-leak-on-component-r.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"6ad4892c4f5cb437a928a02f5b7d37d496aa9268","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89938","title":"iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF","status":"unfixed","project":false,"upstream":[{"sha":"be61c8c6252671ecf1fee0ad90f87669e0be1e20","url":"https://git.kernel.org/stable/c/be61c8c6252671ecf1fee0ad90f87669e0be1e20"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"be61c8c6252671ecf1fee0ad90f87669e0be1e20","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/be61c8c6252671ecf1fee0ad90f87669e0be1e20.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89935","title":"iio: light: apds9306: fix PM reference leak in apds9306_read_data()","status":"not-applicable","project":false,"upstream":[{"sha":"d378fceaafd79e0dc59d3546bda251a3058062c0","url":"https://git.kernel.org/stable/c/d378fceaafd79e0dc59d3546bda251a3058062c0"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"d378fceaafd79e0dc59d3546bda251a3058062c0","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/d378fceaafd79e0dc59d3546bda251a3058062c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89935","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89935.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89929","title":"KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU","status":"unfixed","project":false,"upstream":[{"sha":"6d00e67326d831e6e610933a3800712f4ffe6ec1","url":"https://git.kernel.org/stable/c/6d00e67326d831e6e610933a3800712f4ffe6ec1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6d00e67326d831e6e610933a3800712f4ffe6ec1","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/6d00e67326d831e6e610933a3800712f4ffe6ec1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89913","title":"KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables","status":"unfixed","project":false,"upstream":[{"sha":"f5b8f203bfc07a5a257dff859e66d2c500f9f509","url":"https://git.kernel.org/stable/c/f5b8f203bfc07a5a257dff859e66d2c500f9f509"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f5b8f203bfc07a5a257dff859e66d2c500f9f509","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/f5b8f203bfc07a5a257dff859e66d2c500f9f509.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89913","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89913.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89906","title":"LoongArch: BPF: Refactor jump offset calculation in tail call","status":"unfixed","project":false,"upstream":[{"sha":"37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","url":"https://git.kernel.org/stable/c/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89899","title":"media: cec: disable delayed work before freeing an interrupted transmit","status":"unfixed","project":false,"upstream":[{"sha":"0fbd5c2327020858c45b2d1c65775d64cdeca523","url":"https://git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fbd5c2327020858c45b2d1c65775d64cdeca523","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0fbd5c2327020858c45b2d1c65775d64cdeca523.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89866","title":"media: chips-media: wave5: Resume device before setting EOS flag","status":"not-applicable","project":false,"upstream":[{"sha":"a52e6f7923c17a672135b485ffd96fbd72f46267","url":"https://git.kernel.org/stable/c/a52e6f7923c17a672135b485ffd96fbd72f46267"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"a52e6f7923c17a672135b485ffd96fbd72f46267","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/a52e6f7923c17a672135b485ffd96fbd72f46267.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89866","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89866.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89862","title":"scsi: qla2xxx: Fix BSG job leak on validate flash image error path","status":"unfixed","project":false,"upstream":[{"sha":"0fb52cc632464b0cd07f970341330466d772efe1","url":"https://git.kernel.org/stable/c/0fb52cc632464b0cd07f970341330466d772efe1"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fb52cc632464b0cd07f970341330466d772efe1","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/0fb52cc632464b0cd07f970341330466d772efe1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89826","title":"drm/panthor: harden firmware build-info bounds checks","status":"not-applicable","project":false,"upstream":[{"sha":"8321b093fa6c297b80586460ce6914d9655df170","url":"https://git.kernel.org/stable/c/8321b093fa6c297b80586460ce6914d9655df170"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8321b093fa6c297b80586460ce6914d9655df170","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/8321b093fa6c297b80586460ce6914d9655df170.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89806","title":"drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation","status":"not-applicable","project":false,"upstream":[{"sha":"c6f48e59ece0123f6a11527ad4d89b21c2d65b87","url":"https://git.kernel.org/stable/c/c6f48e59ece0123f6a11527ad4d89b21c2d65b87"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6f48e59ece0123f6a11527ad4d89b21c2d65b87","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/c6f48e59ece0123f6a11527ad4d89b21c2d65b87.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89805","title":"drm/pagemap: Fix folio allocation fallback and use-after-put","status":"not-applicable","project":false,"upstream":[{"sha":"df72e55e754c8d449321ddddad19a8bd3cb8d032","url":"https://git.kernel.org/stable/c/df72e55e754c8d449321ddddad19a8bd3cb8d032"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"df72e55e754c8d449321ddddad19a8bd3cb8d032","lines":181,"reason":"","source":"https://github.com/torvalds/linux/commit/df72e55e754c8d449321ddddad19a8bd3cb8d032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89805","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89805.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89797","title":"power: supply: ab8500_fg: fix use-after-free on remove","status":"unfixed","project":false,"upstream":[{"sha":"75b1e88d34254f4fb7753345e21bfee47abddd7f","url":"https://git.kernel.org/stable/c/75b1e88d34254f4fb7753345e21bfee47abddd7f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"75b1e88d34254f4fb7753345e21bfee47abddd7f","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/75b1e88d34254f4fb7753345e21bfee47abddd7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89793","title":"ublk: clear VM_MAYWRITE on read-only ublk char device mmap","status":"unfixed","project":false,"upstream":[{"sha":"6e2b571b0a54755b06e092501913e1dfefe75d6c","url":"https://git.kernel.org/stable/c/6e2b571b0a54755b06e092501913e1dfefe75d6c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6e2b571b0a54755b06e092501913e1dfefe75d6c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/6e2b571b0a54755b06e092501913e1dfefe75d6c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89793","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89793.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89788","title":"ksmbd: fix tree connection use-after-free in smb2_tree_connect()","status":"queued","project":false,"upstream":[{"sha":"b5ec6c462aab1062cf5d1e667ba7c6442f737055","url":"https://git.kernel.org/stable/c/b5ec6c462aab1062cf5d1e667ba7c6442f737055"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/ksmbd-fix-tree-connection-use-after-free-in-smb2_tre.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5ec6c462aab1062cf5d1e667ba7c6442f737055","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/b5ec6c462aab1062cf5d1e667ba7c6442f737055.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89788","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89788.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89772","title":"btrfs: write-protect folios during data writeback","status":"not-applicable","project":false,"upstream":[{"sha":"5376c9db45368eb210b4d71104ac00a59dc8b6e0","url":"https://git.kernel.org/stable/c/5376c9db45368eb210b4d71104ac00a59dc8b6e0"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"5376c9db45368eb210b4d71104ac00a59dc8b6e0","lines":125,"reason":"","source":"https://github.com/torvalds/linux/commit/5376c9db45368eb210b4d71104ac00a59dc8b6e0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89772","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89772.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89768","title":"fs: fix user path of nested backing files","status":"not-applicable","project":false,"upstream":[{"sha":"f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d","url":"https://git.kernel.org/stable/c/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89762","title":"apparmor: fix cred UAF caused by begin_current_label_crit_section()","status":"queued","project":false,"upstream":[{"sha":"3f4ae5fab613dca01d6a2a8210dd832e009fcf47","url":"https://git.kernel.org/stable/c/3f4ae5fab613dca01d6a2a8210dd832e009fcf47"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/apparmor-fix-cred-uaf-caused-by-begin_current_label_.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"3f4ae5fab613dca01d6a2a8210dd832e009fcf47","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89755","title":"mm/migrate_device: clear stale mapping after freeing swapcache","status":"not-applicable","project":false,"upstream":[{"sha":"34a00895d032a414830d41106a09329ae6c251b6","url":"https://git.kernel.org/stable/c/34a00895d032a414830d41106a09329ae6c251b6"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"34a00895d032a414830d41106a09329ae6c251b6","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/34a00895d032a414830d41106a09329ae6c251b6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89755","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89755.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89739","title":"usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition","status":"not-applicable","project":false,"upstream":[{"sha":"9c855832790cd488d87de1885974f4c37cfe7358","url":"https://git.kernel.org/stable/c/9c855832790cd488d87de1885974f4c37cfe7358"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9c855832790cd488d87de1885974f4c37cfe7358","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/9c855832790cd488d87de1885974f4c37cfe7358.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89739","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89739.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89722","title":"PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()","status":"unfixed","project":false,"upstream":[{"sha":"dc76258d0132df1d831a5a29758bd448ca9c566e","url":"https://git.kernel.org/stable/c/dc76258d0132df1d831a5a29758bd448ca9c566e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"dc76258d0132df1d831a5a29758bd448ca9c566e","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/dc76258d0132df1d831a5a29758bd448ca9c566e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89722","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89722.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89708","title":"nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown","status":"unfixed","project":false,"upstream":[{"sha":"01c5d5f58a5db9b0ee5afba2e49d3157788687b2","url":"https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"01c5d5f58a5db9b0ee5afba2e49d3157788687b2","lines":324,"reason":"","source":"https://github.com/torvalds/linux/commit/01c5d5f58a5db9b0ee5afba2e49d3157788687b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89708","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89708.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89675","title":"nfsd: fix UAF in async copy cancel and shutdown","status":"unfixed","project":false,"upstream":[{"sha":"62c0f6eaf050bb9284c1f9cac6ed1770092e6b95","url":"https://git.kernel.org/stable/c/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"62c0f6eaf050bb9284c1f9cac6ed1770092e6b95","lines":230,"reason":"","source":"https://github.com/torvalds/linux/commit/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89675","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89675.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89644","title":"btrfs: fix extent map leak in NOCOW direct I/O write","status":"queued","project":false,"upstream":[{"sha":"3f950867c307c5413d628a153ac44915bd117ffd","url":"https://git.kernel.org/stable/c/3f950867c307c5413d628a153ac44915bd117ffd"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/btrfs-fix-extent-map-leak-in-nocow-direct-i-o-write.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"btrfs_get_blocks_direct_write leaks input extent map on NOCOW error","review":{"id":"CVE-2026-89644","series":"6.1.y","upstream":["3f950867c307c5413d628a153ac44915bd117ffd"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"btrfs_get_blocks_direct_write leaks input extent map on NOCOW error","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/btrfs/inode.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/btrfs/inode.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n7624"},{"label":"Upstream fix 3f950867c307","url":"https://git.kernel.org/stable/c/3f950867c307c5413d628a153ac44915bd117ffd"}]},"size":{"status":"unknown","patches":[{"sha":"3f950867c307c5413d628a153ac44915bd117ffd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89644","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89644.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89639","title":"cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC","status":"not-applicable","project":false,"upstream":[{"sha":"364b183230586a62660a7280c1eb20138338eeb5","url":"https://git.kernel.org/stable/c/364b183230586a62660a7280c1eb20138338eeb5"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"364b183230586a62660a7280c1eb20138338eeb5","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/364b183230586a62660a7280c1eb20138338eeb5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89639","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89639.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89637","title":"smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2","status":"unfixed","project":false,"upstream":[{"sha":"730d0bb19507b9e19c2fe5343109ac618e2fbce5","url":"https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5"}],"evidence":[],"submission_lore":[],"basis":"cifs_check_trans2 returns false for malformed/rejected secondary replies even when multiRsp is set, allowing handle_mid to overwrite response state and leave dangling server buffer pointers.","review":{"id":"CVE-2026-89637","series":"6.1.y","upstream":["730d0bb19507b9e19c2fe5343109ac618e2fbce5"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"cifs_check_trans2 returns false for malformed/rejected secondary replies even when multiRsp is set, allowing handle_mid to overwrite response state and leave dangling server buffer pointers.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/smb/client/smb1ops.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/smb/client/smb1ops.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n386"},{"label":"Upstream fix 730d0bb19507","url":"https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5"}]},"size":{"status":"within-limit","patches":[{"sha":"730d0bb19507b9e19c2fe5343109ac618e2fbce5","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/730d0bb19507b9e19c2fe5343109ac618e2fbce5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89637","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89637.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89633","title":"smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()","status":"queued","project":false,"upstream":[{"sha":"6343c1da561962688f203362d80d6a3bfa39fa1b","url":"https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/smb-client-fix-oob-read-write-from-unvalidated-datao.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The SMB1 coalesce_t2 handler trusts server-provided DataOffset for source and target pointers and memcpy without validating either range against its buffer.","review":{"id":"CVE-2026-89633","series":"6.1.y","upstream":["6343c1da561962688f203362d80d6a3bfa39fa1b"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"The SMB1 coalesce_t2 handler trusts server-provided DataOffset for source and target pointers and memcpy without validating either range against its buffer.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/smb/client/smb1ops.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/smb/client/smb1ops.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n287"},{"label":"Upstream fix 6343c1da5619","url":"https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b"}]},"size":{"status":"unknown","patches":[{"sha":"6343c1da561962688f203362d80d6a3bfa39fa1b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89633","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89633.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89632","title":"smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()","status":"not-applicable","project":false,"upstream":[{"sha":"05f78e6cf34ea3a285053bd5999e08e8ac298bd5","url":"https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"05f78e6cf34ea3a285053bd5999e08e8ac298bd5","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/05f78e6cf34ea3a285053bd5999e08e8ac298bd5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89632","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89632.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89630","title":"smb: client: restore the data_offset bound in is_valid_oplock_break()","status":"not-applicable","project":false,"upstream":[{"sha":"ba22f575de9deeae4ae0859ca4315a7698226237","url":"https://git.kernel.org/stable/c/ba22f575de9deeae4ae0859ca4315a7698226237"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ba22f575de9deeae4ae0859ca4315a7698226237","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/ba22f575de9deeae4ae0859ca4315a7698226237.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89630","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89630.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89611","title":"ntfs: validate non-resident attribute offsets","status":"unfixed","project":false,"upstream":[{"sha":"a83e82b0ec3ae523028e24813f23f18b43e8fc1c","url":"https://git.kernel.org/stable/c/a83e82b0ec3ae523028e24813f23f18b43e8fc1c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a83e82b0ec3ae523028e24813f23f18b43e8fc1c","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/a83e82b0ec3ae523028e24813f23f18b43e8fc1c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89611","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89611.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89610","title":"ntfs: verify run length exceeding volume boundary","status":"unfixed","project":false,"upstream":[{"sha":"fea9e4488f384c0ef1c0e3d96b565127c1b98447","url":"https://git.kernel.org/stable/c/fea9e4488f384c0ef1c0e3d96b565127c1b98447"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fea9e4488f384c0ef1c0e3d96b565127c1b98447","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/fea9e4488f384c0ef1c0e3d96b565127c1b98447.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89610","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89610.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89584","title":"block: validate user space vectors during extraction","status":"not-applicable","project":false,"upstream":[{"sha":"14b007e178811db72fbb1ebb3535160db6ec1e6a","url":"https://git.kernel.org/stable/c/14b007e178811db72fbb1ebb3535160db6ec1e6a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"14b007e178811db72fbb1ebb3535160db6ec1e6a","lines":168,"reason":"","source":"https://github.com/torvalds/linux/commit/14b007e178811db72fbb1ebb3535160db6ec1e6a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89584","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89584.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89568","title":"kho: fix size calculation in kho_preserved_memory_reserve()","status":"not-applicable","project":false,"upstream":[{"sha":"3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded","url":"https://git.kernel.org/stable/c/3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89568","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89568.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89567","title":"jbd2: bound shrinker scans by examined checkpoint buffers","status":"unfixed","project":false,"upstream":[{"sha":"15cb16496446b94e67f7abcb049b8e2c75cd3d02","url":"https://git.kernel.org/stable/c/15cb16496446b94e67f7abcb049b8e2c75cd3d02"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"15cb16496446b94e67f7abcb049b8e2c75cd3d02","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/15cb16496446b94e67f7abcb049b8e2c75cd3d02.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89567","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89567.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89566","title":"jbd2: check need_resched() when skipping busy checkpoint buffers","status":"unfixed","project":false,"upstream":[{"sha":"f213e12ff5c9590b1034ae8da0e6d09665c772d0","url":"https://git.kernel.org/stable/c/f213e12ff5c9590b1034ae8da0e6d09665c772d0"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f213e12ff5c9590b1034ae8da0e6d09665c772d0","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/f213e12ff5c9590b1034ae8da0e6d09665c772d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89566","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89566.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89545","title":"sunrpc: defer rq_argp and rq_resp free until after RCU grace period","status":"queued","project":false,"upstream":[{"sha":"c479bde671cbe2f9e152834a8b0eb7c3c295bbaf","url":"https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/sunrpc-defer-rq_argp-and-rq_resp-free-until-after-rc.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c479bde671cbe2f9e152834a8b0eb7c3c295bbaf","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89545","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89545.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89534","title":"svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails","status":"not-applicable","project":false,"upstream":[{"sha":"01500306e1d50de7ca7a2cdcdfa28ac0523eb747","url":"https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"01500306e1d50de7ca7a2cdcdfa28ac0523eb747","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/01500306e1d50de7ca7a2cdcdfa28ac0523eb747.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89534","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89534.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89451","title":"iommu/sva: Set handle->dev before the SVA handle is visible","status":"not-applicable","project":false,"upstream":[{"sha":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","url":"https://git.kernel.org/stable/c/530f8f9c3546cb3ebee1b135375aaee08a073ebb"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/530f8f9c3546cb3ebee1b135375aaee08a073ebb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89451","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89451.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-81016","title":"platform/x86/amd/pmc: Propagate SMU errors and validate S2D address","status":"queued","project":false,"upstream":[{"sha":"0225c1d637687b03726f00ac65b6def843d2c464","url":"https://git.kernel.org/stable/c/0225c1d637687b03726f00ac65b6def843d2c464"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/platform-x86-amd-pmc-propagate-smu-errors-and-valida.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"amd_pmc_s2d_init ignores LOW/HIGH address-command errors before mapping","review":{"id":"CVE-2026-81016","series":"6.1.y","upstream":["0225c1d637687b03726f00ac65b6def843d2c464"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"amd_pmc_s2d_init ignores LOW/HIGH address-command errors before mapping","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/platform/x86/amd/pmc.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/amd/pmc.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n870"},{"label":"Upstream fix 0225c1d63768","url":"https://git.kernel.org/stable/c/0225c1d637687b03726f00ac65b6def843d2c464"}]},"size":{"status":"unknown","patches":[{"sha":"0225c1d637687b03726f00ac65b6def843d2c464","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81016","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-81016.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-81010","title":"io_uring/waitid: honor task_work cancellation","status":"not-applicable","project":false,"upstream":[{"sha":"14572de82e5022899e5856008bc9cac97004a88c","url":"https://git.kernel.org/stable/c/14572de82e5022899e5856008bc9cac97004a88c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"14572de82e5022899e5856008bc9cac97004a88c","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/14572de82e5022899e5856008bc9cac97004a88c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-81010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80999","title":"net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO","status":"unfixed","project":false,"upstream":[{"sha":"fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc","url":"https://git.kernel.org/stable/c/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc"}],"evidence":[],"submission_lore":[],"basis":"Legacy Realtek SMI and MDIO reset-probe paths use non-sleeping gpiod_set_value on optional reset GPIOs; sleeping GPIO controllers can warn/fail. Both open-coded paths need cansleep conversion.","review":{"id":"CVE-2026-80999","series":"6.1.y","upstream":["fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"Legacy Realtek SMI and MDIO reset-probe paths use non-sleeping gpiod_set_value on optional reset GPIOs; sleeping GPIO controllers can warn/fail. Both open-coded paths need cansleep conversion.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/dsa/realtek/realtek-mdio.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/dsa/realtek/realtek-mdio.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n143"},{"label":"Checked source: drivers/net/dsa/realtek/realtek-smi.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/dsa/realtek/realtek-smi.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n412"},{"label":"Upstream fix fb58b6a696b3","url":"https://git.kernel.org/stable/c/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc"}]},"size":{"status":"within-limit","patches":[{"sha":"fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80990","title":"net: thunderbolt: Release the Rx HopID that was handed out on mismatch","status":"queued","project":false,"upstream":[{"sha":"2f1463554d0561a2fead81e3888604e5c1125e29","url":"https://git.kernel.org/stable/c/2f1463554d0561a2fead81e3888604e5c1125e29"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/net-thunderbolt-release-the-rx-hopid-that-was-handed.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"Thunderbolt mismatch handling returns without releasing a nonnegative Rx HopID allocated by tb_xdomain_alloc_in_hopid.","review":{"id":"CVE-2026-80990","series":"6.1.y","upstream":["2f1463554d0561a2fead81e3888604e5c1125e29"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"Thunderbolt mismatch handling returns without releasing a nonnegative Rx HopID allocated by tb_xdomain_alloc_in_hopid.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/thunderbolt.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/thunderbolt.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n609"},{"label":"Upstream fix 2f1463554d05","url":"https://git.kernel.org/stable/c/2f1463554d0561a2fead81e3888604e5c1125e29"}]},"size":{"status":"unknown","patches":[{"sha":"2f1463554d0561a2fead81e3888604e5c1125e29","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80989","title":"net: thunderbolt: Mark the connection down when bringing it up fails","status":"queued","project":false,"upstream":[{"sha":"3c8b26ebf525ba5960510f48c6e9936a79ebe76f","url":"https://git.kernel.org/stable/c/3c8b26ebf525ba5960510f48c6e9936a79ebe76f"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/net-thunderbolt-mark-the-connection-down-when-bringi.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"Thunderbolt network connection failure paths leave login_sent set, preventing a correct retry/state transition.","review":{"id":"CVE-2026-80989","series":"6.1.y","upstream":["3c8b26ebf525ba5960510f48c6e9936a79ebe76f"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"Thunderbolt network connection failure paths leave login_sent set, preventing a correct retry/state transition.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/thunderbolt.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/thunderbolt.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n609"},{"label":"Upstream fix 3c8b26ebf525","url":"https://git.kernel.org/stable/c/3c8b26ebf525ba5960510f48c6e9936a79ebe76f"}]},"size":{"status":"unknown","patches":[{"sha":"3c8b26ebf525ba5960510f48c6e9936a79ebe76f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80947","title":"wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop","status":"queued","project":false,"upstream":[{"sha":"6c080026ecc17eecb103f8927c64ea73a74bb818","url":"https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/wifi-rtl8xxxu-fix-use-after-free-from-rx_urb_wq-on-s.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"rtl8xxxu RX work can be scheduled after the stop flag because scheduling occurs outside the lock, and stop does not cancel rx_urb_wq before teardown.","review":{"id":"CVE-2026-80947","series":"6.1.y","upstream":["6c080026ecc17eecb103f8927c64ea73a74bb818"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"rtl8xxxu RX work can be scheduled after the stop flag because scheduling occurs outside the lock, and stop does not cancel rx_urb_wq before teardown.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n5261"},{"label":"Checked source: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n5261"},{"label":"Upstream fix 6c080026ecc1","url":"https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818"}]},"size":{"status":"unknown","patches":[{"sha":"6c080026ecc17eecb103f8927c64ea73a74bb818","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80920","title":"io_uring: defer eventfd signaling when queued from a wakeup handler","status":"unfixed","project":false,"upstream":[{"sha":"cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e","url":"https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e","lines":163,"reason":"","source":"https://github.com/torvalds/linux/commit/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80899","title":"erofs: remove fscache backend entirely","status":"not-applicable","project":false,"upstream":[{"sha":"c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56","url":"https://git.kernel.org/stable/c/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56","lines":1137,"reason":"","source":"https://github.com/torvalds/linux/commit/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80872","title":"ALSA: hda/tas2781: Cancel async firmware request at unbind","status":"not-applicable","project":false,"upstream":[{"sha":"5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9","url":"https://git.kernel.org/stable/c/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80862","title":"nvme-tcp: fix usage of page_frag_cache","status":"not-applicable","project":false,"upstream":[{"sha":"36ac05f7cfd59d90c597071304b14e98090d5dd1","url":"https://git.kernel.org/stable/c/36ac05f7cfd59d90c597071304b14e98090d5dd1"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"36ac05f7cfd59d90c597071304b14e98090d5dd1","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/36ac05f7cfd59d90c597071304b14e98090d5dd1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80820","title":"xfs: don't livelock in scrub on a circular unlinked list","status":"unfixed","project":false,"upstream":[{"sha":"527eaaefddb6ec5c83a06c9a1559960dd6361753","url":"https://git.kernel.org/stable/c/527eaaefddb6ec5c83a06c9a1559960dd6361753"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"527eaaefddb6ec5c83a06c9a1559960dd6361753","lines":149,"reason":"","source":"https://github.com/torvalds/linux/commit/527eaaefddb6ec5c83a06c9a1559960dd6361753.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80820","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80820.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80785","title":"fbdev: serialize mode sysfs access with lock_fb_info()","status":"unfixed","project":false,"upstream":[{"sha":"061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2","url":"https://git.kernel.org/stable/c/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80785","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80785.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80771","title":"HID: nintendo: register input device after capabilities are set","status":"queued","project":false,"upstream":[{"sha":"d723bc1fe2e72b9252234e94c11af644ec477bf7","url":"https://git.kernel.org/stable/c/d723bc1fe2e72b9252234e94c11af644ec477bf7"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/hid-nintendo-register-input-device-after-capabilitie.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"Both target joycon paths set button/axis capabilities, FF_RUMBLE, and create the memless FF object before input_register_device(), so the reported dev->ff/udev race is absent.","review":{"id":"CVE-2026-80771","series":"6.1.y","upstream":["d723bc1fe2e72b9252234e94c11af644ec477bf7"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"no-op","applicability":"unaffected","reason":"Both target joycon paths set button/axis capabilities, FF_RUMBLE, and create the memless FF object before input_register_device(), so the reported dev->ff/udev race is absent.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"d723bc1fe2e72b9252234e94c11af644ec477bf7","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/d723bc1fe2e72b9252234e94c11af644ec477bf7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80771","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80771.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80721","title":"Bluetooth: ISO: ensure no dangling hcon references in iso_conn","status":"not-applicable","project":false,"upstream":[{"sha":"aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb","url":"https://git.kernel.org/stable/c/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80721","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80721.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80705","title":"drm/amd/display: check if dml21_add_phantom_plane() is successful","status":"not-applicable","project":false,"upstream":[{"sha":"000acb4ce7fb9feba3072ce468ad681f6585cd5d","url":"https://git.kernel.org/stable/c/000acb4ce7fb9feba3072ce468ad681f6585cd5d"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"000acb4ce7fb9feba3072ce468ad681f6585cd5d","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/000acb4ce7fb9feba3072ce468ad681f6585cd5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80705","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80705.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80704","title":"drm/amd/display: use proper context for logging","status":"not-applicable","project":false,"upstream":[{"sha":"114b42507b6a23d9d24e24e4ef165233332c64d4","url":"https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4"}],"evidence":[],"submission_lore":[],"basis":"The older target file already uses an empty DC_LOGGER_INIT and DC_LOG_SYNC expands directly to DRM logging without dereferencing calc_pll_cs->ctx; the upstream logger-context rewrite would not fix an extant target bug.","review":{"id":"CVE-2026-80704","series":"6.1.y","upstream":["114b42507b6a23d9d24e24e4ef165233332c64d4"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"no-op","applicability":"unaffected","reason":"The older target file already uses an empty DC_LOGGER_INIT and DC_LOG_SYNC expands directly to DRM logging without dereferencing calc_pll_cs->ctx; the upstream logger-context rewrite would not fix an extant target bug.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"114b42507b6a23d9d24e24e4ef165233332c64d4","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/114b42507b6a23d9d24e24e4ef165233332c64d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80704","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80704.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80685","title":"mm/util: don't read __page_2 for order-1 folios in snapshot_page()","status":"not-applicable","project":false,"upstream":[{"sha":"7441d6348c70738e9ed307510db171c7a9b3f4bf","url":"https://git.kernel.org/stable/c/7441d6348c70738e9ed307510db171c7a9b3f4bf"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7441d6348c70738e9ed307510db171c7a9b3f4bf","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7441d6348c70738e9ed307510db171c7a9b3f4bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80685","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80685.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80676","title":"Drivers: hv: vmbus: use generic driver_override infrastructure","status":"unfixed","project":false,"upstream":[{"sha":"331d8900121a1d74ecd45cd2db742ddcb5a0a565","url":"https://git.kernel.org/stable/c/331d8900121a1d74ecd45cd2db742ddcb5a0a565"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"331d8900121a1d74ecd45cd2db742ddcb5a0a565","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/331d8900121a1d74ecd45cd2db742ddcb5a0a565.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80676","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80676.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80670","title":"perf tools: Use perf_env__get_cpu_topology() in machine__resolve()","status":"unfixed","project":false,"upstream":[{"sha":"5484b43a0ec8231c36fba6ead654cb72dbba8b8f","url":"https://git.kernel.org/stable/c/5484b43a0ec8231c36fba6ead654cb72dbba8b8f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5484b43a0ec8231c36fba6ead654cb72dbba8b8f","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/5484b43a0ec8231c36fba6ead654cb72dbba8b8f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80670","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80670.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80668","title":"netfilter: nf_conntrack_expect: use conntrack GC to reap expectations","status":"queued","project":false,"upstream":[{"sha":"b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2","url":"https://git.kernel.org/stable/c/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/netfilter-nf_conntrack_expect-use-conntrack-gc-to-re.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2","lines":512,"reason":"","source":"https://github.com/torvalds/linux/commit/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80668","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80668.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80657","title":"accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer","status":"not-applicable","project":false,"upstream":[{"sha":"506255d46bdb93a281cf39e72abbca124f5c7a1b","url":"https://git.kernel.org/stable/c/506255d46bdb93a281cf39e72abbca124f5c7a1b"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"506255d46bdb93a281cf39e72abbca124f5c7a1b","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/506255d46bdb93a281cf39e72abbca124f5c7a1b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80657","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80657.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80650","title":"media: atomisp: gc2235: fix UAF and memory leak","status":"unfixed","project":false,"upstream":[{"sha":"628f763aee0047ff44974388d6f70f75a763026b","url":"https://git.kernel.org/stable/c/628f763aee0047ff44974388d6f70f75a763026b"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","url":"https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"628f763aee0047ff44974388d6f70f75a763026b","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/628f763aee0047ff44974388d6f70f75a763026b.patch"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","lines":168072,"reason":"","source":"https://github.com/torvalds/linux/commit/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80650","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80650.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80636","title":"netfilter: conntrack: revert ct extension genid infrastructure","status":"unfixed","project":false,"upstream":[{"sha":"35e21a4dccc5c255ba59ccfbfeb4629ed21da972","url":"https://git.kernel.org/stable/c/35e21a4dccc5c255ba59ccfbfeb4629ed21da972"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"35e21a4dccc5c255ba59ccfbfeb4629ed21da972","lines":183,"reason":"","source":"https://github.com/torvalds/linux/commit/35e21a4dccc5c255ba59ccfbfeb4629ed21da972.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80636","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80636.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80634","title":"netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag","status":"queued","project":false,"upstream":[{"sha":"e052f920773b73be49eb4d8702a9f85de7464363","url":"https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/netfilter-flowtable-avoid-num_encaps-underflow-on-br.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"In renamed nft_flow_offload.c, nft_dev_path_info decrements u8 num_encaps inside WARN_ON_ONCE; zero wraps to 255 and the later route loop reads encap beyond its two-entry array.","review":{"id":"CVE-2026-80634","series":"6.1.y","upstream":["e052f920773b73be49eb4d8702a9f85de7464363"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"In renamed nft_flow_offload.c, nft_dev_path_info decrements u8 num_encaps inside WARN_ON_ONCE; zero wraps to 255 and the later route loop reads encap beyond its two-entry array.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: net/netfilter/nft_flow_offload.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/netfilter/nft_flow_offload.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n94"},{"label":"Upstream fix e052f920773b","url":"https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363"}]},"size":{"status":"unknown","patches":[{"sha":"e052f920773b73be49eb4d8702a9f85de7464363","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80611","title":"ACPI: processor_idle: Mark LPI enter functions as __cpuidle","status":"queued","project":false,"upstream":[{"sha":"956ca5d72c76504824c8eb601879da9476973e15","url":"https://git.kernel.org/stable/c/956ca5d72c76504824c8eb601879da9476973e15"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/acpi-processor_idle-mark-lpi-enter-functions-as-__cp.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"956ca5d72c76504824c8eb601879da9476973e15","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80611","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80611.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80580","title":"fbdev: bound mode sysfs output to the sysfs buffer","status":"unfixed","project":false,"upstream":[{"sha":"d15d51fb26e830af58f3f21964f1c09c239077ea","url":"https://git.kernel.org/stable/c/d15d51fb26e830af58f3f21964f1c09c239077ea"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d15d51fb26e830af58f3f21964f1c09c239077ea","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/d15d51fb26e830af58f3f21964f1c09c239077ea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80580","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80580.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80579","title":"fbdev: clear fb_info->mode before deleting a videomode","status":"unfixed","project":false,"upstream":[{"sha":"95e647d2a5304a8fd11f1ba3c8502de700650131","url":"https://git.kernel.org/stable/c/95e647d2a5304a8fd11f1ba3c8502de700650131"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"95e647d2a5304a8fd11f1ba3c8502de700650131","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/95e647d2a5304a8fd11f1ba3c8502de700650131.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80579","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80579.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80556","title":"mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition","status":"unfixed","project":false,"upstream":[{"sha":"c125ee35a49a0518521b52b27631eef061b8719a","url":"https://git.kernel.org/stable/c/c125ee35a49a0518521b52b27631eef061b8719a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c125ee35a49a0518521b52b27631eef061b8719a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/c125ee35a49a0518521b52b27631eef061b8719a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80556","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80556.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80546","title":"s390/zcrypt: Improve CCA CPRB length and overflow checks","status":"not-applicable","project":false,"upstream":[{"sha":"35ac6754ba6da45fd193f5ce3f665f7490b830d5","url":"https://git.kernel.org/stable/c/35ac6754ba6da45fd193f5ce3f665f7490b830d5"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"35ac6754ba6da45fd193f5ce3f665f7490b830d5","lines":110,"reason":"","source":"https://github.com/torvalds/linux/commit/35ac6754ba6da45fd193f5ce3f665f7490b830d5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80546","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80546.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80545","title":"s390/zcrypt: Improve EP11 CPRB length and overflow checks","status":"not-applicable","project":false,"upstream":[{"sha":"17ac0bc866fc624cd05f022dcd8b730c0af11bb1","url":"https://git.kernel.org/stable/c/17ac0bc866fc624cd05f022dcd8b730c0af11bb1"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"17ac0bc866fc624cd05f022dcd8b730c0af11bb1","lines":197,"reason":"","source":"https://github.com/torvalds/linux/commit/17ac0bc866fc624cd05f022dcd8b730c0af11bb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80545","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80545.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80544","title":"s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing","status":"not-applicable","project":false,"upstream":[{"sha":"0864a163783bff109b548266921829ea794edc93","url":"https://git.kernel.org/stable/c/0864a163783bff109b548266921829ea794edc93"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"0864a163783bff109b548266921829ea794edc93","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/0864a163783bff109b548266921829ea794edc93.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80544","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80544.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80543","title":"s390/zcrypt: Pad trailing CCA or EP11 message with zeros","status":"not-applicable","project":false,"upstream":[{"sha":"eb363254472493e3458156fc11fd56dca92f4333","url":"https://git.kernel.org/stable/c/eb363254472493e3458156fc11fd56dca92f4333"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb363254472493e3458156fc11fd56dca92f4333","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/eb363254472493e3458156fc11fd56dca92f4333.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80543","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80543.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80521","title":"af_unix: Unlink scc_entry in unix_del_edge().","status":"backported","project":true,"upstream":[{"sha":"594d905195024b228c962627ae5ae7c17bd582a4","url":"https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2b6c2842692d08e7acaf32d1eb47f95def35f3fe","label":"2b6c2842692d","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"594d905195024b228c962627ae5ae7c17bd582a4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80521","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80521.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74752","title":"sctp: validate cookie AUTH state before use","status":"unfixed","project":false,"upstream":[{"sha":"3dbb44d88b1e94dd31fe43588af7437b34b44d56","url":"https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3dbb44d88b1e94dd31fe43588af7437b34b44d56","lines":105,"reason":"","source":"https://github.com/torvalds/linux/commit/3dbb44d88b1e94dd31fe43588af7437b34b44d56.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74735","title":"l2tp: fix tunnel and session refcount leak on seq_file release","status":"queued","project":false,"upstream":[{"sha":"9006c116dd111d457bf5d074990210f70a4ad2c8","url":"https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/l2tp-fix-tunnel-and-session-refcount-leak-on-seq_fil.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/netdev/6a760f32.01d0871a.3a0d52.004f.GAE@google.com/T/#u"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"9006c116dd111d457bf5d074990210f70a4ad2c8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74735","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74735.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74725","title":"enic: fix tx_hang_reset use-after-free on device removal","status":"unfixed","project":false,"upstream":[{"sha":"ec680ea4ba1bca92a767fb7e7869758bfdd886e3","url":"https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ec680ea4ba1bca92a767fb7e7869758bfdd886e3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/ec680ea4ba1bca92a767fb7e7869758bfdd886e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74725","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74725.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74677","title":"net: usb: ipheth: fix carrier_work UAF on disconnect","status":"unfixed","project":false,"upstream":[{"sha":"fde39b8a521780391fb4e5bda2c0aa4928947f12","url":"https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fde39b8a521780391fb4e5bda2c0aa4928947f12","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/fde39b8a521780391fb4e5bda2c0aa4928947f12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74677","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74677.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74653","title":"serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx","status":"unfixed","project":false,"upstream":[{"sha":"1423415471274abda87024967d7fe2206ceee0ea","url":"https://git.kernel.org/stable/c/1423415471274abda87024967d7fe2206ceee0ea"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1423415471274abda87024967d7fe2206ceee0ea","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/1423415471274abda87024967d7fe2206ceee0ea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74653","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74653.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74638","title":"drm/v3d: Serialize the scheduler timeout handlers","status":"unfixed","project":false,"upstream":[{"sha":"4da94744707b27a3ae1197bdd7127da4505dc5b1","url":"https://git.kernel.org/stable/c/4da94744707b27a3ae1197bdd7127da4505dc5b1"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4da94744707b27a3ae1197bdd7127da4505dc5b1","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/4da94744707b27a3ae1197bdd7127da4505dc5b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74638","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74638.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74592","title":"ima: Instantiate file_truncate and path_truncate hooks","status":"unfixed","project":false,"upstream":[{"sha":"b80bed5c871a80151351342c065579405ce77145","url":"https://git.kernel.org/stable/c/b80bed5c871a80151351342c065579405ce77145"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b80bed5c871a80151351342c065579405ce77145","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/b80bed5c871a80151351342c065579405ce77145.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74592","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74592.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74560","title":"xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx","status":"not-applicable","project":false,"upstream":[{"sha":"a3c8382ebce4780c6b3ace2c09bc342313ac0186","url":"https://git.kernel.org/stable/c/a3c8382ebce4780c6b3ace2c09bc342313ac0186"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"a3c8382ebce4780c6b3ace2c09bc342313ac0186","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/a3c8382ebce4780c6b3ace2c09bc342313ac0186.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74560","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74560.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74559","title":"xsk: drain continuation descs after overflow in xsk_build_skb()","status":"not-applicable","project":false,"upstream":[{"sha":"bd44a6dcd4248883de90f5dad53ae80066e27096","url":"https://git.kernel.org/stable/c/bd44a6dcd4248883de90f5dad53ae80066e27096"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"bd44a6dcd4248883de90f5dad53ae80066e27096","lines":97,"reason":"","source":"https://github.com/torvalds/linux/commit/bd44a6dcd4248883de90f5dad53ae80066e27096.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74559","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74559.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74558","title":"xsk: reclaim invalid Tx descriptors in ZC batch path","status":"not-applicable","project":false,"upstream":[{"sha":"72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","url":"https://git.kernel.org/stable/c/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","lines":404,"reason":"","source":"https://github.com/torvalds/linux/commit/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74558","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74558.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74536","title":"Bluetooth: ISO: fix leaking sk after socket release","status":"unfixed","project":false,"upstream":[{"sha":"ce57442a379212fe3fda59c9437ee8217eceb5b1","url":"https://git.kernel.org/stable/c/ce57442a379212fe3fda59c9437ee8217eceb5b1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ce57442a379212fe3fda59c9437ee8217eceb5b1","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/ce57442a379212fe3fda59c9437ee8217eceb5b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74536","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74536.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74533","title":"Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero","status":"not-applicable","project":false,"upstream":[{"sha":"af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","url":"https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","lines":170,"reason":"","source":"https://github.com/torvalds/linux/commit/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74533","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74533.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74531","title":"Bluetooth: hci_conn: hold conn reference in abort_conn_sync()","status":"unfixed","project":false,"upstream":[{"sha":"5761d003daa987ac81463f570713ce9c9dd204e5","url":"https://git.kernel.org/stable/c/5761d003daa987ac81463f570713ce9c9dd204e5"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5761d003daa987ac81463f570713ce9c9dd204e5","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/5761d003daa987ac81463f570713ce9c9dd204e5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74531","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74531.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74521","title":"ksmbd: use memcmp() to compare ClientGUIDs","status":"backported","project":true,"upstream":[{"sha":"e8bb506e6ef749ac0336f3e579d8d02396b7d832","url":"https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7bde6f181fa307d2cc1ec2b0313ac8e9811c8232","label":"7bde6f181fa3","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e8bb506e6ef749ac0336f3e579d8d02396b7d832","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74521","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74521.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74513","title":"dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister","status":"not-applicable","project":false,"upstream":[{"sha":"a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","url":"https://git.kernel.org/stable/c/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74513","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74513.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74506","title":"afs: Fix UAF when sending a message","status":"unfixed","project":false,"upstream":[{"sha":"4af1ec68d54b3871155914d584fb10669c41a861","url":"https://git.kernel.org/stable/c/4af1ec68d54b3871155914d584fb10669c41a861"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4af1ec68d54b3871155914d584fb10669c41a861","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/4af1ec68d54b3871155914d584fb10669c41a861.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74506","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74506.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74449","title":"drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport","status":"not-applicable","project":false,"upstream":[{"sha":"f327e389c07cfc3a2f6ff54f6214e1a52d457edc","url":"https://git.kernel.org/stable/c/f327e389c07cfc3a2f6ff54f6214e1a52d457edc"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"f327e389c07cfc3a2f6ff54f6214e1a52d457edc","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/f327e389c07cfc3a2f6ff54f6214e1a52d457edc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74419","title":"accel/amdxdna: Adjust size for copy_to_user()","status":"not-applicable","project":false,"upstream":[{"sha":"6e87001fe19f251e2ae14373bc76554358a13df2","url":"https://git.kernel.org/stable/c/6e87001fe19f251e2ae14373bc76554358a13df2"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"6e87001fe19f251e2ae14373bc76554358a13df2","lines":264,"reason":"","source":"https://github.com/torvalds/linux/commit/6e87001fe19f251e2ae14373bc76554358a13df2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74419","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74419.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74407","title":"wifi: ath11k: cancel SSR work items during PCI shutdown","status":"queued","project":false,"upstream":[{"sha":"8c79aac429b583301f387374ff37c59be671df87","url":"https://git.kernel.org/stable/c/8c79aac429b583301f387374ff37c59be671df87"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/wifi-ath11k-cancel-ssr-work-items-during-pci-shutdow.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"8c79aac429b583301f387374ff37c59be671df87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74407","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74407.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74374","title":"md/raid1,raid10: fix error-path detection with md_cloned_bio()","status":"unfixed","project":false,"upstream":[{"sha":"811545e0926d02a6a0b1a1258bb5544777c164d4","url":"https://git.kernel.org/stable/c/811545e0926d02a6a0b1a1258bb5544777c164d4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"811545e0926d02a6a0b1a1258bb5544777c164d4","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/811545e0926d02a6a0b1a1258bb5544777c164d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74374","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74374.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74368","title":"wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()","status":"not-applicable","project":false,"upstream":[{"sha":"98d4f92ab6a1af2ea2ab590d7e2801b203110981","url":"https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"98d4f92ab6a1af2ea2ab590d7e2801b203110981","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/98d4f92ab6a1af2ea2ab590d7e2801b203110981.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74368","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74368.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74354","title":"bpf: Take mmap_lock in zap_pages()","status":"not-applicable","project":false,"upstream":[{"sha":"80b89d0226a05e8b67969de99c31b51fcd54f76a","url":"https://git.kernel.org/stable/c/80b89d0226a05e8b67969de99c31b51fcd54f76a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"80b89d0226a05e8b67969de99c31b51fcd54f76a","lines":93,"reason":"","source":"https://github.com/torvalds/linux/commit/80b89d0226a05e8b67969de99c31b51fcd54f76a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74354","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74354.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74342","title":"kernfs: link kn to its parent before the LSM init hook","status":"unfixed","project":false,"upstream":[{"sha":"6cccc49b027c7551ffc1d2532f2ef1922661f3da","url":"https://git.kernel.org/stable/c/6cccc49b027c7551ffc1d2532f2ef1922661f3da"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6cccc49b027c7551ffc1d2532f2ef1922661f3da","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/6cccc49b027c7551ffc1d2532f2ef1922661f3da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74342","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74342.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74337","title":"bpf: Fix NMI/tracepoint re-entry deadlock on lru locks","status":"unfixed","project":false,"upstream":[{"sha":"89edbdfc5d0308cef57b71359331de5c4ddbf763","url":"https://git.kernel.org/stable/c/89edbdfc5d0308cef57b71359331de5c4ddbf763"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"89edbdfc5d0308cef57b71359331de5c4ddbf763","lines":402,"reason":"","source":"https://github.com/torvalds/linux/commit/89edbdfc5d0308cef57b71359331de5c4ddbf763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74336","title":"wifi: mac80211: bound S1G TIM PVB walk to the TIM element","status":"not-applicable","project":false,"upstream":[{"sha":"b224d18b1e5d1cddfc67f63f41d80023b2ec8889","url":"https://git.kernel.org/stable/c/b224d18b1e5d1cddfc67f63f41d80023b2ec8889"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"b224d18b1e5d1cddfc67f63f41d80023b2ec8889","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b224d18b1e5d1cddfc67f63f41d80023b2ec8889.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74336","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74336.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74324","title":"wifi: mt76: mt7925: validate skb length in testmode query","status":"not-applicable","project":false,"upstream":[{"sha":"c7369a00860a0704461d440e7c3bf9b49bfdbaee","url":"https://git.kernel.org/stable/c/c7369a00860a0704461d440e7c3bf9b49bfdbaee"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7369a00860a0704461d440e7c3bf9b49bfdbaee","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/c7369a00860a0704461d440e7c3bf9b49bfdbaee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74324","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74324.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74314","title":"bpf: Cancel special fields on map value recycle","status":"unfixed","project":false,"upstream":[{"sha":"a3a81d247651218e47153f2d2afd7aee236726fd","url":"https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"a3a81d247651218e47153f2d2afd7aee236726fd","lines":471,"reason":"","source":"https://github.com/torvalds/linux/commit/a3a81d247651218e47153f2d2afd7aee236726fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74314","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74314.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74294","title":"ASoC: meson: aiu: Validate written enum values","status":"backported","project":true,"upstream":[{"sha":"d65adf85477247be04ac86886f8edfaa047b5d4a","url":"https://git.kernel.org/stable/c/d65adf85477247be04ac86886f8edfaa047b5d4a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/91797708f99e4a910ab019760069c0a7e00a6fc0","label":"91797708f99e","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d65adf85477247be04ac86886f8edfaa047b5d4a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74294","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74294.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74291","title":"ASoC: topology: Check PCM and DAI name strings before use","status":"queued","project":false,"upstream":[{"sha":"b7e44d1986d6671342c19b82192189ca5db5dab7","url":"https://git.kernel.org/stable/c/b7e44d1986d6671342c19b82192189ca5db5dab7"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/asoc-topology-check-pcm-and-dai-name-strings-before-.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"b7e44d1986d6671342c19b82192189ca5db5dab7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74291","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74291.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74289","title":"ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().","status":"backported","project":true,"upstream":[{"sha":"06b693d2eb6651a63ad85bad8673de3b7d4edd6d","url":"https://git.kernel.org/stable/c/06b693d2eb6651a63ad85bad8673de3b7d4edd6d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8bdb20b8a581495062b5879f4e9d435da648b3b0","label":"8bdb20b8a581","date":"2026-10-03T12:28:11+02:00","lore":["https://lore.kernel.org/netdev/6a290011.39669fcc.33b062.00b1.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"06b693d2eb6651a63ad85bad8673de3b7d4edd6d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74272","title":"cxl/region: Resolve region deletion races","status":"unfixed","project":false,"upstream":[{"sha":"4dd86ca99ffcc413cbf79063fd9956ef54e0ca91","url":"https://git.kernel.org/stable/c/4dd86ca99ffcc413cbf79063fd9956ef54e0ca91"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"4dd86ca99ffcc413cbf79063fd9956ef54e0ca91","lines":176,"reason":"","source":"https://github.com/torvalds/linux/commit/4dd86ca99ffcc413cbf79063fd9956ef54e0ca91.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74272","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74272.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74269","title":"bnxt: fix head underflow on XDP head-grow","status":"queued","project":false,"upstream":[{"sha":"e26657fe3b85c068b01f42bb0c602f242d643ba9","url":"https://git.kernel.org/stable/c/e26657fe3b85c068b01f42bb0c602f242d643ba9"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/bnxt-fix-head-underflow-on-xdp-head-grow.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"unknown","patches":[{"sha":"e26657fe3b85c068b01f42bb0c602f242d643ba9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74269","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74269.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74258","title":"bpf: Guard __get_user acesss with access_ok for uprobe_multi data","status":"not-applicable","project":false,"upstream":[{"sha":"4d87a251d45b4a95eb4c0abcfab809c9f231258a","url":"https://git.kernel.org/stable/c/4d87a251d45b4a95eb4c0abcfab809c9f231258a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"4d87a251d45b4a95eb4c0abcfab809c9f231258a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74258","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74258.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72501","title":"RDMA/bnxt_re: Initialize dpi variable to zero","status":"not-applicable","project":false,"upstream":[{"sha":"978b27d6ce538bb832ccd69e45802824e4301c4b","url":"https://git.kernel.org/stable/c/978b27d6ce538bb832ccd69e45802824e4301c4b"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"978b27d6ce538bb832ccd69e45802824e4301c4b","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/978b27d6ce538bb832ccd69e45802824e4301c4b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72501","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72501.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72496","title":"RDMA/bnxt_re: Proper rollback if the ioremap fails","status":"not-applicable","project":false,"upstream":[{"sha":"87267803a8c824616eb147c5dad7030a5db6f878","url":"https://git.kernel.org/stable/c/87267803a8c824616eb147c5dad7030a5db6f878"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"87267803a8c824616eb147c5dad7030a5db6f878","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72496","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72496.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72494","title":"RDMA/irdma: Replace waitqueue and flag with completion","status":"queued","project":false,"upstream":[{"sha":"d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd","url":"https://git.kernel.org/stable/c/d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/rdma-irdma-replace-waitqueue-and-flag-with-completio.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72494","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72494.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72493","title":"net: serialize netif_running() check in enqueue_to_backlog()","status":"unfixed","project":false,"upstream":[{"sha":"46762cefe7f4e5bffc1eb467810a7bbb02e461d7","url":"https://git.kernel.org/stable/c/46762cefe7f4e5bffc1eb467810a7bbb02e461d7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"46762cefe7f4e5bffc1eb467810a7bbb02e461d7","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/46762cefe7f4e5bffc1eb467810a7bbb02e461d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72485","title":"coresight: platform: defer connection counter increment until alloc succeeds","status":"not-applicable","project":false,"upstream":[{"sha":"1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae","url":"https://git.kernel.org/stable/c/1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72485","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72485.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72472","title":"nfs: use nfsi->rwsem to protect traversal of the file lock list","status":"queued","project":false,"upstream":[{"sha":"4837fb36219e6c08b666bc31a86841bad8526358","url":"https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/nfs-use-nfsi-rwsem-to-protect-traversal-of-the-file-.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/all/20250419085709.1452492-1-lilingfeng3@huawei.com/","https://lore.kernel.org/all/20250715030559.2906634-1-lilingfeng3@huawei.com/"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4837fb36219e6c08b666bc31a86841bad8526358","lines":87,"reason":"","source":"https://github.com/torvalds/linux/commit/4837fb36219e6c08b666bc31a86841bad8526358.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72472","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72472.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72469","title":"xprtrdma: Fix ep kref imbalance on ADDR_CHANGE","status":"unfixed","project":false,"upstream":[{"sha":"af9b65b29af341932625c4283dc7a23cdb62688a","url":"https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"af9b65b29af341932625c4283dc7a23cdb62688a","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/af9b65b29af341932625c4283dc7a23cdb62688a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72469","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72469.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72463","title":"xfrm: Fix dev use-after-free in xfrm async resumption","status":"not-applicable","project":false,"upstream":[{"sha":"8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff","url":"https://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff","lines":115,"reason":"","source":"https://github.com/torvalds/linux/commit/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72463","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72463.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72454","title":"i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()","status":"unfixed","project":false,"upstream":[{"sha":"650716f23eac488c6696babdc7805f6a6b7427ad","url":"https://git.kernel.org/stable/c/650716f23eac488c6696babdc7805f6a6b7427ad"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"650716f23eac488c6696babdc7805f6a6b7427ad","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/650716f23eac488c6696babdc7805f6a6b7427ad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72454","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72454.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72438","title":"md/raid10: fix writes_pending and barrier reference leaks on discard failures","status":"queued","project":false,"upstream":[{"sha":"393d687131d8aa8c7e4de2cb494438e145d20fc2","url":"https://git.kernel.org/stable/c/393d687131d8aa8c7e4de2cb494438e145d20fc2"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/md-raid10-fix-writes_pending-and-barrier-reference-l.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"393d687131d8aa8c7e4de2cb494438e145d20fc2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72438","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72438.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72434","title":"netfilter: ipset: make sure gc is properly stopped","status":"unfixed","project":false,"upstream":[{"sha":"4a597a87e2e2f608edb6be2c510dc826b4fdfb53","url":"https://git.kernel.org/stable/c/4a597a87e2e2f608edb6be2c510dc826b4fdfb53"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4a597a87e2e2f608edb6be2c510dc826b4fdfb53","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/4a597a87e2e2f608edb6be2c510dc826b4fdfb53.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72434","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72434.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72413","title":"sctp: fix err_chunk memory leaks in INIT handling","status":"backported","project":true,"upstream":[{"sha":"9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2","url":"https://git.kernel.org/stable/c/9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a8e6a839c0e7ca1da752faaab51e2eafb17483a4","label":"a8e6a839c0e7","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72413","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72413.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72402","title":"bpf: Mask pseudo pointer values in verifier logs","status":"backported","project":true,"upstream":[{"sha":"72a85e9464a5332fb2cd7efd26d9295275ceda2d","url":"https://git.kernel.org/stable/c/72a85e9464a5332fb2cd7efd26d9295275ceda2d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b767a5d7c6cb595f9feb00b5af96191a59efca26","label":"b767a5d7c6cb","date":"2026-10-03T12:28:11+02:00","lore":["https://lore.kernel.org/r/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-1-a190ebb8f3e2@mails.tsinghua.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"72a85e9464a5332fb2cd7efd26d9295275ceda2d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72402","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72402.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72397","title":"hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()","status":"unfixed","project":false,"upstream":[{"sha":"828cd614e2af053ca5e1d6da767bbd8a1b5cabfb","url":"https://git.kernel.org/stable/c/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"828cd614e2af053ca5e1d6da767bbd8a1b5cabfb","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72397","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72397.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72377","title":"afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints","status":"not-applicable","project":false,"upstream":[{"sha":"81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459","url":"https://git.kernel.org/stable/c/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72377","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72377.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72376","title":"afs: Fix misplaced inc of net->cells_outstanding","status":"unfixed","project":false,"upstream":[{"sha":"c9c3b615a462a4023bd148f02c564e175ed10502","url":"https://git.kernel.org/stable/c/c9c3b615a462a4023bd148f02c564e175ed10502"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c9c3b615a462a4023bd148f02c564e175ed10502","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c9c3b615a462a4023bd148f02c564e175ed10502.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72376","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72376.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72373","title":"afs: Fix missing NULL pointer check in afs_break_some_callbacks()","status":"unfixed","project":false,"upstream":[{"sha":"794a01110390c1b76f59ece773fb0fbfd89c6f5c","url":"https://git.kernel.org/stable/c/794a01110390c1b76f59ece773fb0fbfd89c6f5c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"794a01110390c1b76f59ece773fb0fbfd89c6f5c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/794a01110390c1b76f59ece773fb0fbfd89c6f5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72373","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72373.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72369","title":"minix: avoid overflow in bitmap block count calculation","status":"unfixed","project":false,"upstream":[{"sha":"fb3e566cafc38fe3ba35e6843a2d529a3748870c","url":"https://git.kernel.org/stable/c/fb3e566cafc38fe3ba35e6843a2d529a3748870c"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb3e566cafc38fe3ba35e6843a2d529a3748870c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/fb3e566cafc38fe3ba35e6843a2d529a3748870c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72369","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72369.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72367","title":"iomap: guard io_size EOF trim against concurrent truncate underflow","status":"not-applicable","project":false,"upstream":[{"sha":"55ec50d046c03b3724741957f7b007856e36dbe7","url":"https://git.kernel.org/stable/c/55ec50d046c03b3724741957f7b007856e36dbe7"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"55ec50d046c03b3724741957f7b007856e36dbe7","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/55ec50d046c03b3724741957f7b007856e36dbe7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72367","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72367.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72365","title":"netfs: Fix writethrough to use collection offload","status":"not-applicable","project":false,"upstream":[{"sha":"ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4","url":"https://git.kernel.org/stable/c/ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72365","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72365.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72355","title":"netfs: Fix barriering when walking subrequest list","status":"not-applicable","project":false,"upstream":[{"sha":"5c6ce05e406520290c1d89da97fb3cd70c09137d","url":"https://git.kernel.org/stable/c/5c6ce05e406520290c1d89da97fb3cd70c09137d"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"5c6ce05e406520290c1d89da97fb3cd70c09137d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/5c6ce05e406520290c1d89da97fb3cd70c09137d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72345","title":"net/mlx5: LAG, Fix off-by-one in single-FDB error rollback","status":"not-applicable","project":false,"upstream":[{"sha":"0f0e4ae6975c773f7854fc48932a267f6c79088f","url":"https://git.kernel.org/stable/c/0f0e4ae6975c773f7854fc48932a267f6c79088f"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0f0e4ae6975c773f7854fc48932a267f6c79088f","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0f0e4ae6975c773f7854fc48932a267f6c79088f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72345","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72345.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72334","title":"Bluetooth: ISO: fix malformed ISO_END/CONT handling","status":"backported","project":true,"upstream":[{"sha":"e054c1a6ae7310d2815778fddb87da616e11c255","url":"https://git.kernel.org/stable/c/e054c1a6ae7310d2815778fddb87da616e11c255"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d2df29dc9abda2fc10ff522eac0969f5b77b3637","label":"d2df29dc9abd","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e054c1a6ae7310d2815778fddb87da616e11c255","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72324","title":"gpio: mvebu: free generic chips on unbind","status":"unfixed","project":false,"upstream":[{"sha":"b11c513ad943f35cf5e8007d3a56279c79b7ed4b","url":"https://git.kernel.org/stable/c/b11c513ad943f35cf5e8007d3a56279c79b7ed4b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b11c513ad943f35cf5e8007d3a56279c79b7ed4b","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b11c513ad943f35cf5e8007d3a56279c79b7ed4b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72324","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72324.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72315","title":"smb: client: fix busy dentry warning on unmount after DIO","status":"unfixed","project":false,"upstream":[{"sha":"75f5c412fa867efa0bf9b646bffe0d912109e84a","url":"https://git.kernel.org/stable/c/75f5c412fa867efa0bf9b646bffe0d912109e84a"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75f5c412fa867efa0bf9b646bffe0d912109e84a","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/75f5c412fa867efa0bf9b646bffe0d912109e84a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72203","title":"ntfs: skip extent mft records in writeback to prevent deadlock","status":"unfixed","project":false,"upstream":[{"sha":"76bc14c7097ff678b2b5dbfd4fa33b46897d87ce","url":"https://git.kernel.org/stable/c/76bc14c7097ff678b2b5dbfd4fa33b46897d87ce"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"76bc14c7097ff678b2b5dbfd4fa33b46897d87ce","lines":154,"reason":"","source":"https://github.com/torvalds/linux/commit/76bc14c7097ff678b2b5dbfd4fa33b46897d87ce.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72203","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72203.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72200","title":"ntfs: detect mapping-pairs LCN accumulator overflow","status":"unfixed","project":false,"upstream":[{"sha":"ec4f061f2219e0f0c6465d56d0380bf749235a53","url":"https://git.kernel.org/stable/c/ec4f061f2219e0f0c6465d56d0380bf749235a53"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ec4f061f2219e0f0c6465d56d0380bf749235a53","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/ec4f061f2219e0f0c6465d56d0380bf749235a53.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72200","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72200.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72198","title":"ntfs: reject non-resident records for resident-only attributes","status":"unfixed","project":false,"upstream":[{"sha":"097cdfd0a55df5af82c9753833f39a8bfadbcfcb","url":"https://git.kernel.org/stable/c/097cdfd0a55df5af82c9753833f39a8bfadbcfcb"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"097cdfd0a55df5af82c9753833f39a8bfadbcfcb","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/097cdfd0a55df5af82c9753833f39a8bfadbcfcb.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72198","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72198.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72073","title":"mmc: vub300: fix use-after-free on probe failure","status":"unfixed","project":false,"upstream":[{"sha":"a3b5f242997a3be7404112fd48784881560aea57","url":"https://git.kernel.org/stable/c/a3b5f242997a3be7404112fd48784881560aea57"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a3b5f242997a3be7404112fd48784881560aea57","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/a3b5f242997a3be7404112fd48784881560aea57.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72042","title":"ipmi: Fix user refcount underflow in event delivery","status":"unfixed","project":false,"upstream":[{"sha":"6aa9e61c46465d231e9beddf56af7effd71be682","url":"https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6aa9e61c46465d231e9beddf56af7effd71be682","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/6aa9e61c46465d231e9beddf56af7effd71be682.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72042","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72042.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72028","title":"riscv: probes: save original sp in rethook trampoline","status":"queued","project":false,"upstream":[{"sha":"bc7b086a45521a986a49045907f017e3e46c763e","url":"https://git.kernel.org/stable/c/bc7b086a45521a986a49045907f017e3e46c763e"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/riscv-probes-save-original-sp-in-rethook-trampoline.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"__kretprobe_trampoline save_all_base_regs does not save original PT_SP","review":{"id":"CVE-2026-72028","series":"6.1.y","upstream":["bc7b086a45521a986a49045907f017e3e46c763e"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"__kretprobe_trampoline save_all_base_regs does not save original PT_SP","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: arch/riscv/kernel/probes/kprobes_trampoline.S","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/riscv/kernel/probes/kprobes_trampoline.S?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n78"},{"label":"Upstream fix bc7b086a4552","url":"https://git.kernel.org/stable/c/bc7b086a45521a986a49045907f017e3e46c763e"}]},"size":{"status":"unknown","patches":[{"sha":"bc7b086a45521a986a49045907f017e3e46c763e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72009","title":"pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI","status":"queued","project":false,"upstream":[{"sha":"99611233f8cda833169fa6487d5dacdf189e5cb0","url":"https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/pmdomain-imx93-blk-ctrl-extract-phy-as-shared-domain.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"DSI and CSI domains both control shared MIPI PHY reset/clock bit 12","review":{"id":"CVE-2026-72009","series":"6.1.y","upstream":["99611233f8cda833169fa6487d5dacdf189e5cb0"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"DSI and CSI domains both control shared MIPI PHY reset/clock bit 12","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/soc/imx/imx93-blk-ctrl.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/soc/imx/imx93-blk-ctrl.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 99611233f8cd","url":"https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"}]},"size":{"status":"over-limit","patches":[{"sha":"99611233f8cda833169fa6487d5dacdf189e5cb0","lines":126,"reason":"","source":"https://github.com/torvalds/linux/commit/99611233f8cda833169fa6487d5dacdf189e5cb0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72009","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72009.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72007","title":"pmdomain: imx: Fix i.MX8MP VC8000E power up sequence","status":"queued","project":false,"upstream":[{"sha":"25e252bcf1593b420b12a7231d9dd64b885a2ae2","url":"https://git.kernel.org/stable/c/25e252bcf1593b420b12a7231d9dd64b885a2ae2"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/pmdomain-imx-fix-i.mx8mp-vc8000e-power-up-sequence.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"VPU power_on enables VC8000E clock before pm_runtime_get_sync","review":{"id":"CVE-2026-72007","series":"6.1.y","upstream":["25e252bcf1593b420b12a7231d9dd64b885a2ae2"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"VPU power_on enables VC8000E clock before pm_runtime_get_sync","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/soc/imx/imx8m-blk-ctrl.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/soc/imx/imx8m-blk-ctrl.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 25e252bcf159","url":"https://git.kernel.org/stable/c/25e252bcf1593b420b12a7231d9dd64b885a2ae2"}]},"size":{"status":"unknown","patches":[{"sha":"25e252bcf1593b420b12a7231d9dd64b885a2ae2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72007","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72007.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68480","title":"x86/bugs: Make Safe-RET robust against interrupt injection","status":"unfixed","project":false,"upstream":[{"sha":"7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9","url":"https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9"},{"sha":"52db77a13be224e09eb4ba6b4252ae8ab9085c2c","url":"https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c"},{"sha":"dfefa3c51370f84acb643cddf98bb42c885d0483","url":"https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483"}],"evidence":[],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"over-limit","patches":[{"sha":"7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9","lines":187,"reason":"","source":"https://github.com/torvalds/linux/commit/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9.patch"},{"sha":"52db77a13be224e09eb4ba6b4252ae8ab9085c2c","lines":190,"reason":"","source":"https://github.com/torvalds/linux/commit/52db77a13be224e09eb4ba6b4252ae8ab9085c2c.patch"},{"sha":"dfefa3c51370f84acb643cddf98bb42c885d0483","lines":190,"reason":"","source":"https://github.com/torvalds/linux/commit/dfefa3c51370f84acb643cddf98bb42c885d0483.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68480","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68480.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68471","title":"wifi: ieee80211: validate MLE common info length","status":"queued","project":false,"upstream":[{"sha":"293baeae9b2434a3e432629d7720b5603db2d77e","url":"https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/wifi-ieee80211-validate-mle-common-info-length.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The merged ieee80211_mle_size_ok check verifies common-info minimum length but not that it fits inside the supplied element length.","review":{"id":"CVE-2026-68471","series":"6.1.y","upstream":["293baeae9b2434a3e432629d7720b5603db2d77e"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"The merged ieee80211_mle_size_ok check verifies common-info minimum length but not that it fits inside the supplied element length.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: include/linux/ieee80211.h","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/linux/ieee80211.h?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n4568"},{"label":"Upstream fix 293baeae9b24","url":"https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"}]},"size":{"status":"unknown","patches":[{"sha":"293baeae9b2434a3e432629d7720b5603db2d77e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68471","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68471.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68470","title":"wifi: mac80211: validate extension-frame layout before RX","status":"unfixed","project":false,"upstream":[{"sha":"57d503ce32eccfa7650065ca4c560f7e29a2e676","url":"https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"57d503ce32eccfa7650065ca4c560f7e29a2e676","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/57d503ce32eccfa7650065ca4c560f7e29a2e676.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68470","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68470.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68447","title":"drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size","status":"unfixed","project":false,"upstream":[{"sha":"426ffae6ecc7ec77d32bf8be065c21a1b881b084","url":"https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"426ffae6ecc7ec77d32bf8be065c21a1b881b084","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/426ffae6ecc7ec77d32bf8be065c21a1b881b084.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68447","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68447.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68421","title":"sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()","status":"not-applicable","project":false,"upstream":[{"sha":"b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da","url":"https://git.kernel.org/stable/c/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68421","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68421.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68412","title":"wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()","status":"unfixed","project":false,"upstream":[{"sha":"c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6","url":"https://git.kernel.org/stable/c/c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68412","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68412.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68391","title":"Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds","status":"backported","project":true,"upstream":[{"sha":"da55f570191d5d72f10c607a7043b947eb05ea46","url":"https://git.kernel.org/stable/c/da55f570191d5d72f10c607a7043b947eb05ea46"}],"evidence":[{"url":"https://git.kernel.org/stable/c/84674dd1d3192ecb050827d3148642609c0c9dbb","label":"84674dd1d319","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"da55f570191d5d72f10c607a7043b947eb05ea46","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68391","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68391.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68382","title":"drm/xe/guc: Hold device ref until queue teardown completes","status":"not-applicable","project":false,"upstream":[{"sha":"9b7e60184f4b22e893d4ae95234d5f26261a430c","url":"https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"9b7e60184f4b22e893d4ae95234d5f26261a430c","lines":263,"reason":"","source":"https://github.com/torvalds/linux/commit/9b7e60184f4b22e893d4ae95234d5f26261a430c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68382","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68382.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68337","title":"bpf: Reject redirect helpers without a bpf_net_context","status":"unfixed","project":false,"upstream":[{"sha":"3f4920d165b29052255527d8ae7619e7ec132ece","url":"https://git.kernel.org/stable/c/3f4920d165b29052255527d8ae7619e7ec132ece"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f4920d165b29052255527d8ae7619e7ec132ece","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/3f4920d165b29052255527d8ae7619e7ec132ece.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68303","title":"drm/vc4: hvs/v3d: Fix null dereference in unbind","status":"queued","project":true,"upstream":[{"sha":"7dc3680b7ffe01add3e9299fde8471d2dd53a8ae","url":"https://git.kernel.org/stable/c/7dc3680b7ffe01add3e9299fde8471d2dd53a8ae"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-vc4-hvs-v3d-fix-null-dereference-in-unbind.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"7dc3680b7ffe01add3e9299fde8471d2dd53a8ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68303","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68303.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68290","title":"rds: tcp: unregister sysctl before tearing down listen socket","status":"queued","project":false,"upstream":[{"sha":"167e54c703ccd4fa028feb568b0d1002020cff86","url":"https://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/rds-tcp-unregister-sysctl-before-tearing-down-listen.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/all/20260719203718.9680-1-blbllhy@gmail.com"]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"167e54c703ccd4fa028feb568b0d1002020cff86","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/167e54c703ccd4fa028feb568b0d1002020cff86.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68290","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68290.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68289","title":"tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()","status":"backported","project":true,"upstream":[{"sha":"47f42ff521b4eeb46e82f9a46a4783a99f7570d7","url":"https://git.kernel.org/stable/c/47f42ff521b4eeb46e82f9a46a4783a99f7570d7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9fd4f92671146b068809b6c34b50346cb30cf8f7","label":"9fd4f9267114","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"47f42ff521b4eeb46e82f9a46a4783a99f7570d7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68288","title":"net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD","status":"backported","project":true,"upstream":[{"sha":"5e9c8baee0329fbefe7c67aea945e2a07f15e98b","url":"https://git.kernel.org/stable/c/5e9c8baee0329fbefe7c67aea945e2a07f15e98b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d427b152b663cb2b19fcd449d792e17edbe4a938","label":"d427b152b663","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5e9c8baee0329fbefe7c67aea945e2a07f15e98b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68287","title":"drop_monitor: fix size calculations for 64-bit attributes","status":"backported","project":true,"upstream":[{"sha":"7089f7ab99c89f443c92d8fcc585e63f2727f0b3","url":"https://git.kernel.org/stable/c/7089f7ab99c89f443c92d8fcc585e63f2727f0b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1275a4769c126405c6c63b6372daff120ac679a6","label":"1275a4769c12","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7089f7ab99c89f443c92d8fcc585e63f2727f0b3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68287","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68287.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68286","title":"drop_monitor: perform u64_stats updates under IRQ-disabled section","status":"backported","project":true,"upstream":[{"sha":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","url":"https://git.kernel.org/stable/c/fd098a23bf8fda7eae48db9b06e7c34fc4d228fa"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dd8472526a04f2185afd792b8041a912a7d75d85","label":"dd8472526a04","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68286","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68286.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68245","title":"drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()","status":"not-applicable","project":false,"upstream":[{"sha":"04cc4aa3617b0ed67e859f91f09de5d896a46f3a","url":"https://git.kernel.org/stable/c/04cc4aa3617b0ed67e859f91f09de5d896a46f3a"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"04cc4aa3617b0ed67e859f91f09de5d896a46f3a","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/04cc4aa3617b0ed67e859f91f09de5d896a46f3a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68245","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68245.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68205","title":"media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()","status":"unfixed","project":false,"upstream":[{"sha":"06cb687a5132fcffe624c0070576ab852ac6b568","url":"https://git.kernel.org/stable/c/06cb687a5132fcffe624c0070576ab852ac6b568"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"06cb687a5132fcffe624c0070576ab852ac6b568","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/06cb687a5132fcffe624c0070576ab852ac6b568.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68205","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68205.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68161","title":"sctp: close UDP tunnel sockets during netns teardown","status":"backported","project":true,"upstream":[{"sha":"ffb2bd7ade36ec4da32c46a6eddbf4515316d08c","url":"https://git.kernel.org/stable/c/ffb2bd7ade36ec4da32c46a6eddbf4515316d08c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c29affd44e6769e3073235d4b471d9b501fa8166","label":"c29affd44e67","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ffb2bd7ade36ec4da32c46a6eddbf4515316d08c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68152","title":"amt: fix use-after-free in AMT delayed works","status":"unfixed","project":false,"upstream":[{"sha":"ea20c44935d6142daecfa9b39d635033a7553e1b","url":"https://git.kernel.org/stable/c/ea20c44935d6142daecfa9b39d635033a7553e1b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ea20c44935d6142daecfa9b39d635033a7553e1b","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/ea20c44935d6142daecfa9b39d635033a7553e1b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68152","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68152.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68112","title":"drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()","status":"not-applicable","project":false,"upstream":[{"sha":"00f4050f7c367d7bdce347ca279ce467c434cf15","url":"https://git.kernel.org/stable/c/00f4050f7c367d7bdce347ca279ce467c434cf15"}],"evidence":[],"submission_lore":[],"basis":"The target includes gfx_v9_4 and gfx_v9_4_2 but no gfx_v9_4_3 ASIC implementation or corresponding affected engine path.","review":{"id":"CVE-2026-68112","series":"6.1.y","upstream":["00f4050f7c367d7bdce347ca279ce467c434cf15"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The target includes gfx_v9_4 and gfx_v9_4_2 but no gfx_v9_4_3 ASIC implementation or corresponding affected engine path.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/gpu/drm/amd/amdgpu absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/amdgpu?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 00f4050f7c36","url":"https://git.kernel.org/stable/c/00f4050f7c367d7bdce347ca279ce467c434cf15"}]},"size":{"status":"within-limit","patches":[{"sha":"00f4050f7c367d7bdce347ca279ce467c434cf15","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/00f4050f7c367d7bdce347ca279ce467c434cf15.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68112","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68112.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68103","title":"drm/amdgpu: reject mapping a reserved doorbell to a new queue","status":"not-applicable","project":false,"upstream":[{"sha":"a609b6278bf3cde17eeee6620091465521e4b02c","url":"https://git.kernel.org/stable/c/a609b6278bf3cde17eeee6620091465521e4b02c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"a609b6278bf3cde17eeee6620091465521e4b02c","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a609b6278bf3cde17eeee6620091465521e4b02c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68097","title":"ksmbd: validate ACE size against SID sub-authorities","status":"backported","project":true,"upstream":[{"sha":"5152c6d49e3fd4e9f2e857c57527aead752f1f87","url":"https://git.kernel.org/stable/c/5152c6d49e3fd4e9f2e857c57527aead752f1f87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5a2d9fe0e87c71baa0aaa1cfc1361892fcd1ece0","label":"5a2d9fe0e87c","date":"2026-10-03T12:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5152c6d49e3fd4e9f2e857c57527aead752f1f87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68086","title":"mm/khugepaged: write all dirty file folios when collapsing","status":"unfixed","project":false,"upstream":[{"sha":"2dfe9f5c91d0963058f8a5e46e1c2a908382cc46","url":"https://git.kernel.org/stable/c/2dfe9f5c91d0963058f8a5e46e1c2a908382cc46"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2dfe9f5c91d0963058f8a5e46e1c2a908382cc46","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/2dfe9f5c91d0963058f8a5e46e1c2a908382cc46.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68086","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68086.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68085","title":"Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled","status":"unfixed","project":false,"upstream":[{"sha":"1b0d946d6f08bd39211385bc703a440911b41e46","url":"https://git.kernel.org/stable/c/1b0d946d6f08bd39211385bc703a440911b41e46"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1b0d946d6f08bd39211385bc703a440911b41e46","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/1b0d946d6f08bd39211385bc703a440911b41e46.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64525","title":"xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit","status":"not-applicable","project":false,"upstream":[{"sha":"3e52417318473782012b236d0325bf7d2266a597","url":"https://git.kernel.org/stable/c/3e52417318473782012b236d0325bf7d2266a597"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3e52417318473782012b236d0325bf7d2266a597","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/3e52417318473782012b236d0325bf7d2266a597.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64525","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64525.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64520","title":"firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies","status":"not-applicable","project":false,"upstream":[{"sha":"3974ea1938406f9bfa7c1f48d4e43533f447bb08","url":"https://git.kernel.org/stable/c/3974ea1938406f9bfa7c1f48d4e43533f447bb08"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"3974ea1938406f9bfa7c1f48d4e43533f447bb08","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/3974ea1938406f9bfa7c1f48d4e43533f447bb08.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64520","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64520.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64513","title":"KVM: x86: Unconditionally recompute CR8 intercept on PPR update","status":"unfixed","project":false,"upstream":[{"sha":"bb365a506b1e6fb050c0fceaad354fe395385ef0","url":"https://git.kernel.org/stable/c/bb365a506b1e6fb050c0fceaad354fe395385ef0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"bb365a506b1e6fb050c0fceaad354fe395385ef0","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/bb365a506b1e6fb050c0fceaad354fe395385ef0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64513","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64513.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64481","title":"ALSA: hda/cs35l41: Fix firmware load work teardown","status":"queued","project":false,"upstream":[{"sha":"b65020d5398f499c09498c9786dba6d67ae57664","url":"https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/alsa-hda-cs35l41-fix-firmware-load-work-teardown.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"unbind/remove do not unconditionally drain fw_load_work and remove controls","review":{"id":"CVE-2026-64481","series":"6.1.y","upstream":["b65020d5398f499c09498c9786dba6d67ae57664"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"unbind/remove do not unconditionally drain fw_load_work and remove controls","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: sound/pci/hda/cs35l41_hda.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/sound/pci/hda/cs35l41_hda.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix b65020d5398f","url":"https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664"}]},"size":{"status":"unknown","patches":[{"sha":"b65020d5398f499c09498c9786dba6d67ae57664","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64481","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64481.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64424","title":"netpoll: fix a use-after-free on shutdown path","status":"queued","project":false,"upstream":[{"sha":"45f1458a85017a023f138b22ac5c76abd477db42","url":"https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/netpoll-fix-a-use-after-free-on-shutdown-path.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"45f1458a85017a023f138b22ac5c76abd477db42","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/45f1458a85017a023f138b22ac5c76abd477db42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64305","title":"crypto: qat - protect service table iterations with service_lock","status":"queued","project":false,"upstream":[{"sha":"5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e","url":"https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/crypto-qat-protect-service-table-iterations-with-ser.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"adf_dev_init/start/stop and other service_table traversals lack service_lock","review":{"id":"CVE-2026-64305","series":"6.1.y","upstream":["5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"adf_dev_init/start/stop and other service_table traversals lack service_lock","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/crypto/qat/qat_common/adf_init.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/crypto/qat/qat_common/adf_init.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n51"},{"label":"Upstream fix 5c6f845e77ec","url":"https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e"}]},"size":{"status":"unknown","patches":[{"sha":"5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64305","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64305.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64255","title":"wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers","status":"not-applicable","project":false,"upstream":[{"sha":"f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","url":"https://git.kernel.org/stable/c/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64255","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64255.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64241","title":"gpio: rockchip: teardown bugs and resource leaks","status":"unfixed","project":false,"upstream":[{"sha":"9500077678230e36d22bf16d2b9539c13e59a801","url":"https://git.kernel.org/stable/c/9500077678230e36d22bf16d2b9539c13e59a801"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9500077678230e36d22bf16d2b9539c13e59a801","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/9500077678230e36d22bf16d2b9539c13e59a801.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64241","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64241.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64212","title":"wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it","status":"not-applicable","project":false,"upstream":[{"sha":"d733ed481fd20a8e7bfe5119c4e77761ba3f87ee","url":"https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee"}],"evidence":[],"submission_lore":[],"basis":"The iwlwifi MLD remove-link implementation changed upstream is absent from this target; no corresponding remove-link path exists.","review":{"id":"CVE-2026-64212","series":"6.1.y","upstream":["d733ed481fd20a8e7bfe5119c4e77761ba3f87ee"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The iwlwifi MLD remove-link implementation changed upstream is absent from this target; no corresponding remove-link path exists.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/net/wireless/intel/iwlwifi/mld/link.c absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix d733ed481fd2","url":"https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee"}]},"size":{"status":"within-limit","patches":[{"sha":"d733ed481fd20a8e7bfe5119c4e77761ba3f87ee","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64212","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64212.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64190","title":"net: team: fix NULL pointer dereference in team_xmit during mode change","status":"queued","project":false,"upstream":[{"sha":"25fe708bbc59289d3d1ea4b126fbc1b460a072a5","url":"https://git.kernel.org/stable/c/25fe708bbc59289d3d1ea4b126fbc1b460a072a5"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/net-team-fix-null-pointer-dereference-in-team_xmit-d.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"team_adjust_ops and mode change publish/clear ops with plain stores while team_xmit reads them locklessly; fix adds WRITE_ONCE and synchronize_net.","review":{"id":"CVE-2026-64190","series":"6.1.y","upstream":["25fe708bbc59289d3d1ea4b126fbc1b460a072a5"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"team_adjust_ops and mode change publish/clear ops with plain stores while team_xmit reads them locklessly; fix adds WRITE_ONCE and synchronize_net.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/team/team.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/team/team.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n529"},{"label":"Checked source: drivers/net/team/team.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/team/team.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n529"},{"label":"Checked source: drivers/net/team/team.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/team/team.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n529"},{"label":"Upstream fix 25fe708bbc59","url":"https://git.kernel.org/stable/c/25fe708bbc59289d3d1ea4b126fbc1b460a072a5"}]},"size":{"status":"unknown","patches":[{"sha":"25fe708bbc59289d3d1ea4b126fbc1b460a072a5","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64190","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64190.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64163","title":"test_kprobes: clear kprobes between test runs","status":"queued","project":false,"upstream":[{"sha":"ef5581bb30efb939cc2bf093475c6cc85258e5cd","url":"https://git.kernel.org/stable/c/ef5581bb30efb939cc2bf093475c6cc85258e5cd"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/test_kprobes-clear-kprobes-between-test-runs.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/all/20260507134615.1010905-1-martin@kaiser.cx/"]}],"submission_lore":[],"basis":"kprobes_test_init does not reset global test state for repeated suite runs","review":{"id":"CVE-2026-64163","series":"6.1.y","upstream":["ef5581bb30efb939cc2bf093475c6cc85258e5cd"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"kprobes_test_init does not reset global test state for repeated suite runs","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: lib/test_kprobes.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/lib/test_kprobes.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n335"},{"label":"Upstream fix ef5581bb30ef","url":"https://git.kernel.org/stable/c/ef5581bb30efb939cc2bf093475c6cc85258e5cd"}]},"size":{"status":"unknown","patches":[{"sha":"ef5581bb30efb939cc2bf093475c6cc85258e5cd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64163","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64163.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64160","title":"netfs: Fix potential for tearing in ->remote_i_size and ->zero_point","status":"unfixed","project":false,"upstream":[{"sha":"2c8f4742bb76117d735f92a3932d85239b16c494","url":"https://git.kernel.org/stable/c/2c8f4742bb76117d735f92a3932d85239b16c494"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2c8f4742bb76117d735f92a3932d85239b16c494","lines":953,"reason":"","source":"https://github.com/torvalds/linux/commit/2c8f4742bb76117d735f92a3932d85239b16c494.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64160","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64160.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64112","title":"rbd: eliminate a race in lock_dwork draining on unmap","status":"unfixed","project":false,"upstream":[{"sha":"9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90","url":"https://git.kernel.org/stable/c/9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64112","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64112.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64109","title":"af_unix: Fix UAF read of tail->len in unix_stream_data_wait()","status":"unfixed","project":false,"upstream":[{"sha":"be309f8eae8b474a4a617eaae01324da996fc719","url":"https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"be309f8eae8b474a4a617eaae01324da996fc719","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/be309f8eae8b474a4a617eaae01324da996fc719.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64109","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64109.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64082","title":"riscv: Fix register corruption from uninitialized cregs on error","status":"backported","project":true,"upstream":[{"sha":"6ebcbb53fc9bc30843054ed99fd60b8e542628f4","url":"https://git.kernel.org/stable/c/6ebcbb53fc9bc30843054ed99fd60b8e542628f4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f2d88b0d7aebfa4643fc58bbae57210c6daff9c6","label":"f2d88b0d7aeb","date":"2026-09-02T14:28:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6ebcbb53fc9bc30843054ed99fd60b8e542628f4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64082","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64082.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64079","title":"netfilter: x_tables: allocate hook ops while under mutex","status":"unfixed","project":false,"upstream":[{"sha":"b62eb8dcf2c47d4d676a434efbd57c4f776f7829","url":"https://git.kernel.org/stable/c/b62eb8dcf2c47d4d676a434efbd57c4f776f7829"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"b62eb8dcf2c47d4d676a434efbd57c4f776f7829","lines":271,"reason":"","source":"https://github.com/torvalds/linux/commit/b62eb8dcf2c47d4d676a434efbd57c4f776f7829.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64078","title":"netfilter: x_tables: add and use xtables_unregister_table_exit","status":"unfixed","project":false,"upstream":[{"sha":"b4597d5fd7d2f8cebfffd40dffb5e003cc78964c","url":"https://git.kernel.org/stable/c/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"b4597d5fd7d2f8cebfffd40dffb5e003cc78964c","lines":246,"reason":"","source":"https://github.com/torvalds/linux/commit/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64078","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64078.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64070","title":"powerpc/hv-gpci: fix preempt count leak in sysfs show paths","status":"not-applicable","project":false,"upstream":[{"sha":"dbc30a57bd8e026995e9fa8e8c31cffd18542c01","url":"https://git.kernel.org/stable/c/dbc30a57bd8e026995e9fa8e8c31cffd18542c01"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"dbc30a57bd8e026995e9fa8e8c31cffd18542c01","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64070","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64070.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64068","title":"netfs: Fix missing locking around retry adding new subreqs","status":"not-applicable","project":false,"upstream":[{"sha":"cce18c263e9623872327ba3c956012f73c1179cc","url":"https://git.kernel.org/stable/c/cce18c263e9623872327ba3c956012f73c1179cc"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"cce18c263e9623872327ba3c956012f73c1179cc","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64068","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64068.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64067","title":"netfs: Fix missing barriers when accessing stream->subrequests locklessly","status":"not-applicable","project":false,"upstream":[{"sha":"b5782e2d462c028096f922abca46318cec890670","url":"https://git.kernel.org/stable/c/b5782e2d462c028096f922abca46318cec890670"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5782e2d462c028096f922abca46318cec890670","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/b5782e2d462c028096f922abca46318cec890670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64067","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64067.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64066","title":"netfs: Fix netfs_read_to_pagecache() to pause on subreq failure","status":"not-applicable","project":false,"upstream":[{"sha":"8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4","url":"https://git.kernel.org/stable/c/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64066","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64066.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64060","title":"netfs: Fix leak of request in netfs_write_begin() error handling","status":"unfixed","project":false,"upstream":[{"sha":"5046a34f0643441f05b0253ea64e1a3af87efe14","url":"https://git.kernel.org/stable/c/5046a34f0643441f05b0253ea64e1a3af87efe14"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5046a34f0643441f05b0253ea64e1a3af87efe14","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/5046a34f0643441f05b0253ea64e1a3af87efe14.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64060","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64060.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64026","title":"rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg","status":"unfixed","project":false,"upstream":[{"sha":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","url":"https://git.kernel.org/stable/c/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","lines":534,"reason":"","source":"https://github.com/torvalds/linux/commit/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64017","title":"blk-mq: pop cached request if it is usable","status":"queued","project":false,"upstream":[{"sha":"dc278e9bf2b9513a763353e6b9cc21e0f532954e","url":"https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/blk-mq-pop-cached-request-if-it-is-usable.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"unknown","patches":[{"sha":"dc278e9bf2b9513a763353e6b9cc21e0f532954e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64001","title":"ALSA: pcm: oss: Fix setup list UAF on proc write error","status":"unfixed","project":false,"upstream":[{"sha":"4cc54bdd54b337e77115be5b55577d1c58608eae","url":"https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4cc54bdd54b337e77115be5b55577d1c58608eae","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/4cc54bdd54b337e77115be5b55577d1c58608eae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64001","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64001.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63999","title":"ethtool: rss: fix indir_table and hkey leak on get_rxfh failure","status":"not-applicable","project":false,"upstream":[{"sha":"266297692f97008ca48bc311775c087c59bd7fe3","url":"https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3"}],"evidence":[],"submission_lore":[],"basis":"The older ioctl get-rxfh implementation uses one rss_config allocation and frees it on the callback error path, so the reported indir_table/hkey leaks do not occur.","review":{"id":"CVE-2026-63999","series":"6.1.y","upstream":["266297692f97008ca48bc311775c087c59bd7fe3"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"no-op","applicability":"unaffected","reason":"The older ioctl get-rxfh implementation uses one rss_config allocation and frees it on the callback error path, so the reported indir_table/hkey leaks do not occur.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: net/ethtool/ioctl.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/ethtool/ioctl.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1170"},{"label":"Upstream fix 266297692f97","url":"https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3"}]},"size":{"status":"within-limit","patches":[{"sha":"266297692f97008ca48bc311775c087c59bd7fe3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/266297692f97008ca48bc311775c087c59bd7fe3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63983","title":"net/sched: fix packet loop on netem when duplicate is on","status":"unfixed","project":false,"upstream":[{"sha":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","url":"https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/9552b11e3edabc97cfcd9f29103d5afbce7ae183.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63983","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63983.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63977","title":"dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work","status":"not-applicable","project":false,"upstream":[{"sha":"d733f519f6443540f8359461a34e3b0042099bbe","url":"https://git.kernel.org/stable/c/d733f519f6443540f8359461a34e3b0042099bbe"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"d733f519f6443540f8359461a34e3b0042099bbe","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/d733f519f6443540f8359461a34e3b0042099bbe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63977","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63977.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63959","title":"usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT","status":"queued","project":false,"upstream":[{"sha":"aa2f716327be1818e1cb156da8a2844804aaec2f","url":"https://git.kernel.org/stable/c/aa2f716327be1818e1cb156da8a2844804aaec2f"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/usb-typec-tcpm-tcpci_maxim-validate-header-ndo-again.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"process_rx bounds RX_BYTE_CNT by buffer length but not PD header NDO","review":{"id":"CVE-2026-63959","series":"6.1.y","upstream":["aa2f716327be1818e1cb156da8a2844804aaec2f"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"process_rx bounds RX_BYTE_CNT by buffer length but not PD header NDO","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/usb/typec/tcpm/tcpci_maxim.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/usb/typec/tcpm/tcpci_maxim.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n146"},{"label":"Upstream fix aa2f716327be","url":"https://git.kernel.org/stable/c/aa2f716327be1818e1cb156da8a2844804aaec2f"}]},"size":{"status":"unknown","patches":[{"sha":"aa2f716327be1818e1cb156da8a2844804aaec2f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63959","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63959.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63941","title":"KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor","status":"not-applicable","project":false,"upstream":[{"sha":"83726330748981372bde86ed5411d7b306612991","url":"https://git.kernel.org/stable/c/83726330748981372bde86ed5411d7b306612991"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"83726330748981372bde86ed5411d7b306612991","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/83726330748981372bde86ed5411d7b306612991.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63941","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63941.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63871","title":"Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls","status":"queued","project":false,"upstream":[{"sha":"9ca7053d6215d89c33f28893bfd1625a32919d3f","url":"https://git.kernel.org/stable/c/9ca7053d6215d89c33f28893bfd1625a32919d3f"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/bluetooth-iso-fix-data-race-on-iso_pi-fields-in-hci_.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"9ca7053d6215d89c33f28893bfd1625a32919d3f","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/9ca7053d6215d89c33f28893bfd1625a32919d3f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63871","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63871.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63858","title":"netfilter: nf_tables: add hook transactions for device deletions","status":"unfixed","project":false,"upstream":[{"sha":"10f79dbd7719d1da9f5884d13060322d8729f091","url":"https://git.kernel.org/stable/c/10f79dbd7719d1da9f5884d13060322d8729f091"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"10f79dbd7719d1da9f5884d13060322d8729f091","lines":525,"reason":"","source":"https://github.com/torvalds/linux/commit/10f79dbd7719d1da9f5884d13060322d8729f091.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63858","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63858.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63839","title":"platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()","status":"not-applicable","project":false,"upstream":[{"sha":"0c3887a134f191723b53e2a47e501b534c8723ee","url":"https://git.kernel.org/stable/c/0c3887a134f191723b53e2a47e501b534c8723ee"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"0c3887a134f191723b53e2a47e501b534c8723ee","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63839","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63839.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63819","title":"f2fs: fix to do sanity check on f2fs_get_node_folio_ra()","status":"unfixed","project":false,"upstream":[{"sha":"8712353ed80f87271d732297567dcdbe4b84e8c7","url":"https://git.kernel.org/stable/c/8712353ed80f87271d732297567dcdbe4b84e8c7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8712353ed80f87271d732297567dcdbe4b84e8c7","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8712353ed80f87271d732297567dcdbe4b84e8c7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63819","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63819.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63816","title":"f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode","status":"unfixed","project":false,"upstream":[{"sha":"e0288584baa5dc41df4a829a023c4c1b33fe53d7","url":"https://git.kernel.org/stable/c/e0288584baa5dc41df4a829a023c4c1b33fe53d7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"e0288584baa5dc41df4a829a023c4c1b33fe53d7","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/e0288584baa5dc41df4a829a023c4c1b33fe53d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63816","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63816.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63805","title":"crypto: nx - fix nx_crypto_ctx_exit argument","status":"unfixed","project":false,"upstream":[{"sha":"4e67f504ee9ded15e256b64f4fde150e917381d7","url":"https://git.kernel.org/stable/c/4e67f504ee9ded15e256b64f4fde150e917381d7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4e67f504ee9ded15e256b64f4fde150e917381d7","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/4e67f504ee9ded15e256b64f4fde150e917381d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63805","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63805.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53368","title":"f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage","status":"queued","project":false,"upstream":[{"sha":"019f9dda7f66e55eb94cd32e1d3fff5835f73fbc","url":"https://git.kernel.org/stable/c/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/f2fs-fix-fsck-inconsistency-caused-by-incorrect-nat_.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"019f9dda7f66e55eb94cd32e1d3fff5835f73fbc","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53368","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53368.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53313","title":"drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths","status":"queued","project":false,"upstream":[{"sha":"4ae3e16f4b3bf64140f773629b765d605ee079a9","url":"https://git.kernel.org/stable/c/4ae3e16f4b3bf64140f773629b765d605ee079a9"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-avoid-null-dereference-in-dc_dmub_sr.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"4ae3e16f4b3bf64140f773629b765d605ee079a9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53285","title":"drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED","status":"unfixed","project":false,"upstream":[{"sha":"183182235f6d53bac62c6c39014738a54a68dfa6","url":"https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6"}],"evidence":[],"submission_lore":[],"basis":"dcn32_enable_phantom_plane() allocates a phantom plane through dc_create_plane_state() without re-enabling preemption; the helper is reached from phantom-pipe addition in DML validation and retains the allocation-in-FP/softirq-disabled failure fixed upstream.","review":{"id":"CVE-2026-53285","series":"6.1.y","upstream":["183182235f6d53bac62c6c39014738a54a68dfa6"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"dcn32_enable_phantom_plane() allocates a phantom plane through dc_create_plane_state() without re-enabling preemption; the helper is reached from phantom-pipe addition in DML validation and retains the allocation-in-FP/softirq-disabled failure fixed upstream.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1652"},{"label":"Upstream fix 183182235f6d","url":"https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6"}]},"size":{"status":"within-limit","patches":[{"sha":"183182235f6d53bac62c6c39014738a54a68dfa6","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/183182235f6d53bac62c6c39014738a54a68dfa6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53285","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53285.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53246","title":"sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing","status":"unfixed","project":false,"upstream":[{"sha":"0861615c28de668669d748ef4eb913ea9262d13b","url":"https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0861615c28de668669d748ef4eb913ea9262d13b","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/0861615c28de668669d748ef4eb913ea9262d13b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53246","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53246.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53226","title":"gpio: rockchip: fix generic IRQ chip leak on remove","status":"unfixed","project":false,"upstream":[{"sha":"1c1e0fc88d6ef65bf15d517853251f75ab9d18c3","url":"https://git.kernel.org/stable/c/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c1e0fc88d6ef65bf15d517853251f75ab9d18c3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53226","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53226.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53185","title":"zram: fix use-after-free in zram_bvec_write_partial()","status":"unfixed","project":false,"upstream":[{"sha":"732fd9f0b9c1cdc6dfd77162ded60df005182cc0","url":"https://git.kernel.org/stable/c/732fd9f0b9c1cdc6dfd77162ded60df005182cc0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"732fd9f0b9c1cdc6dfd77162ded60df005182cc0","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/732fd9f0b9c1cdc6dfd77162ded60df005182cc0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53185","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53185.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53179","title":"staging: rtl8723bs: fix buffer over-read in rtw_update_protection","status":"unfixed","project":false,"upstream":[{"sha":"514ab98364595007d4557ecc85d7e5f012c504d3","url":"https://git.kernel.org/stable/c/514ab98364595007d4557ecc85d7e5f012c504d3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"514ab98364595007d4557ecc85d7e5f012c504d3","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/514ab98364595007d4557ecc85d7e5f012c504d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53179","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53179.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53178","title":"staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction","status":"unfixed","project":false,"upstream":[{"sha":"88e994c57a79f62d5338231d8d37ee8dd98baffe","url":"https://git.kernel.org/stable/c/88e994c57a79f62d5338231d8d37ee8dd98baffe"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"88e994c57a79f62d5338231d8d37ee8dd98baffe","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/88e994c57a79f62d5338231d8d37ee8dd98baffe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53178","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53178.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53156","title":"nvmem: core: fix use-after-free bugs in error paths","status":"not-applicable","project":false,"upstream":[{"sha":"5b6b6fc491899d583eaa75344e094796ae9b530b","url":"https://git.kernel.org/stable/c/5b6b6fc491899d583eaa75344e094796ae9b530b"}],"evidence":[],"submission_lore":[],"basis":"Upstream reorders nvmem layout-module release ahead of the final device put to avoid using nvmem after it may be freed. Do not backport: 6.1.y lacks the relevant layout ownership, and 6.6.y lacks nvmem_layout_module_get_optional()/nvmem_layout_module_put() and the vulnerable per-cell get/put scheme. Applying fragments would be an effective no-op or invent a foreign lifetime model; neither target can reach the upstream use-after-free sequence.","review":{"id":"CVE-2026-53156","series":"6.1.y","upstream":["5b6b6fc491899d583eaa75344e094796ae9b530b"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"Upstream reorders nvmem layout-module release ahead of the final device put to avoid using nvmem after it may be freed. Do not backport: 6.1.y lacks the relevant layout ownership, and 6.6.y lacks nvmem_layout_module_get_optional()/nvmem_layout_module_put() and the vulnerable per-cell get/put scheme. Applying fragments would be an effective no-op or invent a foreign lifetime model; neither target can reach the upstream use-after-free sequence.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"5b6b6fc491899d583eaa75344e094796ae9b530b","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/5b6b6fc491899d583eaa75344e094796ae9b530b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53156","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53156.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53143","title":"drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11","status":"unfixed","project":false,"upstream":[{"sha":"352ea59028ea48a6fff77f19ae28f98f71946a80","url":"https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"352ea59028ea48a6fff77f19ae28f98f71946a80","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/352ea59028ea48a6fff77f19ae28f98f71946a80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53143","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53143.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53132","title":"vsock/virtio: fix potential unbounded skb queue","status":"unfixed","project":false,"upstream":[{"sha":"059b7dbd20a6f0c539a45ddff1573cb8946685b5","url":"https://git.kernel.org/stable/c/059b7dbd20a6f0c539a45ddff1573cb8946685b5"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"059b7dbd20a6f0c539a45ddff1573cb8946685b5","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/059b7dbd20a6f0c539a45ddff1573cb8946685b5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53132","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53132.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53123","title":"md: wake raid456 reshape waiters before suspend","status":"not-applicable","project":false,"upstream":[{"sha":"cf86bb53b9c92354904a328e947a05ffbfdd1840","url":"https://git.kernel.org/stable/c/cf86bb53b9c92354904a328e947a05ffbfdd1840"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf86bb53b9c92354904a328e947a05ffbfdd1840","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/cf86bb53b9c92354904a328e947a05ffbfdd1840.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53120","title":"PCI: use generic driver_override infrastructure","status":"unfixed","project":false,"upstream":[{"sha":"10a4206a24013be4d558d476010cbf2eb4c9fa64","url":"https://git.kernel.org/stable/c/10a4206a24013be4d558d476010cbf2eb4c9fa64"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"10a4206a24013be4d558d476010cbf2eb4c9fa64","lines":131,"reason":"","source":"https://github.com/torvalds/linux/commit/10a4206a24013be4d558d476010cbf2eb4c9fa64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53120","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53120.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53118","title":"vdpa: use generic driver_override infrastructure","status":"unfixed","project":false,"upstream":[{"sha":"85bb534ff12aab6916058897b39c748940a7a4c6","url":"https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"85bb534ff12aab6916058897b39c748940a7a4c6","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/85bb534ff12aab6916058897b39c748940a7a4c6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53117","title":"s390/cio: use generic driver_override infrastructure","status":"unfixed","project":false,"upstream":[{"sha":"ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4","url":"https://git.kernel.org/stable/c/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53117","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53117.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53115","title":"bus: fsl-mc: use generic driver_override infrastructure","status":"unfixed","project":false,"upstream":[{"sha":"6c8dfb0362732bf1e4829867a2a5239fedc592d0","url":"https://git.kernel.org/stable/c/6c8dfb0362732bf1e4829867a2a5239fedc592d0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6c8dfb0362732bf1e4829867a2a5239fedc592d0","lines":99,"reason":"","source":"https://github.com/torvalds/linux/commit/6c8dfb0362732bf1e4829867a2a5239fedc592d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53113","title":"wifi: ath11k: fix memory leaks in beacon template setup","status":"not-applicable","project":false,"upstream":[{"sha":"ff49eba595df500e4ddccc593088c8a4ab5f2c27","url":"https://git.kernel.org/stable/c/ff49eba595df500e4ddccc593088c8a4ab5f2c27"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"ff49eba595df500e4ddccc593088c8a4ab5f2c27","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53113","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53113.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53107","title":"wifi: libertas: don't kill URBs in interrupt context","status":"unfixed","project":false,"upstream":[{"sha":"7c5c2b661bdb78c1472b8833265c9ed1ee880039","url":"https://git.kernel.org/stable/c/7c5c2b661bdb78c1472b8833265c9ed1ee880039"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c5c2b661bdb78c1472b8833265c9ed1ee880039","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/7c5c2b661bdb78c1472b8833265c9ed1ee880039.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53107","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53107.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53106","title":"bpf: Do not allow deleting local storage in NMI","status":"unfixed","project":false,"upstream":[{"sha":"350de5b8a9befaa2a68861c51f671d4f5f751ca5","url":"https://git.kernel.org/stable/c/350de5b8a9befaa2a68861c51f671d4f5f751ca5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"350de5b8a9befaa2a68861c51f671d4f5f751ca5","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/350de5b8a9befaa2a68861c51f671d4f5f751ca5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53106","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53106.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53102","title":"wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()","status":"queued","project":false,"upstream":[{"sha":"c41075ce8cf05ed8c0e7b7efef000dce548ffc42","url":"https://git.kernel.org/stable/c/c41075ce8cf05ed8c0e7b7efef000dce548ffc42"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/wifi-mt76-fix-memory-leak-after-mt76_connac_mcu_allo.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"c41075ce8cf05ed8c0e7b7efef000dce548ffc42","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53091","title":"net: pull headers in qdisc_pkt_len_segs_init()","status":"unfixed","project":false,"upstream":[{"sha":"7fb4c19670110f052c04e1ec1d2b953b9f4f57e4","url":"https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"7fb4c19670110f052c04e1ec1d2b953b9f4f57e4","lines":118,"reason":"","source":"https://github.com/torvalds/linux/commit/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53091","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53091.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53089","title":"bpf: Fix use-after-free in offloaded map/prog info fill","status":"backported","project":true,"upstream":[{"sha":"a0c584fc18056709c8e047a82a6045d6c209f4ce","url":"https://git.kernel.org/stable/c/a0c584fc18056709c8e047a82a6045d6c209f4ce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fea55b034328feaafef75aee252f305e6f85a991","label":"fea55b034328","date":"2026-09-02T14:28:32+02:00","lore":["https://lore.kernel.org/bpf/f0aa3678-79c9-47ae-9e8c-02a3d1df160a@hust.edu.cn/","https://lore.kernel.org/r/20260409023733.168050-1-jiayuan.chen@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a0c584fc18056709c8e047a82a6045d6c209f4ce","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53078","title":"bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops","status":"backported","project":true,"upstream":[{"sha":"10f86a2a5c91fc4c4d001960f1c21abe52545ef6","url":"https://git.kernel.org/stable/c/10f86a2a5c91fc4c4d001960f1c21abe52545ef6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0e6b30657bbc771f38025c828d722b6162428508","label":"0e6b30657bbc","date":"2026-09-14T13:24:34+02:00","lore":["https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"10f86a2a5c91fc4c4d001960f1c21abe52545ef6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53078","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53078.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53070","title":"sctp: disable BH before calling udp_tunnel_xmit_skb()","status":"queued","project":false,"upstream":[{"sha":"2cd7e6971fc2787408ceef17906ea152791448cf","url":"https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/sctp-disable-bh-before-calling-udp_tunnel_xmit_skb.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The bug depends on 6f1a9140ecda's per-CPU tunnel recursion counter, which is absent from both targets; adding BH disable would not fix an extant target bug.","review":{"id":"CVE-2026-53070","series":"6.1.y","upstream":["2cd7e6971fc2787408ceef17906ea152791448cf"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The bug depends on 6f1a9140ecda's per-CPU tunnel recursion counter, which is absent from both targets; adding BH disable would not fix an extant target bug.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"2cd7e6971fc2787408ceef17906ea152791448cf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53070","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53070.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53024","title":"greybus: raw: fix use-after-free if write is called after disconnect","status":"queued","project":false,"upstream":[{"sha":"84265cbd96b97058ef67e3f8be3933667a000835","url":"https://git.kernel.org/stable/c/84265cbd96b97058ef67e3f8be3933667a000835"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/greybus-raw-fix-use-after-free-if-write-is-called-af.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"84265cbd96b97058ef67e3f8be3933667a000835","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/84265cbd96b97058ef67e3f8be3933667a000835.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53024","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53024.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53015","title":"erofs: unify lcn as u64 for 32-bit platforms","status":"queued","project":false,"upstream":[{"sha":"2d8c7edcb661812249469f4a5b62e9339118846f","url":"https://git.kernel.org/stable/c/2d8c7edcb661812249469f4a5b62e9339118846f"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/erofs-unify-lcn-as-u64-for-32-bit-platforms.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"2d8c7edcb661812249469f4a5b62e9339118846f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53010","title":"ksmbd: fix use-after-free in smb2_open during durable reconnect","status":"not-applicable","project":false,"upstream":[{"sha":"1baff47b81f94f9231c91236aa511420d0e266b9","url":"https://git.kernel.org/stable/c/1baff47b81f94f9231c91236aa511420d0e266b9"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"unknown","patches":[{"sha":"1baff47b81f94f9231c91236aa511420d0e266b9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52994","title":"vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting","status":"not-applicable","project":false,"upstream":[{"sha":"1cb36e252211506f51095fe7ced8286cc77b4c80","url":"https://git.kernel.org/stable/c/1cb36e252211506f51095fe7ced8286cc77b4c80"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"1cb36e252211506f51095fe7ced8286cc77b4c80","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/1cb36e252211506f51095fe7ced8286cc77b4c80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52994","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52994.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52961","title":"ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size","status":"queued","project":false,"upstream":[{"sha":"0c22d9511cbde746622f8e4c11aaa63fe76d45f9","url":"https://git.kernel.org/stable/c/0c22d9511cbde746622f8e4c11aaa63fe76d45f9"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/ceph-fix-bug_on-in-__ceph_build_xattrs_blob-due-to-s.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"0c22d9511cbde746622f8e4c11aaa63fe76d45f9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52960","title":"ceph: put folios not suitable for writeback","status":"not-applicable","project":false,"upstream":[{"sha":"544576f0f05c4a759806acddfaaeb686f14fb4b0","url":"https://git.kernel.org/stable/c/544576f0f05c4a759806acddfaaeb686f14fb4b0"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"544576f0f05c4a759806acddfaaeb686f14fb4b0","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/544576f0f05c4a759806acddfaaeb686f14fb4b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52960","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52960.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52953","title":"iommu/vt-d: Fix oops due to out of scope access","status":"not-applicable","project":false,"upstream":[{"sha":"a6dea58d8625c06b9654c0555f101742481335c3","url":"https://git.kernel.org/stable/c/a6dea58d8625c06b9654c0555f101742481335c3"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6dea58d8625c06b9654c0555f101742481335c3","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a6dea58d8625c06b9654c0555f101742481335c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52953","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52953.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52944","title":"ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE","status":"backported","project":false,"upstream":[{"sha":"cc57232cae23c0df91b4a59d0f519141ce9b5b02","url":"https://git.kernel.org/stable/c/cc57232cae23c0df91b4a59d0f519141ce9b5b02"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3a9a0a1c38ef90788f5d7c4b29903c8b220f744a","label":"3a9a0a1c38ef","date":"2026-09-14T13:24:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"cc57232cae23c0df91b4a59d0f519141ce9b5b02","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46317","title":"KVM: arm64: Reassign nested_mmus array behind mmu_lock","status":"not-applicable","project":false,"upstream":[{"sha":"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8","url":"https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46314","title":"drm/v3d: Reject empty multisync extension to prevent infinite loop","status":"backported","project":false,"upstream":[{"sha":"fb44d589bf3148e13452185a6e772a7efbf2d684","url":"https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684"}],"evidence":[{"url":"https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998","label":"309abbddeca0","date":"2026-06-19T13:37:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb44d589bf3148e13452185a6e772a7efbf2d684","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/fb44d589bf3148e13452185a6e772a7efbf2d684.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46314","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46314.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46282","title":"iio: frequency: admv1013: fix NULL pointer dereference on str","status":"unfixed","project":false,"upstream":[{"sha":"aac0a51b16700b403a55b67ba495de021db78763","url":"https://git.kernel.org/stable/c/aac0a51b16700b403a55b67ba495de021db78763"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aac0a51b16700b403a55b67ba495de021db78763","lines":93,"reason":"","source":"https://github.com/torvalds/linux/commit/aac0a51b16700b403a55b67ba495de021db78763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46282","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46282.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46279","title":"mm/alloc_tag: clear codetag for pages allocated before page_ext initialization","status":"not-applicable","project":false,"upstream":[{"sha":"6b1842775a460245e97d36d3a67d0cfba7c4ff79","url":"https://git.kernel.org/stable/c/6b1842775a460245e97d36d3a67d0cfba7c4ff79"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"6b1842775a460245e97d36d3a67d0cfba7c4ff79","lines":162,"reason":"","source":"https://github.com/torvalds/linux/commit/6b1842775a460245e97d36d3a67d0cfba7c4ff79.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46279","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46279.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46274","title":"io-wq: check that the predecessor is hashed in io_wq_remove_pending()","status":"unfixed","project":false,"upstream":[{"sha":"d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc","url":"https://git.kernel.org/stable/c/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46274","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46274.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46254","title":"AppArmor: Allow apparmor to handle unaligned dfa tables","status":"queued","project":false,"upstream":[{"sha":"64802f731214a51dfe3c6c27636b3ddafd003eb0","url":"https://git.kernel.org/stable/c/64802f731214a51dfe3c6c27636b3ddafd003eb0"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/apparmor-allow-apparmor-to-handle-unaligned-dfa-tabl.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"64802f731214a51dfe3c6c27636b3ddafd003eb0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46254","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46254.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46245","title":"drm/amd/display: Fix dc_link NULL handling in HPD init","status":"unfixed","project":false,"upstream":[{"sha":"226a40c06a183abaeb7529a4f54d6c203bd14407","url":"https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"226a40c06a183abaeb7529a4f54d6c203bd14407","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/226a40c06a183abaeb7529a4f54d6c203bd14407.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46245","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46245.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46157","title":"ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger","status":"queued","project":false,"upstream":[{"sha":"901ac0ff15edf9503162e2cf6579bd11a30f1ed4","url":"https://git.kernel.org/stable/c/901ac0ff15edf9503162e2cf6579bd11a30f1ed4"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/alsa-pcm-oss-fix-data-race-at-accessing-runtime.oss..patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/20260423145330.210035-1-jjy600901@snu.ac.kr"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"901ac0ff15edf9503162e2cf6579bd11a30f1ed4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46157","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46157.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46153","title":"8021q: delete cleared egress QoS mappings","status":"unfixed","project":false,"upstream":[{"sha":"7dddc74af369478ba7f9bc136d0fc1dc4570cb66","url":"https://git.kernel.org/stable/c/7dddc74af369478ba7f9bc136d0fc1dc4570cb66"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7dddc74af369478ba7f9bc136d0fc1dc4570cb66","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7dddc74af369478ba7f9bc136d0fc1dc4570cb66.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46153","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46153.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46147","title":"KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()","status":"unfixed","project":false,"upstream":[{"sha":"73b9c1e5da84cd69b1a86e374e450817cd051371","url":"https://git.kernel.org/stable/c/73b9c1e5da84cd69b1a86e374e450817cd051371"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"73b9c1e5da84cd69b1a86e374e450817cd051371","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/73b9c1e5da84cd69b1a86e374e450817cd051371.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46147","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46147.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46130","title":"dm-verity-fec: fix reading parity bytes split across blocks (take 3)","status":"unfixed","project":false,"upstream":[{"sha":"430a05cb926f6bdf53e81460a2c3a553257f3f61","url":"https://git.kernel.org/stable/c/430a05cb926f6bdf53e81460a2c3a553257f3f61"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"430a05cb926f6bdf53e81460a2c3a553257f3f61","lines":129,"reason":"","source":"https://github.com/torvalds/linux/commit/430a05cb926f6bdf53e81460a2c3a553257f3f61.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46130","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46130.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46096","title":"tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()","status":"not-applicable","project":false,"upstream":[{"sha":"f0f75a3d98b7959a8677b6363e23190f3018636b","url":"https://git.kernel.org/stable/c/f0f75a3d98b7959a8677b6363e23190f3018636b"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0f75a3d98b7959a8677b6363e23190f3018636b","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/f0f75a3d98b7959a8677b6363e23190f3018636b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46096","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46096.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46068","title":"crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx","status":"unfixed","project":false,"upstream":[{"sha":"adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c","url":"https://git.kernel.org/stable/c/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46068","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46068.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46054","title":"selinux: fix overlayfs mmap() and mprotect() access checks","status":"unfixed","project":false,"upstream":[{"sha":"82544d36b1729153c8aeb179e84750f0c085d3b1","url":"https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"82544d36b1729153c8aeb179e84750f0c085d3b1","lines":373,"reason":"","source":"https://github.com/torvalds/linux/commit/82544d36b1729153c8aeb179e84750f0c085d3b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46054","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46054.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46044","title":"ipmi:ssif: Clean up kthread on errors","status":"backported","project":false,"upstream":[{"sha":"75c486cb1bcaa1a3ec3a6438498176a3a4998ae4","url":"https://git.kernel.org/stable/c/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e662be2d0d05253d0fd7deda9771aa036c23393e","label":"e662be2d0d05","date":"2026-06-19T13:37:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75c486cb1bcaa1a3ec3a6438498176a3a4998ae4","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46017","title":"mm: fix deferred split queue races during migration","status":"unfixed","project":false,"upstream":[{"sha":"3bac01168982ec3e3bf87efdc1807c7933590a85","url":"https://git.kernel.org/stable/c/3bac01168982ec3e3bf87efdc1807c7933590a85"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3bac01168982ec3e3bf87efdc1807c7933590a85","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/3bac01168982ec3e3bf87efdc1807c7933590a85.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46014","title":"KVM: SVM: Add missing save/restore handling of LBR MSRs","status":"unfixed","project":false,"upstream":[{"sha":"3700f0788da6acf73b2df56690f4b201aa4aefd2","url":"https://git.kernel.org/stable/c/3700f0788da6acf73b2df56690f4b201aa4aefd2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3700f0788da6acf73b2df56690f4b201aa4aefd2","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/3700f0788da6acf73b2df56690f4b201aa4aefd2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46014","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46014.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45988","title":"rxrpc: Fix re-decryption of RESPONSE packets","status":"unfixed","project":false,"upstream":[{"sha":"0422e7a4883f25101903f3e8105c0808aa5f4ce9","url":"https://git.kernel.org/stable/c/0422e7a4883f25101903f3e8105c0808aa5f4ce9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0422e7a4883f25101903f3e8105c0808aa5f4ce9","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/0422e7a4883f25101903f3e8105c0808aa5f4ce9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45981","title":"s390/cio: Fix device lifecycle handling in css_alloc_subchannel()","status":"unfixed","project":false,"upstream":[{"sha":"f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7","url":"https://git.kernel.org/stable/c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7"}],"evidence":[],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"within-limit","patches":[{"sha":"f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45981","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45981.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45963","title":"ASoC: nau8821: Cancel delayed work on component remove","status":"backported","project":true,"upstream":[{"sha":"dbd3fd05cddfdeec1e49b0a66269881c09eebd17","url":"https://git.kernel.org/stable/c/dbd3fd05cddfdeec1e49b0a66269881c09eebd17"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cd6b991de3e0b68560fe98dc739672747d2e4204","label":"cd6b991de3e0","date":"2026-09-02T14:28:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"dbd3fd05cddfdeec1e49b0a66269881c09eebd17","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45963","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45963.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45901","title":"netfilter: nf_tables: revert commit_mutex usage in reset path","status":"unfixed","project":false,"upstream":[{"sha":"7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc","url":"https://git.kernel.org/stable/c/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc","lines":372,"reason":"","source":"https://github.com/torvalds/linux/commit/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45897","title":"netfilter: nft_counter: serialize reset with spinlock","status":"backported","project":true,"upstream":[{"sha":"779c60a5190c42689534172f4b49e927c9959e4e","url":"https://git.kernel.org/stable/c/779c60a5190c42689534172f4b49e927c9959e4e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e13194e60217db02c2e7202375d9e5951267d87b","label":"e13194e60217","date":"2026-09-14T13:24:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"779c60a5190c42689534172f4b49e927c9959e4e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45897","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45897.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45893","title":"apparmor: Fix & Optimize table creation from possibly unaligned memory","status":"queued","project":false,"upstream":[{"sha":"6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a","url":"https://git.kernel.org/stable/c/6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/apparmor-fix-optimize-table-creation-from-possibly-u.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45893","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45893.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45877","title":"HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients","status":"queued","project":false,"upstream":[{"sha":"56f7db581ee73af53cd512e00a6261a025bf1d58","url":"https://git.kernel.org/stable/c/56f7db581ee73af53cd512e00a6261a025bf1d58"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/hid-intel-ish-hid-fix-null-ptr-deref-in-ishtp_bus_re.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The target loop iterates cl_device and checks cl_device->reference_count; it does not dereference the possibly NULL cl->device fixed upstream.","review":{"id":"CVE-2026-45877","series":"6.1.y","upstream":["56f7db581ee73af53cd512e00a6261a025bf1d58"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The target loop iterates cl_device and checks cl_device->reference_count; it does not dereference the possibly NULL cl->device fixed upstream.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"56f7db581ee73af53cd512e00a6261a025bf1d58","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45877","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45877.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45858","title":"ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1","status":"unfixed","project":false,"upstream":[{"sha":"1bf6974822d1dba86cf11b5f05498581cf3488a2","url":"https://git.kernel.org/stable/c/1bf6974822d1dba86cf11b5f05498581cf3488a2"}],"evidence":[],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"within-limit","patches":[{"sha":"1bf6974822d1dba86cf11b5f05498581cf3488a2","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/1bf6974822d1dba86cf11b5f05498581cf3488a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45858","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45858.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45855","title":"ata: libata-scsi: avoid Non-NCQ command starvation","status":"queued","project":false,"upstream":[{"sha":"0ea84089dbf62a92dc7889c79e6b18fc89260808","url":"https://git.kernel.org/stable/c/0ea84089dbf62a92dc7889c79e6b18fc89260808"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/ata-libata-scsi-avoid-non-ncq-command-starvation.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"0ea84089dbf62a92dc7889c79e6b18fc89260808","lines":165,"reason":"","source":"https://github.com/torvalds/linux/commit/0ea84089dbf62a92dc7889c79e6b18fc89260808.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45855","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45855.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43500","title":"rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present","status":"unfixed","project":false,"upstream":[{"sha":"aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","url":"https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43500","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43500.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43485","title":"nouveau/gsp: drop WARN_ON in ACPI probes","status":"not-applicable","project":false,"upstream":[{"sha":"9478c166c46934160135e197b049b5a05753f2ad","url":"https://git.kernel.org/stable/c/9478c166c46934160135e197b049b5a05753f2ad"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"9478c166c46934160135e197b049b5a05753f2ad","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/9478c166c46934160135e197b049b5a05753f2ad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43485","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43485.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43446","title":"accel/amdxdna: Fix runtime suspend deadlock when there is pending job","status":"not-applicable","project":false,"upstream":[{"sha":"6b13cb8f48a42ddf6dd98865b673a82e37ff238b","url":"https://git.kernel.org/stable/c/6b13cb8f48a42ddf6dd98865b673a82e37ff238b"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6b13cb8f48a42ddf6dd98865b673a82e37ff238b","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/6b13cb8f48a42ddf6dd98865b673a82e37ff238b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43446","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43446.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43416","title":"powerpc, perf: Check that current->mm is alive before getting user callchain","status":"unfixed","project":false,"upstream":[{"sha":"e9bbfb4bfa86c6b5515b868d6982ac60505d7e39","url":"https://git.kernel.org/stable/c/e9bbfb4bfa86c6b5515b868d6982ac60505d7e39"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e9bbfb4bfa86c6b5515b868d6982ac60505d7e39","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/e9bbfb4bfa86c6b5515b868d6982ac60505d7e39.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43416","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43416.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43409","title":"kprobes: avoid crash when rmmod/insmod after ftrace killed","status":"unfixed","project":false,"upstream":[{"sha":"e113f0b46d19626ec15388bcb91432c9a4fd6261","url":"https://git.kernel.org/stable/c/e113f0b46d19626ec15388bcb91432c9a4fd6261"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e113f0b46d19626ec15388bcb91432c9a4fd6261","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/e113f0b46d19626ec15388bcb91432c9a4fd6261.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43409","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43409.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43408","title":"ceph: add a bunch of missing ceph_path_info initializers","status":"not-applicable","project":false,"upstream":[{"sha":"43323a5934b660afae687e8e4e95ac328615a5c4","url":"https://git.kernel.org/stable/c/43323a5934b660afae687e8e4e95ac328615a5c4"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"43323a5934b660afae687e8e4e95ac328615a5c4","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/43323a5934b660afae687e8e4e95ac328615a5c4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43408","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43408.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43391","title":"nsfs: tighten permission checks for handle opening","status":"not-applicable","project":false,"upstream":[{"sha":"d2324a9317f00013facb0ba00b00440e19d2af5e","url":"https://git.kernel.org/stable/c/d2324a9317f00013facb0ba00b00440e19d2af5e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"d2324a9317f00013facb0ba00b00440e19d2af5e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43391","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43391.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43362","title":"smb: client: fix in-place encryption corruption in SMB2_write()","status":"unfixed","project":false,"upstream":[{"sha":"d78840a6a38d312dc1a51a65317bb67e46f0b929","url":"https://git.kernel.org/stable/c/d78840a6a38d312dc1a51a65317bb67e46f0b929"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d78840a6a38d312dc1a51a65317bb67e46f0b929","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/d78840a6a38d312dc1a51a65317bb67e46f0b929.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43362","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43362.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43344","title":"perf/x86/intel/uncore: Fix die ID init and look up bugs","status":"queued","project":false,"upstream":[{"sha":"a16d1ec4dd0cdcf689f324adde6067083bce9099","url":"https://git.kernel.org/stable/c/a16d1ec4dd0cdcf689f324adde6067083bce9099"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/perf-x86-intel-uncore-fix-die-id-init-and-look-up-bu.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"a16d1ec4dd0cdcf689f324adde6067083bce9099","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43344","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43344.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43326","title":"sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback","status":"not-applicable","project":false,"upstream":[{"sha":"415cb193bb9736f0e830286c72a6fa8eb2a9cc5c","url":"https://git.kernel.org/stable/c/415cb193bb9736f0e830286c72a6fa8eb2a9cc5c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"415cb193bb9736f0e830286c72a6fa8eb2a9cc5c","lines":158,"reason":"","source":"https://github.com/torvalds/linux/commit/415cb193bb9736f0e830286c72a6fa8eb2a9cc5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43326","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43326.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43318","title":"drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify","status":"unfixed","project":false,"upstream":[{"sha":"b18fc0ab837381c1a6ef28386602cd888f2d9edf","url":"https://git.kernel.org/stable/c/b18fc0ab837381c1a6ef28386602cd888f2d9edf"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b18fc0ab837381c1a6ef28386602cd888f2d9edf","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/b18fc0ab837381c1a6ef28386602cd888f2d9edf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43318","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43318.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43317","title":"most: core: fix leak on early registration failure","status":"unfixed","project":false,"upstream":[{"sha":"2c198c272f9c9213b0fdf6b4a879f445c574f416","url":"https://git.kernel.org/stable/c/2c198c272f9c9213b0fdf6b4a879f445c574f416"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c198c272f9c9213b0fdf6b4a879f445c574f416","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/2c198c272f9c9213b0fdf6b4a879f445c574f416.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43309","title":"md raid: fix hang when stopping arrays with metadata through dm-raid","status":"unfixed","project":false,"upstream":[{"sha":"cefcb9297fbdb6d94b61787b4f8d84f55b741470","url":"https://git.kernel.org/stable/c/cefcb9297fbdb6d94b61787b4f8d84f55b741470"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cefcb9297fbdb6d94b61787b4f8d84f55b741470","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/cefcb9297fbdb6d94b61787b4f8d84f55b741470.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43309","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43309.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43301","title":"media: chips-media: wave5: Fix PM runtime usage count underflow","status":"not-applicable","project":false,"upstream":[{"sha":"9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38","url":"https://git.kernel.org/stable/c/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43301","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43301.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43299","title":"btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()","status":"queued","project":false,"upstream":[{"sha":"8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3","url":"https://git.kernel.org/stable/c/8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/btrfs-do-not-assert-when-the-fs-flips-ro-inside-btrf.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/linux-btrfs/20260126045555.GB31641@lst.de/"]}],"submission_lore":[],"basis":"repair_io_failure asserts read-only but continues writing","review":{"id":"CVE-2026-43299","series":"6.1.y","upstream":["8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"repair_io_failure asserts read-only but continues writing","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/btrfs/extent_io.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/btrfs/extent_io.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n548"},{"label":"Upstream fix 8ceaad6cd6e7","url":"https://git.kernel.org/stable/c/8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3"}]},"size":{"status":"unknown","patches":[{"sha":"8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43299","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43299.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43288","title":"ext4: move ext4_percpu_param_init() before ext4_mb_init()","status":"backported","project":true,"upstream":[{"sha":"270564513489d98b721a1e4a10017978d5213bff","url":"https://git.kernel.org/stable/c/270564513489d98b721a1e4a10017978d5213bff"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0b3d80c56957862ba477ca0ce30c12cad9179c2b","label":"0b3d80c56957","date":"2026-09-14T13:24:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"270564513489d98b721a1e4a10017978d5213bff","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43234","title":"team: avoid NETDEV_CHANGEMTU event when unregistering slave","status":"queued","project":false,"upstream":[{"sha":"bb4c698633c0e19717586a6524a33196cff01a32","url":"https://git.kernel.org/stable/c/bb4c698633c0e19717586a6524a33196cff01a32"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/team-avoid-netdev_changemtu-event-when-unregistering.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"On NETDEV_UNREGISTER, deleting a team port invokes dev_set_mtu and can emit NETDEV_CHANGEMTU during unregister.","review":{"id":"CVE-2026-43234","series":"6.1.y","upstream":["bb4c698633c0e19717586a6524a33196cff01a32"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"On NETDEV_UNREGISTER, deleting a team port invokes dev_set_mtu and can emit NETDEV_CHANGEMTU during unregister.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/team/team.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/team/team.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n3037"},{"label":"Upstream fix bb4c698633c0","url":"https://git.kernel.org/stable/c/bb4c698633c0e19717586a6524a33196cff01a32"}]},"size":{"status":"unknown","patches":[{"sha":"bb4c698633c0e19717586a6524a33196cff01a32","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43234","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43234.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43188","title":"ceph: do not propagate page array emplacement errors as batch errors","status":"not-applicable","project":false,"upstream":[{"sha":"707104682e3c163f7c14cdd6b07a3e95fb374759","url":"https://git.kernel.org/stable/c/707104682e3c163f7c14cdd6b07a3e95fb374759"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"707104682e3c163f7c14cdd6b07a3e95fb374759","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/707104682e3c163f7c14cdd6b07a3e95fb374759.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43188","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43188.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43174","title":"io_uring/zcrx: fix post open error handling","status":"not-applicable","project":false,"upstream":[{"sha":"5d540e4508950c674d6feef1d95463d039bbf4f5","url":"https://git.kernel.org/stable/c/5d540e4508950c674d6feef1d95463d039bbf4f5"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"5d540e4508950c674d6feef1d95463d039bbf4f5","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/5d540e4508950c674d6feef1d95463d039bbf4f5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43173","title":"net: ethernet: xscale: Check for PTP support properly","status":"unfixed","project":false,"upstream":[{"sha":"594163ea88a03bdb412063af50fc7177ef3cbeae","url":"https://git.kernel.org/stable/c/594163ea88a03bdb412063af50fc7177ef3cbeae"}],"evidence":[],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"within-limit","patches":[{"sha":"594163ea88a03bdb412063af50fc7177ef3cbeae","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/594163ea88a03bdb412063af50fc7177ef3cbeae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43173","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43173.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43172","title":"wifi: iwlwifi: fix 22000 series SMEM parsing","status":"unfixed","project":false,"upstream":[{"sha":"58192b9ce09b0f0f86e2036683bd542130b91a98","url":"https://git.kernel.org/stable/c/58192b9ce09b0f0f86e2036683bd542130b91a98"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"58192b9ce09b0f0f86e2036683bd542130b91a98","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/58192b9ce09b0f0f86e2036683bd542130b91a98.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43172","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43172.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43161","title":"iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode","status":"unfixed","project":false,"upstream":[{"sha":"42662d19839f34735b718129ea200e3734b07e50","url":"https://git.kernel.org/stable/c/42662d19839f34735b718129ea200e3734b07e50"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"42662d19839f34735b718129ea200e3734b07e50","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/42662d19839f34735b718129ea200e3734b07e50.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43137","title":"ASoC: SOF: Intel: hda: Fix NULL pointer dereference","status":"unfixed","project":false,"upstream":[{"sha":"16c589567a956d46a7c1363af3f64de3d420af20","url":"https://git.kernel.org/stable/c/16c589567a956d46a7c1363af3f64de3d420af20"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"16c589567a956d46a7c1363af3f64de3d420af20","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/16c589567a956d46a7c1363af3f64de3d420af20.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43126","title":"ALSA: mixer: oss: Add card disconnect checkpoints","status":"queued","project":false,"upstream":[{"sha":"084d5d44418148662365eced3e126ad1a81ee3e2","url":"https://git.kernel.org/stable/c/084d5d44418148662365eced3e126ad1a81ee3e2"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/alsa-mixer-oss-add-card-disconnect-checkpoints.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"084d5d44418148662365eced3e126ad1a81ee3e2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43126","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43126.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43115","title":"srcu: Use irq_work to start GP in tiny SRCU","status":"unfixed","project":false,"upstream":[{"sha":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","url":"https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43095","title":"ASoC: SDCA: Fix errors in IRQ cleanup","status":"not-applicable","project":false,"upstream":[{"sha":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","url":"https://git.kernel.org/stable/c/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","lines":145,"reason":"","source":"https://github.com/torvalds/linux/commit/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43095","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43095.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43088","title":"net: af_key: zero aligned sockaddr tail in PF_KEY exports","status":"backported","project":true,"upstream":[{"sha":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","url":"https://git.kernel.org/stable/c/426c355742f02cf743b347d9d7dbdc1bfbfa31ef"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e357c3cf8a44d4ec1f49ad6981e4ab9704354347","label":"e357c3cf8a44","date":"2026-09-14T13:24:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43088","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43088.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43073","title":"x86-64: rename misleadingly named '__copy_user_nocache()' function","status":"unfixed","project":false,"upstream":[{"sha":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","url":"https://git.kernel.org/stable/c/d187a86de793f84766ea40b9ade7ac60aabbb4fe"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","lines":84,"reason":"","source":"https://github.com/torvalds/linux/commit/d187a86de793f84766ea40b9ade7ac60aabbb4fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43053","title":"xfs: close crash window in attr dabtree inactivation","status":"unfixed","project":false,"upstream":[{"sha":"b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61","url":"https://git.kernel.org/stable/c/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61","lines":171,"reason":"","source":"https://github.com/torvalds/linux/commit/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43053","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43053.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43045","title":"mshv: Fix error handling in mshv_region_pin","status":"not-applicable","project":false,"upstream":[{"sha":"c0e296f257671ba10249630fe58026f29e4804d9","url":"https://git.kernel.org/stable/c/c0e296f257671ba10249630fe58026f29e4804d9"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"c0e296f257671ba10249630fe58026f29e4804d9","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/c0e296f257671ba10249630fe58026f29e4804d9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43045","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43045.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43042","title":"mpls: add seqcount to protect the platform_label{,s} pair","status":"queued","project":false,"upstream":[{"sha":"629ec78ef8608d955ce217880cdc3e1873af3a15","url":"https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/mpls-add-seqcount-to-protect-the-platform_label-s-pa.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"629ec78ef8608d955ce217880cdc3e1873af3a15","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/629ec78ef8608d955ce217880cdc3e1873af3a15.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43042","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43042.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43029","title":"mptcp: fix soft lockup in mptcp_recvmsg()","status":"not-applicable","project":false,"upstream":[{"sha":"5dd8025a49c268ab6b94d978532af3ad341132a7","url":"https://git.kernel.org/stable/c/5dd8025a49c268ab6b94d978532af3ad341132a7"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5dd8025a49c268ab6b94d978532af3ad341132a7","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/5dd8025a49c268ab6b94d978532af3ad341132a7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43029","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43029.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43009","title":"bpf: Fix incorrect pruning due to atomic fetch precision tracking","status":"queued","project":false,"upstream":[{"sha":"179ee84a89114b854ac2dd1d293633a7f6c8dac1","url":"https://git.kernel.org/stable/c/179ee84a89114b854ac2dd1d293633a7f6c8dac1"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/bpf-fix-incorrect-pruning-due-to-atomic-fetch-precis.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/20260331222020.401848-1-daniel@iogearbox.net"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"179ee84a89114b854ac2dd1d293633a7f6c8dac1","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43009","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43009.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31777","title":"ALSA: ctxfi: Check the error for index mapping","status":"unfixed","project":false,"upstream":[{"sha":"277c6960d4ddb94d16198afd70c92c3d4593d131","url":"https://git.kernel.org/stable/c/277c6960d4ddb94d16198afd70c92c3d4593d131"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"277c6960d4ddb94d16198afd70c92c3d4593d131","lines":162,"reason":"","source":"https://github.com/torvalds/linux/commit/277c6960d4ddb94d16198afd70c92c3d4593d131.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31777","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31777.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31729","title":"usb: typec: ucsi: validate connector number in ucsi_notify_common()","status":"not-applicable","project":false,"upstream":[{"sha":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","url":"https://git.kernel.org/stable/c/d2d8c17ac01a1b1f638ea5d340a884ccc5015186"}],"evidence":[],"submission_lore":[],"basis":"Both targets already validate !num || num > cap.num_connectors inside ucsi_connector_change() before indexing connector[num-1], covering every older backend call site. The later centralized check would be redundant and its ucsi_notify_common() function does not exist in these targets.","review":{"id":"CVE-2026-31729","series":"6.1.y","upstream":["d2d8c17ac01a1b1f638ea5d340a884ccc5015186"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"no-op","applicability":"unaffected","reason":"Both targets already validate !num || num > cap.num_connectors inside ucsi_connector_change() before indexing connector[num-1], covering every older backend call site. The later centralized check would be redundant and its ucsi_notify_common() function does not exist in these targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/d2d8c17ac01a1b1f638ea5d340a884ccc5015186.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31729","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31729.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31710","title":"smb: client: fix dir separator in SMB1 UNIX mounts","status":"not-applicable","project":false,"upstream":[{"sha":"c4d3fc5844d685441befd0caaab648321013cdfd","url":"https://git.kernel.org/stable/c/c4d3fc5844d685441befd0caaab648321013cdfd"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c4d3fc5844d685441befd0caaab648321013cdfd","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/c4d3fc5844d685441befd0caaab648321013cdfd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31710","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31710.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31692","title":"rtnetlink: add missing netlink_ns_capable() check for peer netns","status":"unfixed","project":false,"upstream":[{"sha":"7b735ef81286007794a227ce2539419479c02a5f","url":"https://git.kernel.org/stable/c/7b735ef81286007794a227ce2539419479c02a5f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7b735ef81286007794a227ce2539419479c02a5f","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/7b735ef81286007794a227ce2539419479c02a5f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31692","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31692.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31655","title":"pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled","status":"queued","project":false,"upstream":[{"sha":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","url":"https://git.kernel.org/stable/c/e91d5f94acf68618ea3ad9c92ac28614e791ae7d"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/pmdomain-imx8mp-blk-ctrl-keep-the-noc_hdcp-clock-ena.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"HDCP power_on/off toggles shared NOC_HDCP clock BIT(11)","review":{"id":"CVE-2026-31655","series":"6.1.y","upstream":["e91d5f94acf68618ea3ad9c92ac28614e791ae7d"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"HDCP power_on/off toggles shared NOC_HDCP clock BIT(11)","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/soc/imx/imx8mp-blk-ctrl.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/soc/imx/imx8mp-blk-ctrl.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix e91d5f94acf6","url":"https://git.kernel.org/stable/c/e91d5f94acf68618ea3ad9c92ac28614e791ae7d"}]},"size":{"status":"unknown","patches":[{"sha":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31655","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31655.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31648","title":"mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()","status":"unfixed","project":false,"upstream":[{"sha":"f58df566524ebcdfa394329c64f47e3c9257516e","url":"https://git.kernel.org/stable/c/f58df566524ebcdfa394329c64f47e3c9257516e"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f58df566524ebcdfa394329c64f47e3c9257516e","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/f58df566524ebcdfa394329c64f47e3c9257516e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31648","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31648.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31591","title":"KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish","status":"not-applicable","project":false,"upstream":[{"sha":"cb923ee6a80f4e604e6242a4702b59251e61a380","url":"https://git.kernel.org/stable/c/cb923ee6a80f4e604e6242a4702b59251e61a380"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"cb923ee6a80f4e604e6242a4702b59251e61a380","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/cb923ee6a80f4e604e6242a4702b59251e61a380.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31579","title":"wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit","status":"unfixed","project":false,"upstream":[{"sha":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","url":"https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31579","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31579.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31573","title":"media: verisilicon: Fix kernel panic due to __initconst misuse","status":"queued","project":false,"upstream":[{"sha":"e8d97c270cb46a2a88739019d0f8547adc7d97da","url":"https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/media-verisilicon-fix-kernel-panic-due-to-__initcons.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/","https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/"]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e8d97c270cb46a2a88739019d0f8547adc7d97da","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/e8d97c270cb46a2a88739019d0f8547adc7d97da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31573","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31573.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31537","title":"smb: server: make use of smbdirect_socket.send_io.bcredits","status":"unfixed","project":false,"upstream":[{"sha":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","url":"https://git.kernel.org/stable/c/34abd408c8ba24d7c97bd02ba874d8c714f49db1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/34abd408c8ba24d7c97bd02ba874d8c714f49db1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31537","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31537.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31536","title":"smb: server: let send_done handle a completion without IB_SEND_SIGNALED","status":"unfixed","project":false,"upstream":[{"sha":"9da82dc73cb03e85d716a2609364572367a5ff47","url":"https://git.kernel.org/stable/c/9da82dc73cb03e85d716a2609364572367a5ff47"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9da82dc73cb03e85d716a2609364572367a5ff47","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/9da82dc73cb03e85d716a2609364572367a5ff47.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31536","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31536.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31527","title":"driver core: platform: use generic driver_override infrastructure","status":"unfixed","project":false,"upstream":[{"sha":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","url":"https://git.kernel.org/stable/c/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31527","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31527.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31516","title":"xfrm: prevent policy_hthresh.work from racing with netns teardown","status":"unfixed","project":false,"upstream":[{"sha":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","url":"https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/29fe3a61bcdce398ee3955101c39f89c01a8a77e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31516","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31516.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31502","title":"team: fix header_ops type confusion with non-Ethernet ports","status":"queued","project":false,"upstream":[{"sha":"425000dbf17373a4ab8be9428f5dc055ef870a56","url":"https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/team-fix-header_ops-type-confusion-with-non-ethernet.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/all/69b46af7.050a0220.36eb34.000e.GAE@google.com/T/"]}],"submission_lore":[],"basis":"Renamed team implementation copies non-Ethernet port header_ops into the team device without validating the operation type.","review":{"id":"CVE-2026-31502","series":"6.1.y","upstream":["425000dbf17373a4ab8be9428f5dc055ef870a56"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"Renamed team implementation copies non-Ethernet port header_ops into the team device without validating the operation type.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/team/team.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/team/team.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n2144"},{"label":"Upstream fix 425000dbf173","url":"https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"}]},"size":{"status":"unknown","patches":[{"sha":"425000dbf17373a4ab8be9428f5dc055ef870a56","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31502","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31502.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31499","title":"Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()","status":"backported","project":false,"upstream":[{"sha":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","url":"https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608"}],"evidence":[{"url":"https://git.kernel.org/stable/c/665f7f117375f076667c3ff27e98d0c4c67f7d5f","label":"665f7f117375","date":"2026-07-24T15:55:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/00fdebbbc557a2fc21321ff2eaa22fd70c078608.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31493","title":"RDMA/efa: Fix use of completion ctx after free","status":"unfixed","project":false,"upstream":[{"sha":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","url":"https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","lines":179,"reason":"","source":"https://github.com/torvalds/linux/commit/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31487","title":"spi: use generic driver_override infrastructure","status":"unfixed","project":false,"upstream":[{"sha":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","url":"https://git.kernel.org/stable/c/cc34d77dd48708d810c12bfd6f5bf03304f6c824"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/cc34d77dd48708d810c12bfd6f5bf03304f6c824.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31487","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31487.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31458","title":"mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]","status":"unfixed","project":false,"upstream":[{"sha":"1bfe9fb5ed2667fb075682408b776b5273162615","url":"https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1bfe9fb5ed2667fb075682408b776b5273162615","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/1bfe9fb5ed2667fb075682408b776b5273162615.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31458","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31458.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31435","title":"netfs: Fix read abandonment during retry","status":"not-applicable","project":false,"upstream":[{"sha":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","url":"https://git.kernel.org/stable/c/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31435","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31435.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31420","title":"bridge: mrp: reject zero test interval to avoid OOM panic","status":"backported","project":true,"upstream":[{"sha":"fa6e24963342de4370e3a3c9af41e38277b74cf3","url":"https://git.kernel.org/stable/c/fa6e24963342de4370e3a3c9af41e38277b74cf3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1ec86b4b9e28170a2565cf36f0e6e2b96b55134d","label":"1ec86b4b9e28","date":"2026-09-14T13:24:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fa6e24963342de4370e3a3c9af41e38277b74cf3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31420","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31420.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23459","title":"ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS","status":"not-applicable","project":false,"upstream":[{"sha":"8431c602f551549f082bbfa67f3003f2d8e3e132","url":"https://git.kernel.org/stable/c/8431c602f551549f082bbfa67f3003f2d8e3e132"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"unknown","patches":[{"sha":"8431c602f551549f082bbfa67f3003f2d8e3e132","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23459","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23459.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23448","title":"net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check","status":"backported","project":true,"upstream":[{"sha":"2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a","url":"https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/63c35b8fce77a7892e8fa06c540d4943145506eb","label":"63c35b8fce77","date":"2026-09-14T13:24:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23448","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23448.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23447","title":"net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check","status":"backported","project":true,"upstream":[{"sha":"77914255155e68a20aa41175edeecf8121dac391","url":"https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391"}],"evidence":[{"url":"https://git.kernel.org/stable/c/baf246d6680befde2086b1df9eb3aaba3fb6853f","label":"baf246d6680b","date":"2026-09-14T13:24:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"77914255155e68a20aa41175edeecf8121dac391","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23447","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23447.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23393","title":"bridge: cfm: Fix race condition in peer_mep deletion","status":"unfixed","project":false,"upstream":[{"sha":"3715a00855316066cdda69d43648336367422127","url":"https://git.kernel.org/stable/c/3715a00855316066cdda69d43648336367422127"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3715a00855316066cdda69d43648336367422127","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/3715a00855316066cdda69d43648336367422127.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23393","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23393.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23371","title":"sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting","status":"queued","project":false,"upstream":[{"sha":"d658686a1331db3bb108ca079d76deb3208ed949","url":"https://git.kernel.org/stable/c/d658686a1331db3bb108ca079d76deb3208ed949"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/sched-deadline-fix-missing-enqueue_replenish-during-.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"__sched_setscheduler lacks deadline PI replenish handling","review":{"id":"CVE-2026-23371","series":"6.1.y","upstream":["d658686a1331db3bb108ca079d76deb3208ed949"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"__sched_setscheduler lacks deadline PI replenish handling","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/sched/core.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/sched/core.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n7483"},{"label":"Upstream fix d658686a1331","url":"https://git.kernel.org/stable/c/d658686a1331db3bb108ca079d76deb3208ed949"}]},"size":{"status":"unknown","patches":[{"sha":"d658686a1331db3bb108ca079d76deb3208ed949","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23371","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23371.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23348","title":"cxl: Fix race of nvdimm_bus object when creating nvdimm objects","status":"unfixed","project":false,"upstream":[{"sha":"96a1fd0d84b17360840f344826897fa71049870e","url":"https://git.kernel.org/stable/c/96a1fd0d84b17360840f344826897fa71049870e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"96a1fd0d84b17360840f344826897fa71049870e","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/96a1fd0d84b17360840f344826897fa71049870e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23348","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23348.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23346","title":"arm64: io: Extract user memory type in ioremap_prot()","status":"unfixed","project":false,"upstream":[{"sha":"8f098037139b294050053123ab2bc0f819d08932","url":"https://git.kernel.org/stable/c/8f098037139b294050053123ab2bc0f819d08932"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f098037139b294050053123ab2bc0f819d08932","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8f098037139b294050053123ab2bc0f819d08932.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23346","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23346.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23295","title":"accel/amdxdna: Fix dead lock for suspend and resume","status":"not-applicable","project":false,"upstream":[{"sha":"1aa82181a3c285c7351523d587f7981ae4c015c8","url":"https://git.kernel.org/stable/c/1aa82181a3c285c7351523d587f7981ae4c015c8"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"1aa82181a3c285c7351523d587f7981ae4c015c8","lines":144,"reason":"","source":"https://github.com/torvalds/linux/commit/1aa82181a3c285c7351523d587f7981ae4c015c8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23295","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23295.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23276","title":"net: add xmit recursion limit to tunnel xmit functions","status":"unfixed","project":false,"upstream":[{"sha":"6f1a9140ecda3baba3d945b9a6155af4268aafc4","url":"https://git.kernel.org/stable/c/6f1a9140ecda3baba3d945b9a6155af4268aafc4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"6f1a9140ecda3baba3d945b9a6155af4268aafc4","lines":152,"reason":"","source":"https://github.com/torvalds/linux/commit/6f1a9140ecda3baba3d945b9a6155af4268aafc4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23276","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23276.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23265","title":"f2fs: fix to do sanity check on node footer in {read,write}_end_io","status":"unfixed","project":false,"upstream":[{"sha":"50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4","url":"https://git.kernel.org/stable/c/50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4","lines":107,"reason":"","source":"https://github.com/torvalds/linux/commit/50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23265","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23265.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23240","title":"tls: Fix race condition in tls_sw_cancel_work_tx()","status":"unfixed","project":false,"upstream":[{"sha":"7bb09315f93dce6acc54bf59e5a95ba7365c2be4","url":"https://git.kernel.org/stable/c/7bb09315f93dce6acc54bf59e5a95ba7365c2be4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7bb09315f93dce6acc54bf59e5a95ba7365c2be4","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7bb09315f93dce6acc54bf59e5a95ba7365c2be4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23240","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23240.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23239","title":"espintcp: Fix race condition in espintcp_close()","status":"unfixed","project":false,"upstream":[{"sha":"e1512c1db9e8794d8d130addd2615ec27231d994","url":"https://git.kernel.org/stable/c/e1512c1db9e8794d8d130addd2615ec27231d994"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e1512c1db9e8794d8d130addd2615ec27231d994","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/e1512c1db9e8794d8d130addd2615ec27231d994.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23239","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23239.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23152","title":"wifi: mac80211: correctly decode TTLM with default link map","status":"not-applicable","project":false,"upstream":[{"sha":"1eab33aa63c993685dd341e03bd5b267dd7403fa","url":"https://git.kernel.org/stable/c/1eab33aa63c993685dd341e03bd5b267dd7403fa"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"1eab33aa63c993685dd341e03bd5b267dd7403fa","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/1eab33aa63c993685dd341e03bd5b267dd7403fa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23152","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23152.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23137","title":"of: unittest: Fix memory leak in unittest_data_add()","status":"queued","project":false,"upstream":[{"sha":"235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b","url":"https://git.kernel.org/stable/c/235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/of-unittest-fix-memory-leak-in-unittest_data_add.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23102","title":"arm64/fpsimd: signal: Fix restoration of SVE context","status":"backported","project":false,"upstream":[{"sha":"d2907cbe9ea0a54cbe078076f9d089240ee1e2d9","url":"https://git.kernel.org/stable/c/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9bc3adba8c35119be80ab20217027720446742f2","label":"9bc3adba8c35","date":"2026-02-06T16:44:20+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2907cbe9ea0a54cbe078076f9d089240ee1e2d9","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23088","title":"tracing: Fix crash on synthetic stacktrace field usage","status":"unfixed","project":false,"upstream":[{"sha":"90f9f5d64cae4e72defd96a2a22760173cb3c9ec","url":"https://git.kernel.org/stable/c/90f9f5d64cae4e72defd96a2a22760173cb3c9ec"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"90f9f5d64cae4e72defd96a2a22760173cb3c9ec","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/90f9f5d64cae4e72defd96a2a22760173cb3c9ec.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23088","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23088.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23035","title":"net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv","status":"unfixed","project":false,"upstream":[{"sha":"4ef8512e1427111f7ba92b4a847d181ff0aeec42","url":"https://git.kernel.org/stable/c/4ef8512e1427111f7ba92b4a847d181ff0aeec42"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4ef8512e1427111f7ba92b4a847d181ff0aeec42","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/4ef8512e1427111f7ba92b4a847d181ff0aeec42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23035","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23035.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23007","title":"block: zero non-PI portion of auto integrity buffer","status":"not-applicable","project":false,"upstream":[{"sha":"ca22c566b89164f6e670af56ecc45f47ef3df819","url":"https://git.kernel.org/stable/c/ca22c566b89164f6e670af56ecc45f47ef3df819"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"ca22c566b89164f6e670af56ecc45f47ef3df819","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/ca22c566b89164f6e670af56ecc45f47ef3df819.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23007","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23007.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23000","title":"net/mlx5e: Fix crash on profile change rollback failure","status":"unfixed","project":false,"upstream":[{"sha":"4dadc4077e3f77d6d31e199a925fc7a705e7adeb","url":"https://git.kernel.org/stable/c/4dadc4077e3f77d6d31e199a925fc7a705e7adeb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"4dadc4077e3f77d6d31e199a925fc7a705e7adeb","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/4dadc4077e3f77d6d31e199a925fc7a705e7adeb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23000","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23000.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-22996","title":"net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv","status":"unfixed","project":false,"upstream":[{"sha":"123eda2e5b1638e298e3a66bb1e64a8da92de5e1","url":"https://git.kernel.org/stable/c/123eda2e5b1638e298e3a66bb1e64a8da92de5e1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"123eda2e5b1638e298e3a66bb1e64a8da92de5e1","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/123eda2e5b1638e298e3a66bb1e64a8da92de5e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-22996","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-22996.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71315","title":"drm/vkms: Convert to DRM's vblank timer","status":"unfixed","project":false,"upstream":[{"sha":"02e2681ffe1addde1fc8c35d05657b16bfa79613","url":"https://git.kernel.org/stable/c/02e2681ffe1addde1fc8c35d05657b16bfa79613"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"02e2681ffe1addde1fc8c35d05657b16bfa79613","lines":130,"reason":"","source":"https://github.com/torvalds/linux/commit/02e2681ffe1addde1fc8c35d05657b16bfa79613.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71302","title":"drm/panthor: fix for dma-fence safe access rules","status":"not-applicable","project":false,"upstream":[{"sha":"efe24898485c5c831e629d9c6fb9350c35cb576f","url":"https://git.kernel.org/stable/c/efe24898485c5c831e629d9c6fb9350c35cb576f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"efe24898485c5c831e629d9c6fb9350c35cb576f","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/efe24898485c5c831e629d9c6fb9350c35cb576f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71302","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71302.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71272","title":"most: core: fix resource leak in most_register_interface error paths","status":"unfixed","project":false,"upstream":[{"sha":"1f4c9d8a1021281750c6cda126d6f8a40cc24e71","url":"https://git.kernel.org/stable/c/1f4c9d8a1021281750c6cda126d6f8a40cc24e71"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1f4c9d8a1021281750c6cda126d6f8a40cc24e71","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/1f4c9d8a1021281750c6cda126d6f8a40cc24e71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71272","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71272.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71225","title":"md: suspend array while updating raid_disks via sysfs","status":"unfixed","project":false,"upstream":[{"sha":"2cc583653bbe050bacd1cadcc9776d39bf449740","url":"https://git.kernel.org/stable/c/2cc583653bbe050bacd1cadcc9776d39bf449740"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2cc583653bbe050bacd1cadcc9776d39bf449740","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/2cc583653bbe050bacd1cadcc9776d39bf449740.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71225","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71225.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71202","title":"iommu/sva: invalidate stale IOTLB entries for kernel address space","status":"unfixed","project":false,"upstream":[{"sha":"e37d5a2d60a338c5917c45296bac65da1382eda5","url":"https://git.kernel.org/stable/c/e37d5a2d60a338c5917c45296bac65da1382eda5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"e37d5a2d60a338c5917c45296bac65da1382eda5","lines":110,"reason":"","source":"https://github.com/torvalds/linux/commit/e37d5a2d60a338c5917c45296bac65da1382eda5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71202","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71202.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71160","title":"netfilter: nf_tables: avoid chain re-validation if possible","status":"unfixed","project":false,"upstream":[{"sha":"8e1a1bc4f5a42747c08130b8242ebebd1210b32f","url":"https://git.kernel.org/stable/c/8e1a1bc4f5a42747c08130b8242ebebd1210b32f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8e1a1bc4f5a42747c08130b8242ebebd1210b32f","lines":177,"reason":"","source":"https://github.com/torvalds/linux/commit/8e1a1bc4f5a42747c08130b8242ebebd1210b32f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71160","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71160.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71129","title":"LoongArch: BPF: Sign extend kfunc call arguments","status":"unfixed","project":false,"upstream":[{"sha":"3f5a238f24d7b75f9efe324d3539ad388f58536e","url":"https://git.kernel.org/stable/c/3f5a238f24d7b75f9efe324d3539ad388f58536e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f5a238f24d7b75f9efe324d3539ad388f58536e","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/3f5a238f24d7b75f9efe324d3539ad388f58536e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71117","title":"block: Remove queue freezing from several sysfs store callbacks","status":"not-applicable","project":false,"upstream":[{"sha":"935a20d1bebf6236076785fac3ff81e3931834e9","url":"https://git.kernel.org/stable/c/935a20d1bebf6236076785fac3ff81e3931834e9"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"935a20d1bebf6236076785fac3ff81e3931834e9","lines":113,"reason":"","source":"https://github.com/torvalds/linux/commit/935a20d1bebf6236076785fac3ff81e3931834e9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71117","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71117.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71065","title":"f2fs: fix to avoid potential deadlock","status":"unfixed","project":false,"upstream":[{"sha":"ca8b201f28547e28343a6f00a6e91fa8c09572fe","url":"https://git.kernel.org/stable/c/ca8b201f28547e28343a6f00a6e91fa8c09572fe"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ca8b201f28547e28343a6f00a6e91fa8c09572fe","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/ca8b201f28547e28343a6f00a6e91fa8c09572fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71065","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71065.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68781","title":"usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal","status":"unfixed","project":false,"upstream":[{"sha":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","url":"https://git.kernel.org/stable/c/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f"}],"evidence":[],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"within-limit","patches":[{"sha":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68781","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68781.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68768","title":"inet: frags: flush pending skbs in fqdir_pre_exit()","status":"unfixed","project":false,"upstream":[{"sha":"006a5035b495dec008805df249f92c22c89c3d2e","url":"https://git.kernel.org/stable/c/006a5035b495dec008805df249f92c22c89c3d2e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"006a5035b495dec008805df249f92c22c89c3d2e","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/006a5035b495dec008805df249f92c22c89c3d2e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68751","title":"s390/fpu: Fix false-positive kmsan report in fpu_vstl()","status":"not-applicable","project":false,"upstream":[{"sha":"14e4e4175b64dd9216b522f6ece8af6997d063b2","url":"https://git.kernel.org/stable/c/14e4e4175b64dd9216b522f6ece8af6997d063b2"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"14e4e4175b64dd9216b522f6ece8af6997d063b2","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/14e4e4175b64dd9216b522f6ece8af6997d063b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68751","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68751.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68338","title":"net: dsa: microchip: Don't free uninitialized ksz_irq","status":"not-applicable","project":false,"upstream":[{"sha":"25b62cc5b22c45face094ae3e8717258e46d1d19","url":"https://git.kernel.org/stable/c/25b62cc5b22c45face094ae3e8717258e46d1d19"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"25b62cc5b22c45face094ae3e8717258e46d1d19","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/25b62cc5b22c45face094ae3e8717258e46d1d19.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68338","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68338.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68334","title":"platform/x86/amd/pmc: Add support for Van Gogh SoC","status":"unfixed","project":false,"upstream":[{"sha":"db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb","url":"https://git.kernel.org/stable/c/db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb"}],"evidence":[],"submission_lore":[],"basis":"PMC PCI IDs and OS hint lack Van Gogh 0x1645; platform cannot suspend and reported GPU resume hang remains","review":{"id":"CVE-2025-68334","series":"6.1.y","upstream":["db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"PMC PCI IDs and OS hint lack Van Gogh 0x1645; platform cannot suspend and reported GPU resume hang remains","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/platform/x86/amd/pmc.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/amd/pmc.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix db4a3f0fbedb","url":"https://git.kernel.org/stable/c/db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb"}]},"size":{"status":"within-limit","patches":[{"sha":"db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68322","title":"parisc: Avoid crash due to unaligned access in unwinder","status":"unfixed","project":false,"upstream":[{"sha":"fd9f30d1038ee1624baa17a6ff11effe5f7617cb","url":"https://git.kernel.org/stable/c/fd9f30d1038ee1624baa17a6ff11effe5f7617cb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":{"id":"CVE-2025-68322","series":"6.1.y","upstream":["fd9f30d1038ee1624baa17a6ff11effe5f7617cb"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"needs-review","applicability":"unknown","reason":"Upstream adds alignment checks around unwinder frame reads introduced by the newer unwinder path. Do not backport: the upstream commit explicitly carries Cc: stable # v6.12+, and the relevant target control-flow/layout does not match the v6.12+ faulting path. Treating CNA range alone as proof would override explicit maintainer scoping; fragments on these older unwinders would not establish that the reported bug is fixed and risk a semantic no-op.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"fd9f30d1038ee1624baa17a6ff11effe5f7617cb","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/fd9f30d1038ee1624baa17a6ff11effe5f7617cb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68322","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68322.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68313","title":"x86/CPU/AMD: Add RDSEED fix for Zen5","status":"not-applicable","project":false,"upstream":[{"sha":"607b9fb2ce248cc5b633c5949e0153838992c152","url":"https://git.kernel.org/stable/c/607b9fb2ce248cc5b633c5949e0153838992c152"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"607b9fb2ce248cc5b633c5949e0153838992c152","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/607b9fb2ce248cc5b633c5949e0153838992c152.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68304","title":"Bluetooth: hci_core: lookup hci_conn on RX path on protocol side","status":"unfixed","project":false,"upstream":[{"sha":"79a2d4678ba90bdba577dc3af88cc900d6dcd5ee","url":"https://git.kernel.org/stable/c/79a2d4678ba90bdba577dc3af88cc900d6dcd5ee"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"79a2d4678ba90bdba577dc3af88cc900d6dcd5ee","lines":327,"reason":"","source":"https://github.com/torvalds/linux/commit/79a2d4678ba90bdba577dc3af88cc900d6dcd5ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68304","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68304.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68296","title":"drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup","status":"unfixed","project":false,"upstream":[{"sha":"eb76d0f5553575599561010f24c277cc5b31d003","url":"https://git.kernel.org/stable/c/eb76d0f5553575599561010f24c277cc5b31d003"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb76d0f5553575599561010f24c277cc5b31d003","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/eb76d0f5553575599561010f24c277cc5b31d003.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68296","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68296.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68251","title":"erofs: avoid infinite loops due to corrupted subpage compact indexes","status":"not-applicable","project":false,"upstream":[{"sha":"e13d315ae077bb7c3c6027cc292401bc0f4ec683","url":"https://git.kernel.org/stable/c/e13d315ae077bb7c3c6027cc292401bc0f4ec683"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"unknown","patches":[{"sha":"e13d315ae077bb7c3c6027cc292401bc0f4ec683","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68251","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68251.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68174","title":"amd/amdkfd: enhance kfd process check in switch partition","status":"not-applicable","project":false,"upstream":[{"sha":"45da20e00d5da842e17dfc633072b127504f0d0e","url":"https://git.kernel.org/stable/c/45da20e00d5da842e17dfc633072b127504f0d0e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"45da20e00d5da842e17dfc633072b127504f0d0e","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/45da20e00d5da842e17dfc633072b127504f0d0e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40355","title":"sysfs: check visibility before changing group attribute ownership","status":"unfixed","project":false,"upstream":[{"sha":"c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33","url":"https://git.kernel.org/stable/c/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40354","title":"drm/amd/display: increase max link count and fix link->enc NULL pointer access","status":"not-applicable","project":false,"upstream":[{"sha":"bec947cbe9a65783adb475a5fb47980d7b4f4796","url":"https://git.kernel.org/stable/c/bec947cbe9a65783adb475a5fb47980d7b4f4796"}],"evidence":[],"submission_lore":[],"basis":"The targets lack DCN401 and the 14-link MAX_LINKS configuration changed upstream; neither the overflow configuration nor the dcn401 NULL link encoder path exists.","review":{"id":"CVE-2025-40354","series":"6.1.y","upstream":["bec947cbe9a65783adb475a5fb47980d7b4f4796"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The targets lack DCN401 and the 14-link MAX_LINKS configuration changed upstream; neither the overflow configuration nor the dcn401 NULL link encoder path exists.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"bec947cbe9a65783adb475a5fb47980d7b4f4796","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/bec947cbe9a65783adb475a5fb47980d7b4f4796.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40354","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40354.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40339","title":"drm/amdgpu: fix nullptr err of vm_handle_moved","status":"not-applicable","project":false,"upstream":[{"sha":"859958a7faefe5b7742b7b8cdbc170713d4bf158","url":"https://git.kernel.org/stable/c/859958a7faefe5b7742b7b8cdbc170713d4bf158"}],"evidence":[],"submission_lore":[],"basis":"Neither target restore_process_bos() calls amdgpu_vm_handle_moved(); the later NULL-BO PRT dereference path fixed upstream is absent.","review":{"id":"CVE-2025-40339","series":"6.1.y","upstream":["859958a7faefe5b7742b7b8cdbc170713d4bf158"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"Neither target restore_process_bos() calls amdgpu_vm_handle_moved(); the later NULL-BO PRT dereference path fixed upstream is absent.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"859958a7faefe5b7742b7b8cdbc170713d4bf158","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/859958a7faefe5b7742b7b8cdbc170713d4bf158.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40339","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40339.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40333","title":"f2fs: fix infinite loop in __insert_extent_tree()","status":"unfixed","project":false,"upstream":[{"sha":"23361bd54966b437e1ed3eb1a704572f4b279e58","url":"https://git.kernel.org/stable/c/23361bd54966b437e1ed3eb1a704572f4b279e58"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"23361bd54966b437e1ed3eb1a704572f4b279e58","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/23361bd54966b437e1ed3eb1a704572f4b279e58.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40311","title":"accel/habanalabs: support mapping cb with vmalloc-backed coherent memory","status":"queued","project":false,"upstream":[{"sha":"513024d5a0e34fd34247043f1876b6138ca52847","url":"https://git.kernel.org/stable/c/513024d5a0e34fd34247043f1876b6138ca52847"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"Gaudi mmap invokes dma_mmap_coherent without VM_MIXEDMAP","review":{"id":"CVE-2025-40311","series":"6.1.y","upstream":["513024d5a0e34fd34247043f1876b6138ca52847"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"Gaudi mmap invokes dma_mmap_coherent without VM_MIXEDMAP","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/misc/habanalabs/gaudi/gaudi.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/misc/habanalabs/gaudi/gaudi.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 513024d5a0e3","url":"https://git.kernel.org/stable/c/513024d5a0e34fd34247043f1876b6138ca52847"}]},"size":{"status":"unknown","patches":[{"sha":"513024d5a0e34fd34247043f1876b6138ca52847","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40311","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40311.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40303","title":"btrfs: ensure no dirty metadata is written back for an fs with errors","status":"unfixed","project":false,"upstream":[{"sha":"2618849f31e7cf51fadd4a5242458501a6d5b315","url":"https://git.kernel.org/stable/c/2618849f31e7cf51fadd4a5242458501a6d5b315"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2618849f31e7cf51fadd4a5242458501a6d5b315","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/2618849f31e7cf51fadd4a5242458501a6d5b315.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40303","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40303.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40266","title":"KVM: arm64: Check the untrusted offset in FF-A memory share","status":"not-applicable","project":false,"upstream":[{"sha":"103e17aac09cdd358133f9e00998b75d6c1f1518","url":"https://git.kernel.org/stable/c/103e17aac09cdd358133f9e00998b75d6c1f1518"}],"evidence":[],"submission_lore":[],"basis":"NVHE target lacks ffa.c and __do_ffa_mem_xfer implementation","review":{"id":"CVE-2025-40266","series":"6.1.y","upstream":["103e17aac09cdd358133f9e00998b75d6c1f1518"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"NVHE target lacks ffa.c and __do_ffa_mem_xfer implementation","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: arch/arm64/kvm/hyp/nvhe/mem_protect.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/arm64/kvm/hyp/nvhe/mem_protect.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 103e17aac09c","url":"https://git.kernel.org/stable/c/103e17aac09cdd358133f9e00998b75d6c1f1518"}]},"size":{"status":"within-limit","patches":[{"sha":"103e17aac09cdd358133f9e00998b75d6c1f1518","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/103e17aac09cdd358133f9e00998b75d6c1f1518.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40266","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40266.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40247","title":"drm/msm: Fix pgtable prealloc error path","status":"unfixed","project":false,"upstream":[{"sha":"830d68f2cb8ab6fb798bb9555016709a9e012af0","url":"https://git.kernel.org/stable/c/830d68f2cb8ab6fb798bb9555016709a9e012af0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"830d68f2cb8ab6fb798bb9555016709a9e012af0","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/830d68f2cb8ab6fb798bb9555016709a9e012af0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40247","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40247.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40217","title":"pidfs: validate extensible ioctls","status":"not-applicable","project":false,"upstream":[{"sha":"3c17001b21b9f168c957ced9384abe969019b609","url":"https://git.kernel.org/stable/c/3c17001b21b9f168c957ced9384abe969019b609"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"3c17001b21b9f168c957ced9384abe969019b609","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/3c17001b21b9f168c957ced9384abe969019b609.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40168","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().","status":"backported","project":true,"upstream":[{"sha":"235f81045c008169cc4e1955b4a64e118eebe61b","url":"https://git.kernel.org/stable/c/235f81045c008169cc4e1955b4a64e118eebe61b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3f119c37aa293af41400cccb3d89fab8dcf774b0","label":"3f119c37aa29","date":"2026-09-02T14:28:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"235f81045c008169cc4e1955b4a64e118eebe61b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40168","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40168.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40146","title":"blk-mq: fix potential deadlock while nr_requests grown","status":"unfixed","project":false,"upstream":[{"sha":"b86433721f46d934940528f28d49c1dedb690df1","url":"https://git.kernel.org/stable/c/b86433721f46d934940528f28d49c1dedb690df1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"b86433721f46d934940528f28d49c1dedb690df1","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/b86433721f46d934940528f28d49c1dedb690df1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40146","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40146.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40139","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().","status":"backported","project":true,"upstream":[{"sha":"935d783e5de9b64587f3adb25641dd8385e64ddb","url":"https://git.kernel.org/stable/c/935d783e5de9b64587f3adb25641dd8385e64ddb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5a2fccc4b32c13ddde3676f9e15e1a9baa7d6fde","label":"5a2fccc4b32c","date":"2026-09-02T14:28:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"935d783e5de9b64587f3adb25641dd8385e64ddb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40139","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40139.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40102","title":"KVM: arm64: Prevent access to vCPU events before init","status":"backported","project":true,"upstream":[{"sha":"0aa1b76fe1429629215a7c79820e4b96233ac4a3","url":"https://git.kernel.org/stable/c/0aa1b76fe1429629215a7c79820e4b96233ac4a3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b498f0da45a388b40195f7198455c62fe366a372","label":"b498f0da45a3","date":"2026-09-02T14:28:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0aa1b76fe1429629215a7c79820e4b96233ac4a3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40079","title":"riscv, bpf: Sign extend struct ops return values properly","status":"not-applicable","project":false,"upstream":[{"sha":"fd2e08128944a7679e753f920e9eda72057e427c","url":"https://git.kernel.org/stable/c/fd2e08128944a7679e753f920e9eda72057e427c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd2e08128944a7679e753f920e9eda72057e427c","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/fd2e08128944a7679e753f920e9eda72057e427c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40064","title":"smc: Fix use-after-free in __pnet_find_base_ndev().","status":"backported","project":true,"upstream":[{"sha":"3d3466878afd8d43ec0ca2facfbc7f03e40d0f79","url":"https://git.kernel.org/stable/c/3d3466878afd8d43ec0ca2facfbc7f03e40d0f79"}],"evidence":[{"url":"https://git.kernel.org/stable/c/005a7173d8e4710646043a681af36f79ce05a29b","label":"005a7173d8e4","date":"2026-09-02T14:28:32+02:00","lore":["https://lore.kernel.org/netdev/68c237c7.050a0220.3c6139.0036.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3d3466878afd8d43ec0ca2facfbc7f03e40d0f79","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40064","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40064.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40025","title":"f2fs: fix to do sanity check on node footer for non inode dnode","status":"unfixed","project":false,"upstream":[{"sha":"c18ecd99e0c707ef8f83cace861cbc3162f4fdf1","url":"https://git.kernel.org/stable/c/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c18ecd99e0c707ef8f83cace861cbc3162f4fdf1","lines":144,"reason":"","source":"https://github.com/torvalds/linux/commit/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40025","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40025.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40000","title":"wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()","status":"not-applicable","project":false,"upstream":[{"sha":"3e31a6bc07312b448fad3b45de578471f86f0e77","url":"https://git.kernel.org/stable/c/3e31a6bc07312b448fad3b45de578471f86f0e77"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"3e31a6bc07312b448fad3b45de578471f86f0e77","lines":172,"reason":"","source":"https://github.com/torvalds/linux/commit/3e31a6bc07312b448fad3b45de578471f86f0e77.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40000","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40000.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39990","title":"bpf: Check the helper function is valid in get_helper_proto","status":"unfixed","project":false,"upstream":[{"sha":"e4414b01c1cd9887bbde92f946c1ba94e40d6d64","url":"https://git.kernel.org/stable/c/e4414b01c1cd9887bbde92f946c1ba94e40d6d64"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e4414b01c1cd9887bbde92f946c1ba94e40d6d64","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/e4414b01c1cd9887bbde92f946c1ba94e40d6d64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39981","title":"Bluetooth: MGMT: Fix possible UAFs","status":"unfixed","project":false,"upstream":[{"sha":"302a1f674c00dd5581ab8e493ef44767c5101aab","url":"https://git.kernel.org/stable/c/302a1f674c00dd5581ab8e493ef44767c5101aab"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"302a1f674c00dd5581ab8e493ef44767c5101aab","lines":615,"reason":"","source":"https://github.com/torvalds/linux/commit/302a1f674c00dd5581ab8e493ef44767c5101aab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39981","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39981.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39961","title":"iommu/amd/pgtbl: Fix possible race while increase page table level","status":"unfixed","project":false,"upstream":[{"sha":"1e56310b40fd2e7e0b9493da9ff488af145bdd0c","url":"https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1e56310b40fd2e7e0b9493da9ff488af145bdd0c","lines":76,"reason":"","source":"https://github.com/torvalds/linux/commit/1e56310b40fd2e7e0b9493da9ff488af145bdd0c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39947","title":"net/mlx5e: Harden uplink netdev access against device unbind","status":"unfixed","project":false,"upstream":[{"sha":"6b4be64fd9fec16418f365c2d8e47a7566e9eba5","url":"https://git.kernel.org/stable/c/6b4be64fd9fec16418f365c2d8e47a7566e9eba5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6b4be64fd9fec16418f365c2d8e47a7566e9eba5","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/6b4be64fd9fec16418f365c2d8e47a7566e9eba5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39940","title":"dm-stripe: fix a possible integer overflow","status":"unfixed","project":false,"upstream":[{"sha":"1071d560afb4c245c2076494226df47db5a35708","url":"https://git.kernel.org/stable/c/1071d560afb4c245c2076494226df47db5a35708"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1071d560afb4c245c2076494226df47db5a35708","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/1071d560afb4c245c2076494226df47db5a35708.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39940","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39940.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39932","title":"smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)","status":"queued","project":false,"upstream":[{"sha":"d9dcbbcf9145b68aa85c40947311a6907277e097","url":"https://git.kernel.org/stable/c/d9dcbbcf9145b68aa85c40947311a6907277e097"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/smb-client-let-smbd_destroy-call-disable_work_sync-i.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d9dcbbcf9145b68aa85c40947311a6907277e097","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d9dcbbcf9145b68aa85c40947311a6907277e097.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39927","title":"ceph: fix race condition validating r_parent before applying state","status":"unfixed","project":false,"upstream":[{"sha":"15f519e9f883b316d86e2bb6b767a023aafd9d83","url":"https://git.kernel.org/stable/c/15f519e9f883b316d86e2bb6b767a023aafd9d83"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"15f519e9f883b316d86e2bb6b767a023aafd9d83","lines":556,"reason":"","source":"https://github.com/torvalds/linux/commit/15f519e9f883b316d86e2bb6b767a023aafd9d83.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39927","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39927.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39925","title":"can: j1939: implement NETDEV_UNREGISTER notification handler","status":"backported","project":true,"upstream":[{"sha":"7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a","url":"https://git.kernel.org/stable/c/7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2c88069fac2c792e228e6a4ae71c9b9b5b9a87a6","label":"2c88069fac2c","date":"2026-09-02T14:28:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39925","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39925.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39862","title":"wifi: mt76: mt7915: fix list corruption after hardware restart","status":"unfixed","project":false,"upstream":[{"sha":"065c79df595af21d6d1b27d642860faa1d938774","url":"https://git.kernel.org/stable/c/065c79df595af21d6d1b27d642860faa1d938774"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"065c79df595af21d6d1b27d642860faa1d938774","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/065c79df595af21d6d1b27d642860faa1d938774.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39834","title":"net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow","status":"not-applicable","project":false,"upstream":[{"sha":"a630f83592cdad1253523a1b760cfe78fef6cd9c","url":"https://git.kernel.org/stable/c/a630f83592cdad1253523a1b760cfe78fef6cd9c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"a630f83592cdad1253523a1b760cfe78fef6cd9c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/a630f83592cdad1253523a1b760cfe78fef6cd9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39833","title":"mISDN: hfcpci: Fix warning when deleting uninitialized timer","status":"backported","project":true,"upstream":[{"sha":"97766512a9951b9fd6fc97f1b93211642bb0b220","url":"https://git.kernel.org/stable/c/97766512a9951b9fd6fc97f1b93211642bb0b220"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d8be1288e398ccda2dc590fdaa0551f192f6a1c6","label":"d8be1288e398","date":"2026-09-02T14:28:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"97766512a9951b9fd6fc97f1b93211642bb0b220","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39833","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39833.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39830","title":"net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path","status":"not-applicable","project":false,"upstream":[{"sha":"2c0a959bebdc1ada13cf9a8242f177c5400299e6","url":"https://git.kernel.org/stable/c/2c0a959bebdc1ada13cf9a8242f177c5400299e6"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c0a959bebdc1ada13cf9a8242f177c5400299e6","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/2c0a959bebdc1ada13cf9a8242f177c5400299e6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39830","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39830.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39822","title":"io_uring/kbuf: fix signedness in this_len calculation","status":"not-applicable","project":false,"upstream":[{"sha":"c64eff368ac676e8540344d27a3de47e0ad90d21","url":"https://git.kernel.org/stable/c/c64eff368ac676e8540344d27a3de47e0ad90d21"},{"sha":"c4dbca5be33c6203d2f611dbd7502f887e4cd954","url":"https://git.kernel.org/stable/c/c4dbca5be33c6203d2f611dbd7502f887e4cd954"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"c64eff368ac676e8540344d27a3de47e0ad90d21","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/c64eff368ac676e8540344d27a3de47e0ad90d21.patch"},{"sha":"c4dbca5be33c6203d2f611dbd7502f887e4cd954","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/c4dbca5be33c6203d2f611dbd7502f887e4cd954.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39822","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39822.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39789","title":"crypto: x86/aegis - Add missing error checks","status":"unfixed","project":false,"upstream":[{"sha":"3d9eb180fbe8828cce43bce4c370124685b205c3","url":"https://git.kernel.org/stable/c/3d9eb180fbe8828cce43bce4c370124685b205c3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3d9eb180fbe8828cce43bce4c370124685b205c3","lines":97,"reason":"","source":"https://github.com/torvalds/linux/commit/3d9eb180fbe8828cce43bce4c370124685b205c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39789","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39789.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39779","title":"btrfs: subpage: keep TOWRITE tag until folio is cleaned","status":"not-applicable","project":false,"upstream":[{"sha":"b1511360c8ac882b0c52caa263620538e8d73220","url":"https://git.kernel.org/stable/c/b1511360c8ac882b0c52caa263620538e8d73220"}],"evidence":[],"submission_lore":[],"basis":"The upstream stable qualifier is 6.12+ and the affected subpage writeback implementation is not present in these forms on 6.1/6.6; do not transplant the folio-tag logic.","review":{"id":"CVE-2025-39779","series":"6.1.y","upstream":["b1511360c8ac882b0c52caa263620538e8d73220"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The upstream stable qualifier is 6.12+ and the affected subpage writeback implementation is not present in these forms on 6.1/6.6; do not transplant the folio-tag logic.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"b1511360c8ac882b0c52caa263620538e8d73220","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/b1511360c8ac882b0c52caa263620538e8d73220.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39779","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39779.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39775","title":"mm/mremap: fix WARN with uffd that has remap events disabled","status":"not-applicable","project":false,"upstream":[{"sha":"772e5b4a5e8360743645b9a466842d16092c4f94","url":"https://git.kernel.org/stable/c/772e5b4a5e8360743645b9a466842d16092c4f94"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"772e5b4a5e8360743645b9a466842d16092c4f94","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/772e5b4a5e8360743645b9a466842d16092c4f94.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39762","title":"drm/amd/display: add null check","status":"unfixed","project":false,"upstream":[{"sha":"158b9201c17fc93ed4253c2f03b77fd2671669a1","url":"https://git.kernel.org/stable/c/158b9201c17fc93ed4253c2f03b77fd2671669a1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"158b9201c17fc93ed4253c2f03b77fd2671669a1","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/158b9201c17fc93ed4253c2f03b77fd2671669a1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39747","title":"drm/msm: Add error handling for krealloc in metadata setup","status":"not-applicable","project":false,"upstream":[{"sha":"1c8c354098ea9d4376a58c96ae6b65288a6f15d8","url":"https://git.kernel.org/stable/c/1c8c354098ea9d4376a58c96ae6b65288a6f15d8"}],"evidence":[],"submission_lore":[],"basis":"msm_ioctl_gem_info_set_metadata() is absent from both targets, so the vulnerable krealloc assignment is not present and a backport would have no security effect.","review":{"id":"CVE-2025-39747","series":"6.1.y","upstream":["1c8c354098ea9d4376a58c96ae6b65288a6f15d8"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"msm_ioctl_gem_info_set_metadata() is absent from both targets, so the vulnerable krealloc assignment is not present and a backport would have no security effect.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"1c8c354098ea9d4376a58c96ae6b65288a6f15d8","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/1c8c354098ea9d4376a58c96ae6b65288a6f15d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39747","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39747.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39746","title":"wifi: ath10k: shutdown driver when hardware is unreliable","status":"unfixed","project":false,"upstream":[{"sha":"c256a94d1b1b15109740306f7f2a7c2173e12072","url":"https://git.kernel.org/stable/c/c256a94d1b1b15109740306f7f2a7c2173e12072"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c256a94d1b1b15109740306f7f2a7c2173e12072","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/c256a94d1b1b15109740306f7f2a7c2173e12072.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39746","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39746.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39732","title":"wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()","status":"unfixed","project":false,"upstream":[{"sha":"65c12b104cb942d588a1a093acc4537fb3d3b129","url":"https://git.kernel.org/stable/c/65c12b104cb942d588a1a093acc4537fb3d3b129"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"65c12b104cb942d588a1a093acc4537fb3d3b129","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/65c12b104cb942d588a1a093acc4537fb3d3b129.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39732","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39732.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39707","title":"drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities","status":"not-applicable","project":false,"upstream":[{"sha":"b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288","url":"https://git.kernel.org/stable/c/b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288"}],"evidence":[],"submission_lore":[],"basis":"No effect: the amdgpu_dm_capabilities capabilities_show() path and its hubbub dereference are absent from both targets. None; adding the newer debugfs feature is not a vulnerability backport. The reported NULL dereference is unreachable without the later debugfs implementation.","review":{"id":"CVE-2025-39707","series":"6.1.y","upstream":["b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"No effect: the amdgpu_dm_capabilities capabilities_show() path and its hubbub dereference are absent from both targets. None; adding the newer debugfs feature is not a vulnerability backport. The reported NULL dereference is unreachable without the later debugfs implementation.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39707","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39707.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38722","title":"habanalabs: fix UAF in export_dmabuf()","status":"queued","project":false,"upstream":[{"sha":"33927f3d0ecdcff06326d6e4edb6166aed42811c","url":"https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/habanalabs-fix-uaf-in-export_dmabuf.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"export_dmabuf_common publishes FD before assigning ctx and taking references","review":{"id":"CVE-2025-38722","series":"6.1.y","upstream":["33927f3d0ecdcff06326d6e4edb6166aed42811c"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"export_dmabuf_common publishes FD before assigning ctx and taking references","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/misc/habanalabs/common/memory.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/misc/habanalabs/common/memory.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1788"},{"label":"Upstream fix 33927f3d0ecd","url":"https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"}]},"size":{"status":"unknown","patches":[{"sha":"33927f3d0ecdcff06326d6e4edb6166aed42811c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38722","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38722.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38717","title":"net: kcm: Fix race condition in kcm_unattach()","status":"unfixed","project":false,"upstream":[{"sha":"52565a935213cd6a8662ddb8efe5b4219343a25d","url":"https://git.kernel.org/stable/c/52565a935213cd6a8662ddb8efe5b4219343a25d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"52565a935213cd6a8662ddb8efe5b4219343a25d","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/52565a935213cd6a8662ddb8efe5b4219343a25d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38717","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38717.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38716","title":"hfs: fix general protection fault in hfs_find_init()","status":"unfixed","project":false,"upstream":[{"sha":"736a0516a16268995f4898eded49bfef077af709","url":"https://git.kernel.org/stable/c/736a0516a16268995f4898eded49bfef077af709"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"736a0516a16268995f4898eded49bfef077af709","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/736a0516a16268995f4898eded49bfef077af709.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38716","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38716.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38675","title":"xfrm: state: initialize state_ptrs earlier in xfrm_state_find","status":"not-applicable","project":false,"upstream":[{"sha":"94d077c331730510d5611b438640a292097341f0","url":"https://git.kernel.org/stable/c/94d077c331730510d5611b438640a292097341f0"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"94d077c331730510d5611b438640a292097341f0","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/94d077c331730510d5611b438640a292097341f0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38675","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38675.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38660","title":"[ceph] parse_longname(): strrchr() expects NUL-terminated string","status":"not-applicable","project":false,"upstream":[{"sha":"101841c38346f4ca41dc1802c867da990ffb32eb","url":"https://git.kernel.org/stable/c/101841c38346f4ca41dc1802c867da990ffb32eb"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"101841c38346f4ca41dc1802c867da990ffb32eb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38660","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38660.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38656","title":"wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()","status":"unfixed","project":false,"upstream":[{"sha":"cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6","url":"https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38656","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38656.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38636","title":"rv: Use strings in da monitors tracepoints","status":"queued","project":false,"upstream":[{"sha":"7f904ff6e58d398c4336f3c19c42b338324451f7","url":"https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/rv-use-strings-in-da-monitors-tracepoints.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/20250728135022.255578-4-gmonaco@redhat.com"]}],"submission_lore":[],"basis":"DA trace classes use fixed __array plus MAX_DA_NAME_LEN memcpy","review":{"id":"CVE-2025-38636","series":"6.1.y","upstream":["7f904ff6e58d398c4336f3c19c42b338324451f7"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"DA trace classes use fixed __array plus MAX_DA_NAME_LEN memcpy","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: include/trace/events/rv.h","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/trace/events/rv.h?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 7f904ff6e58d","url":"https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7"}]},"size":{"status":"unknown","patches":[{"sha":"7f904ff6e58d398c4336f3c19c42b338324451f7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38636","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38636.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38621","title":"md: make rdev_addable usable for rcu mode","status":"not-applicable","project":false,"upstream":[{"sha":"13017b427118f4311471ee47df74872372ca8482","url":"https://git.kernel.org/stable/c/13017b427118f4311471ee47df74872372ca8482"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"13017b427118f4311471ee47df74872372ca8482","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38621","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38621.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38616","title":"tls: handle data disappearing from under the TLS ULP","status":"backported","project":true,"upstream":[{"sha":"6db015fc4b5d5f63a64a193f65d98da3a7fc811d","url":"https://git.kernel.org/stable/c/6db015fc4b5d5f63a64a193f65d98da3a7fc811d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ef50eaab631f9bf519ddbdfa42ccb0528adc1fc8","label":"ef50eaab631f","date":"2026-08-27T14:29:03+02:00","lore":["https://lore.kernel.org/tFjq_kf7sWIG3A7CrCg_egb8CVsT_gsmHAK0_wxDPJXfIzxFAMxqmLwp3MlU5EHiet0AwwJldaaFdgyHpeIUCS-3m3llsmRzp9xIOBR4lAI=@syst3mfailure.io"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6db015fc4b5d5f63a64a193f65d98da3a7fc811d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38616","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38616.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38591","title":"bpf: Reject narrower access to pointer ctx fields","status":"backported","project":false,"upstream":[{"sha":"e09299225d5ba3916c91ef70565f7d2187e4cca0","url":"https://git.kernel.org/stable/c/e09299225d5ba3916c91ef70565f7d2187e4cca0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/33660d44e789edb4f303210c813fc56d56377a90","label":"33660d44e789","date":"2026-02-06T16:44:14+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e09299225d5ba3916c91ef70565f7d2187e4cca0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38585","title":"staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()","status":"unfixed","project":false,"upstream":[{"sha":"ee4cf798202d285dcbe85e4467a094c44f5ed8e6","url":"https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","url":"https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ee4cf798202d285dcbe85e4467a094c44f5ed8e6","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/ee4cf798202d285dcbe85e4467a094c44f5ed8e6.patch"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","lines":168072,"reason":"","source":"https://github.com/torvalds/linux/commit/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38585","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38585.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38449","title":"drm/gem: Acquire references on GEM handles for framebuffers","status":"unfixed","project":false,"upstream":[{"sha":"5307dce878d4126e1b375587318955bd019c3741","url":"https://git.kernel.org/stable/c/5307dce878d4126e1b375587318955bd019c3741"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"5307dce878d4126e1b375587318955bd019c3741","lines":122,"reason":"","source":"https://github.com/torvalds/linux/commit/5307dce878d4126e1b375587318955bd019c3741.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38438","title":"ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.","status":"not-applicable","project":false,"upstream":[{"sha":"6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e","url":"https://git.kernel.org/stable/c/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e"}],"evidence":[],"submission_lore":[],"basis":"The leaking remove_file_ext() helper changed by upstream is absent; the targets' similarly named fixup path frees its temporary kstrdup(), so transplanting the patch would be a no-op/misbackport.","review":{"id":"CVE-2025-38438","series":"6.1.y","upstream":["6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"no-op","applicability":"unaffected","reason":"The leaking remove_file_ext() helper changed by upstream is absent; the targets' similarly named fixup path frees its temporary kstrdup(), so transplanting the patch would be a no-op/misbackport.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38438","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38438.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38426","title":"drm/amdgpu: Add basic validation for RAS header","status":"unfixed","project":false,"upstream":[{"sha":"5df0d6addb7e9b6f71f7162d1253762a5be9138e","url":"https://git.kernel.org/stable/c/5df0d6addb7e9b6f71f7162d1253762a5be9138e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5df0d6addb7e9b6f71f7162d1253762a5be9138e","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/5df0d6addb7e9b6f71f7162d1253762a5be9138e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38426","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38426.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38372","title":"RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling","status":"not-applicable","project":false,"upstream":[{"sha":"2c6b640ea08bff1a192bf87fa45246ff1e40767c","url":"https://git.kernel.org/stable/c/2c6b640ea08bff1a192bf87fa45246ff1e40767c"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c6b640ea08bff1a192bf87fa45246ff1e40767c","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/2c6b640ea08bff1a192bf87fa45246ff1e40767c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38372","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38372.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38369","title":"dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using","status":"unfixed","project":false,"upstream":[{"sha":"17502e7d7b7113346296f6758324798d536c31fd","url":"https://git.kernel.org/stable/c/17502e7d7b7113346296f6758324798d536c31fd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"17502e7d7b7113346296f6758324798d536c31fd","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/17502e7d7b7113346296f6758324798d536c31fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38369","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38369.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38333","title":"f2fs: fix to bail out in get_new_segment()","status":"unfixed","project":false,"upstream":[{"sha":"bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2","url":"https://git.kernel.org/stable/c/bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38311","title":"iavf: get rid of the crit lock","status":"unfixed","project":false,"upstream":[{"sha":"120f28a6f314fef7f282c99f196923fe44081cad","url":"https://git.kernel.org/stable/c/120f28a6f314fef7f282c99f196923fe44081cad"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"120f28a6f314fef7f282c99f196923fe44081cad","lines":513,"reason":"","source":"https://github.com/torvalds/linux/commit/120f28a6f314fef7f282c99f196923fe44081cad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38311","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38311.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38264","title":"nvme-tcp: sanitize request list handling","status":"unfixed","project":false,"upstream":[{"sha":"0bf04c874fcb1ae46a863034296e4b33d8fbd66c","url":"https://git.kernel.org/stable/c/0bf04c874fcb1ae46a863034296e4b33d8fbd66c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0bf04c874fcb1ae46a863034296e4b33d8fbd66c","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/0bf04c874fcb1ae46a863034296e4b33d8fbd66c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38264","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38264.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38237","title":"media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()","status":"backported","project":true,"upstream":[{"sha":"bd9f6ce7d512fa21249415c16af801a4ed5d97b6","url":"https://git.kernel.org/stable/c/bd9f6ce7d512fa21249415c16af801a4ed5d97b6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9b03c3ce32a685f9cb82d33c63fc18bfcee0ba1b","label":"9b03c3ce32a6","date":"2026-09-02T14:28:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"bd9f6ce7d512fa21249415c16af801a4ed5d97b6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38207","title":"mm: fix uprobe pte be overwritten when expanding vma","status":"unfixed","project":false,"upstream":[{"sha":"2b12d06c37fd3a394376f42f026a7478d826ed63","url":"https://git.kernel.org/stable/c/2b12d06c37fd3a394376f42f026a7478d826ed63"}],"evidence":[],"submission_lore":[],"basis":"copy_vma and merge paths call uprobe_mmap without copied-VMA skip","review":{"id":"CVE-2025-38207","series":"6.1.y","upstream":["2b12d06c37fd3a394376f42f026a7478d826ed63"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"copy_vma and merge paths call uprobe_mmap without copied-VMA skip","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: mm/mmap.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/mm/mmap.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n3330"},{"label":"Upstream fix 2b12d06c37fd","url":"https://git.kernel.org/stable/c/2b12d06c37fd3a394376f42f026a7478d826ed63"}]},"size":{"status":"within-limit","patches":[{"sha":"2b12d06c37fd3a394376f42f026a7478d826ed63","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/2b12d06c37fd3a394376f42f026a7478d826ed63.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38207","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38207.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38206","title":"exfat: fix double free in delayed_free","status":"backported","project":true,"upstream":[{"sha":"1f3d9724e16d62c7d42c67d6613b8512f2887c22","url":"https://git.kernel.org/stable/c/1f3d9724e16d62c7d42c67d6613b8512f2887c22"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ea27703eb0efbadcd45b9949526160ed90536a72","label":"ea27703eb0ef","date":"2026-09-02T14:28:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1f3d9724e16d62c7d42c67d6613b8512f2887c22","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38206","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38206.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38205","title":"drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1","status":"not-applicable","project":false,"upstream":[{"sha":"7e40f64896e8e3dca471e287672db5ace12ea0be","url":"https://git.kernel.org/stable/c/7e40f64896e8e3dca471e287672db5ace12ea0be"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"7e40f64896e8e3dca471e287672db5ace12ea0be","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38205","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38205.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38203","title":"jfs: Fix null-ptr-deref in jfs_ioc_trim","status":"backported","project":true,"upstream":[{"sha":"a4685408ff6c3e2af366ad9a7274f45ff3f394ee","url":"https://git.kernel.org/stable/c/a4685408ff6c3e2af366ad9a7274f45ff3f394ee"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4a2de0f5b8d7f218bea5bd43d30b466e8b272b8d","label":"4a2de0f5b8d7","date":"2026-09-02T14:28:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a4685408ff6c3e2af366ad9a7274f45ff3f394ee","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38203","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38203.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38199","title":"wifi: ath12k: Fix memory leak due to multiple rx_stats allocation","status":"not-applicable","project":false,"upstream":[{"sha":"c426497fa2055c8005196922e7d29c41d7e0948a","url":"https://git.kernel.org/stable/c/c426497fa2055c8005196922e7d29c41d7e0948a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"c426497fa2055c8005196922e7d29c41d7e0948a","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/c426497fa2055c8005196922e7d29c41d7e0948a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38199","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38199.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38187","title":"drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()","status":"not-applicable","project":false,"upstream":[{"sha":"9802f0a63b641f4cddb2139c814c2e95cb825099","url":"https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"9802f0a63b641f4cddb2139c814c2e95cb825099","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/9802f0a63b641f4cddb2139c814c2e95cb825099.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38187","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38187.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38140","title":"dm: limit swapping tables for devices with zone write plugs","status":"unfixed","project":false,"upstream":[{"sha":"121218bef4c1df165181f5cd8fc3a2246bac817e","url":"https://git.kernel.org/stable/c/121218bef4c1df165181f5cd8fc3a2246bac817e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"121218bef4c1df165181f5cd8fc3a2246bac817e","lines":166,"reason":"","source":"https://github.com/torvalds/linux/commit/121218bef4c1df165181f5cd8fc3a2246bac817e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38140","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38140.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38137","title":"PCI/pwrctrl: Cancel outstanding rescan work when unregistering","status":"not-applicable","project":false,"upstream":[{"sha":"8b926f237743f020518162c62b93cb7107a2b5eb","url":"https://git.kernel.org/stable/c/8b926f237743f020518162c62b93cb7107a2b5eb"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8b926f237743f020518162c62b93cb7107a2b5eb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/8b926f237743f020518162c62b93cb7107a2b5eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38080","title":"drm/amd/display: Increase block_sequence array size","status":"unfixed","project":false,"upstream":[{"sha":"3a7810c212bcf2f722671dadf4b23ff70a7d23ee","url":"https://git.kernel.org/stable/c/3a7810c212bcf2f722671dadf4b23ff70a7d23ee"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a7810c212bcf2f722671dadf4b23ff70a7d23ee","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3a7810c212bcf2f722671dadf4b23ff70a7d23ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38080","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38080.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38039","title":"net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled","status":"unfixed","project":false,"upstream":[{"sha":"689805dcc474c2accb5cffbbcea1c06ee4a54570","url":"https://git.kernel.org/stable/c/689805dcc474c2accb5cffbbcea1c06ee4a54570"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"689805dcc474c2accb5cffbbcea1c06ee4a54570","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/689805dcc474c2accb5cffbbcea1c06ee4a54570.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38039","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38039.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38038","title":"cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost","status":"not-applicable","project":false,"upstream":[{"sha":"db1cafc77aaaf871509da06f4a864e9af6d6791f","url":"https://git.kernel.org/stable/c/db1cafc77aaaf871509da06f4a864e9af6d6791f"}],"evidence":[],"submission_lore":[],"basis":"No effect: amd_pstate_set_boost() has no amd_pstate_driver_lock acquisition in either target. None; removing a nonexistent guard would be an effective no-op. The deadlocking lock arrangement was introduced after these implementations.","review":{"id":"CVE-2025-38038","series":"6.1.y","upstream":["db1cafc77aaaf871509da06f4a864e9af6d6791f"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"No effect: amd_pstate_set_boost() has no amd_pstate_driver_lock acquisition in either target. None; removing a nonexistent guard would be an effective no-op. The deadlocking lock arrangement was introduced after these implementations.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"db1cafc77aaaf871509da06f4a864e9af6d6791f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/db1cafc77aaaf871509da06f4a864e9af6d6791f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38038","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38038.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38036","title":"drm/xe/vf: Perform early GT MMIO initialization to read GMDID","status":"not-applicable","project":false,"upstream":[{"sha":"13265fe7426ec9ba5aa86baab913417ca361e8a4","url":"https://git.kernel.org/stable/c/13265fe7426ec9ba5aa86baab913417ca361e8a4"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"13265fe7426ec9ba5aa86baab913417ca361e8a4","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/13265fe7426ec9ba5aa86baab913417ca361e8a4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38036","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38036.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38014","title":"dmaengine: idxd: Refactor remove call with idxd_cleanup() helper","status":"unfixed","project":false,"upstream":[{"sha":"a409e919ca321cc0e28f8abf96fde299f0072a81","url":"https://git.kernel.org/stable/c/a409e919ca321cc0e28f8abf96fde299f0072a81"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a409e919ca321cc0e28f8abf96fde299f0072a81","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/a409e919ca321cc0e28f8abf96fde299f0072a81.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38014","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38014.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37907","title":"accel/ivpu: Fix locking order in ivpu_job_submit","status":"not-applicable","project":false,"upstream":[{"sha":"ab680dc6c78aa035e944ecc8c48a1caab9f39924","url":"https://git.kernel.org/stable/c/ab680dc6c78aa035e944ecc8c48a1caab9f39924"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"ab680dc6c78aa035e944ecc8c48a1caab9f39924","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/ab680dc6c78aa035e944ecc8c48a1caab9f39924.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37907","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37907.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37880","title":"um: work around sched_yield not yielding in time-travel mode","status":"unfixed","project":false,"upstream":[{"sha":"887c5c12e80c8424bd471122d2e8b6b462e12874","url":"https://git.kernel.org/stable/c/887c5c12e80c8424bd471122d2e8b6b462e12874"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"887c5c12e80c8424bd471122d2e8b6b462e12874","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/887c5c12e80c8424bd471122d2e8b6b462e12874.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37880","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37880.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37870","title":"drm/amd/display: prevent hang on link training fail","status":"not-applicable","project":false,"upstream":[{"sha":"8058061ed9d6bc259d1e678607b07d259342c08f","url":"https://git.kernel.org/stable/c/8058061ed9d6bc259d1e678607b07d259342c08f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8058061ed9d6bc259d1e678607b07d259342c08f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8058061ed9d6bc259d1e678607b07d259342c08f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37834","title":"mm/vmscan: don't try to reclaim hwpoison folio","status":"unfixed","project":false,"upstream":[{"sha":"1b0449544c6482179ac84530b61fc192a6527bfd","url":"https://git.kernel.org/stable/c/1b0449544c6482179ac84530b61fc192a6527bfd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1b0449544c6482179ac84530b61fc192a6527bfd","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/1b0449544c6482179ac84530b61fc192a6527bfd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37833","title":"net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads","status":"backported","project":true,"upstream":[{"sha":"fbb429ddff5c8e479edcc7dde5a542c9295944e6","url":"https://git.kernel.org/stable/c/fbb429ddff5c8e479edcc7dde5a542c9295944e6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/52a266008a9450e4222994666b4510c026fbb03c","label":"52a266008a94","date":"2026-09-14T13:24:33+02:00","lore":["https://lore.kernel.org/all/20241117234843.19236-3-dullfire@yahoo.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fbb429ddff5c8e479edcc7dde5a542c9295944e6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37833","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37833.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37826","title":"scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()","status":"not-applicable","project":false,"upstream":[{"sha":"08a966a917fe3d92150fa3cc15793ad5e57051eb","url":"https://git.kernel.org/stable/c/08a966a917fe3d92150fa3cc15793ad5e57051eb"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"08a966a917fe3d92150fa3cc15793ad5e57051eb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/08a966a917fe3d92150fa3cc15793ad5e57051eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37802","title":"ksmbd: fix WARNING \"do not call blocking ops when !TASK_RUNNING\"","status":"unfixed","project":false,"upstream":[{"sha":"1df0d4c616138784e033ad337961b6e1a6bcd999","url":"https://git.kernel.org/stable/c/1df0d4c616138784e033ad337961b6e1a6bcd999"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1df0d4c616138784e033ad337961b6e1a6bcd999","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/1df0d4c616138784e033ad337961b6e1a6bcd999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37802","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37802.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37800","title":"driver core: fix potential NULL pointer dereference in dev_uevent()","status":"unfixed","project":false,"upstream":[{"sha":"18daa52418e7e4629ed1703b64777294209d2622","url":"https://git.kernel.org/stable/c/18daa52418e7e4629ed1703b64777294209d2622"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"18daa52418e7e4629ed1703b64777294209d2622","lines":79,"reason":"","source":"https://github.com/torvalds/linux/commit/18daa52418e7e4629ed1703b64777294209d2622.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37800","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37800.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37777","title":"ksmbd: fix use-after-free in __smb2_lease_break_noti()","status":"unfixed","project":false,"upstream":[{"sha":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","url":"https://git.kernel.org/stable/c/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37777","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37777.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37776","title":"ksmbd: fix use-after-free in smb_break_all_levII_oplock()","status":"unfixed","project":false,"upstream":[{"sha":"18b4fac5ef17f77fed9417d22210ceafd6525fc7","url":"https://git.kernel.org/stable/c/18b4fac5ef17f77fed9417d22210ceafd6525fc7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"18b4fac5ef17f77fed9417d22210ceafd6525fc7","lines":91,"reason":"","source":"https://github.com/torvalds/linux/commit/18b4fac5ef17f77fed9417d22210ceafd6525fc7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37776","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37776.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37750","title":"smb: client: fix UAF in decryption with multichannel","status":"queued","project":false,"upstream":[{"sha":"9502dd5c7029902f4a425bf959917a5a9e7c0e50","url":"https://git.kernel.org/stable/c/9502dd5c7029902f4a425bf959917a5a9e7c0e50"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/smb-client-fix-uaf-in-decryption-with-multichannel.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/CAH2r5mu6Yc0-RJXM3kFyBYUB09XmXBrNodOiCVR4EDrmxq5Szg@mail.gmail.com"]}],"submission_lore":[],"basis":"Both targets already allocate and release separate enc/dec AEAD transforms for every channel during negotiate; neither shares primary_server->secmech, so the raced shared-transform state fixed upstream is absent. Applying the source change would reproduce existing target behavior and therefore have no security effect.","review":{"id":"CVE-2025-37750","series":"6.1.y","upstream":["9502dd5c7029902f4a425bf959917a5a9e7c0e50"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"no-op","applicability":"unaffected","reason":"Both targets already allocate and release separate enc/dec AEAD transforms for every channel during negotiate; neither shares primary_server->secmech, so the raced shared-transform state fixed upstream is absent. Applying the source change would reproduce existing target behavior and therefore have no security effect.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"9502dd5c7029902f4a425bf959917a5a9e7c0e50","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37750","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37750.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23133","title":"wifi: ath11k: update channel list in reg notifier instead reg worker","status":"unfixed","project":false,"upstream":[{"sha":"933ab187e679e6fbdeea1835ae39efcc59c022d2","url":"https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"933ab187e679e6fbdeea1835ae39efcc59c022d2","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/933ab187e679e6fbdeea1835ae39efcc59c022d2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23133","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23133.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23132","title":"f2fs: quota: fix to avoid warning in dquot_writeback_dquots()","status":"unfixed","project":false,"upstream":[{"sha":"eb85c2410d6f581e957cd03a644ff6ddbe592af9","url":"https://git.kernel.org/stable/c/eb85c2410d6f581e957cd03a644ff6ddbe592af9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"eb85c2410d6f581e957cd03a644ff6ddbe592af9","lines":232,"reason":"","source":"https://github.com/torvalds/linux/commit/eb85c2410d6f581e957cd03a644ff6ddbe592af9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23132","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23132.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23130","title":"f2fs: fix to avoid panic once fallocation fails for pinfile","status":"unfixed","project":false,"upstream":[{"sha":"48ea8b200414ac69ea96f4c231f5c7ef1fbeffef","url":"https://git.kernel.org/stable/c/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"48ea8b200414ac69ea96f4c231f5c7ef1fbeffef","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23130","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23130.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23129","title":"wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path","status":"backported","project":true,"upstream":[{"sha":"68410c5bd381a81bcc92b808e7dc4e6b9ed25d11","url":"https://git.kernel.org/stable/c/68410c5bd381a81bcc92b808e7dc4e6b9ed25d11"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8d0519f511d93d675f61d6bfb45ffcc945af4b14","label":"8d0519f511d9","date":"2026-09-14T13:24:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"68410c5bd381a81bcc92b808e7dc4e6b9ed25d11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22127","title":"f2fs: fix potential deadloop in prepare_compress_overwrite()","status":"queued","project":false,"upstream":[{"sha":"3147ee567dd9004a49826ddeaf0a4b12865d4409","url":"https://git.kernel.org/stable/c/3147ee567dd9004a49826ddeaf0a4b12865d4409"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/f2fs-fix-potential-deadloop-in-prepare_compress_over.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"3147ee567dd9004a49826ddeaf0a4b12865d4409","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22127","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22127.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22125","title":"md/raid1,raid10: don't ignore IO flags","status":"unfixed","project":false,"upstream":[{"sha":"e879a0d9cb086c8e52ce6c04e5bfa63825a6213c","url":"https://git.kernel.org/stable/c/e879a0d9cb086c8e52ce6c04e5bfa63825a6213c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e879a0d9cb086c8e52ce6c04e5bfa63825a6213c","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/e879a0d9cb086c8e52ce6c04e5bfa63825a6213c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22124","title":"md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb","status":"not-applicable","project":false,"upstream":[{"sha":"6130825f34d41718c98a9b1504a79a23e379701e","url":"https://git.kernel.org/stable/c/6130825f34d41718c98a9b1504a79a23e379701e"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"unknown","patches":[{"sha":"6130825f34d41718c98a9b1504a79a23e379701e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22124","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22124.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22113","title":"ext4: avoid journaling sb update on error if journal is destroying","status":"unfixed","project":false,"upstream":[{"sha":"ce2f26e73783b4a7c46a86e3af5b5c8de0971790","url":"https://git.kernel.org/stable/c/ce2f26e73783b4a7c46a86e3af5b5c8de0971790"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ce2f26e73783b4a7c46a86e3af5b5c8de0971790","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/ce2f26e73783b4a7c46a86e3af5b5c8de0971790.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22113","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22113.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22108","title":"bnxt_en: Mask the bd_cnt field in the TX BD properly","status":"not-applicable","project":false,"upstream":[{"sha":"107b25db61122d8f990987895c2912927b8b6e3f","url":"https://git.kernel.org/stable/c/107b25db61122d8f990987895c2912927b8b6e3f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"107b25db61122d8f990987895c2912927b8b6e3f","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/107b25db61122d8f990987895c2912927b8b6e3f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22108","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22108.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22104","title":"ibmvnic: Use kernel helpers for hex dumps","status":"backported","project":true,"upstream":[{"sha":"d93a6caab5d7d9b5ce034d75b1e1e993338e3852","url":"https://git.kernel.org/stable/c/d93a6caab5d7d9b5ce034d75b1e1e993338e3852"}],"evidence":[{"url":"https://git.kernel.org/stable/c/19efa170e01207c8ada726f3f6c65b31fcba2a73","label":"19efa170e012","date":"2026-09-02T14:28:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d93a6caab5d7d9b5ce034d75b1e1e993338e3852","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22104","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22104.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22103","title":"net: fix NULL pointer dereference in l3mdev_l3_rcv","status":"backported","project":true,"upstream":[{"sha":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","url":"https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862","label":"8da4d7f9141e","date":"2026-09-14T13:24:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22101","title":"net: libwx: fix Tx L4 checksum","status":"not-applicable","project":false,"upstream":[{"sha":"c7d82913d5f9e97860772ee4051eaa66b56a6273","url":"https://git.kernel.org/stable/c/c7d82913d5f9e97860772ee4051eaa66b56a6273"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"c7d82913d5f9e97860772ee4051eaa66b56a6273","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22043","title":"ksmbd: add bounds check for durable handle context","status":"unfixed","project":false,"upstream":[{"sha":"542027e123fc0bfd61dd59e21ae0ee4ef2101b29","url":"https://git.kernel.org/stable/c/542027e123fc0bfd61dd59e21ae0ee4ef2101b29"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"542027e123fc0bfd61dd59e21ae0ee4ef2101b29","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/542027e123fc0bfd61dd59e21ae0ee4ef2101b29.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22039","title":"ksmbd: fix overflow in dacloffset bounds check","status":"backported","project":false,"upstream":[{"sha":"beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42","url":"https://git.kernel.org/stable/c/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8483d7b532be1d1bc149556a2fedf903868c6303","label":"8483d7b532be","date":"2026-09-14T13:24:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22039","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22039.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22028","title":"media: vimc: skip .s_stream() for stopped entities","status":"unfixed","project":false,"upstream":[{"sha":"36cef585e2a31e4ddf33a004b0584a7a572246de","url":"https://git.kernel.org/stable/c/36cef585e2a31e4ddf33a004b0584a7a572246de"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"36cef585e2a31e4ddf33a004b0584a7a572246de","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/36cef585e2a31e4ddf33a004b0584a7a572246de.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21985","title":"drm/amd/display: Fix out-of-bound accesses","status":"not-applicable","project":false,"upstream":[{"sha":"8adbb2a98b00926315fd513b5fe2596b5716b82d","url":"https://git.kernel.org/stable/c/8adbb2a98b00926315fd513b5fe2596b5716b82d"}],"evidence":[],"submission_lore":[],"basis":"Upstream bounds DML2 and DML2.1 translation-helper indices before accessing fixed-size arrays. Do not backport: neither target contains dml2_translation_helper.c or dml21_translation_helper.c, nor the affected DML2 mapping arrays. There is no target code path to modify, so any fabricated analogue would be an effective no-op with respect to this CVE.","review":{"id":"CVE-2025-21985","series":"6.1.y","upstream":["8adbb2a98b00926315fd513b5fe2596b5716b82d"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"Upstream bounds DML2 and DML2.1 translation-helper indices before accessing fixed-size arrays. Do not backport: neither target contains dml2_translation_helper.c or dml21_translation_helper.c, nor the affected DML2 mapping arrays. There is no target code path to modify, so any fabricated analogue would be an effective no-op with respect to this CVE.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"8adbb2a98b00926315fd513b5fe2596b5716b82d","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/8adbb2a98b00926315fd513b5fe2596b5716b82d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21985","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21985.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21976","title":"fbdev: hyperv_fb: Allow graceful removal of framebuffer","status":"unfixed","project":false,"upstream":[{"sha":"ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","url":"https://git.kernel.org/stable/c/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21976","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21976.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21949","title":"LoongArch: Set hugetlb mmap base address aligned with pmd size","status":"unfixed","project":false,"upstream":[{"sha":"3109d5ff484b7bc7b955f166974c6776d91f247b","url":"https://git.kernel.org/stable/c/3109d5ff484b7bc7b955f166974c6776d91f247b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3109d5ff484b7bc7b955f166974c6776d91f247b","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/3109d5ff484b7bc7b955f166974c6776d91f247b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21942","title":"btrfs: zoned: fix extent range end unlock in cow_file_range()","status":"not-applicable","project":false,"upstream":[{"sha":"5a4041f2c47247575a6c2e53ce14f7b0ac946c33","url":"https://git.kernel.org/stable/c/5a4041f2c47247575a6c2e53ce14f7b0ac946c33"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5a4041f2c47247575a6c2e53ce14f7b0ac946c33","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/5a4041f2c47247575a6c2e53ce14f7b0ac946c33.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21942","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21942.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21907","title":"mm: memory-failure: update ttu flag inside unmap_poisoned_folio","status":"unfixed","project":false,"upstream":[{"sha":"b81679b1633aa43c0d973adfa816d78c1ed0d032","url":"https://git.kernel.org/stable/c/b81679b1633aa43c0d973adfa816d78c1ed0d032"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"b81679b1633aa43c0d973adfa816d78c1ed0d032","lines":128,"reason":"","source":"https://github.com/torvalds/linux/commit/b81679b1633aa43c0d973adfa816d78c1ed0d032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21907","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21907.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21886","title":"RDMA/mlx5: Fix implicit ODP hang on parent deregistration","status":"queued","project":false,"upstream":[{"sha":"3d8c6f26893d55fab218ad086719de1fc9bb86ba","url":"https://git.kernel.org/stable/c/3d8c6f26893d55fab218ad086719de1fc9bb86ba"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/rdma-mlx5-fix-implicit-odp-hang-on-parent-deregistra.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3d8c6f26893d55fab218ad086719de1fc9bb86ba","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/3d8c6f26893d55fab218ad086719de1fc9bb86ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21886","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21886.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21870","title":"ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers","status":"queued","project":false,"upstream":[{"sha":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","url":"https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/asoc-sof-ipc4-topology-harden-loops-for-looking-up-a.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21836","title":"io_uring/kbuf: reallocate buf lists on upgrade","status":"unfixed","project":false,"upstream":[{"sha":"8802766324e1f5d414a81ac43365c20142e85603","url":"https://git.kernel.org/stable/c/8802766324e1f5d414a81ac43365c20142e85603"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8802766324e1f5d414a81ac43365c20142e85603","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/8802766324e1f5d414a81ac43365c20142e85603.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21836","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21836.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21825","title":"bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT","status":"not-applicable","project":false,"upstream":[{"sha":"58f038e6d209d2dd862fcf5de55407855856794d","url":"https://git.kernel.org/stable/c/58f038e6d209d2dd862fcf5de55407855856794d"}],"evidence":[],"submission_lore":[],"basis":"Upstream explicitly marks this as depending on v6.12+ PREEMPT_RT; neither target has the configuration/locking combination, so the kworker cancellation backport would be ineffective.","review":{"id":"CVE-2025-21825","series":"6.1.y","upstream":["58f038e6d209d2dd862fcf5de55407855856794d"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"Upstream explicitly marks this as depending on v6.12+ PREEMPT_RT; neither target has the configuration/locking combination, so the kworker cancellation backport would be ineffective.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"58f038e6d209d2dd862fcf5de55407855856794d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/58f038e6d209d2dd862fcf5de55407855856794d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21825","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21825.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21817","title":"block: mark GFP_NOIO around sysfs ->store()","status":"not-applicable","project":false,"upstream":[{"sha":"7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c","url":"https://git.kernel.org/stable/c/7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"unknown","patches":[{"sha":"7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21817","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21817.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21752","title":"btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents","status":"not-applicable","project":false,"upstream":[{"sha":"dc14ba10781bd2629835696b7cc1febf914768e9","url":"https://git.kernel.org/stable/c/dc14ba10781bd2629835696b7cc1febf914768e9"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"dc14ba10781bd2629835696b7cc1febf914768e9","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/dc14ba10781bd2629835696b7cc1febf914768e9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21732","title":"RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error","status":"queued","project":false,"upstream":[{"sha":"abb604a1a9c87255c7a6f3b784410a9707baf467","url":"https://git.kernel.org/stable/c/abb604a1a9c87255c7a6f3b784410a9707baf467"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/rdma-mlx5-fix-a-race-for-an-odp-mr-which-leads-to-cq.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"abb604a1a9c87255c7a6f3b784410a9707baf467","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/abb604a1a9c87255c7a6f3b784410a9707baf467.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21732","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21732.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21693","title":"mm: zswap: properly synchronize freeing resources during CPU hotunplug","status":"unfixed","project":false,"upstream":[{"sha":"12dcb0ef540629a281533f9dedc1b6b8e14cfb65","url":"https://git.kernel.org/stable/c/12dcb0ef540629a281533f9dedc1b6b8e14cfb65"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"12dcb0ef540629a281533f9dedc1b6b8e14cfb65","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/12dcb0ef540629a281533f9dedc1b6b8e14cfb65.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21693","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21693.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21651","title":"net: hns3: don't auto enable misc vector","status":"backported","project":false,"upstream":[{"sha":"98b1e3b27734139c76295754b6c317aa4df6d32e","url":"https://git.kernel.org/stable/c/98b1e3b27734139c76295754b6c317aa4df6d32e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/41b84c5a603ffe987ec094e163d7da73aaf1841d","label":"41b84c5a603f","date":"2026-09-14T13:24:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"98b1e3b27734139c76295754b6c317aa4df6d32e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21651","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21651.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21649","title":"net: hns3: fix kernel crash when 1588 is sent on HIP08 devices","status":"backported","project":true,"upstream":[{"sha":"9741e72b2286de8b38de9db685588ac421a95c87","url":"https://git.kernel.org/stable/c/9741e72b2286de8b38de9db685588ac421a95c87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7b1b15058b177b0457ebf34b6664763cf2bbf712","label":"7b1b15058b17","date":"2026-09-14T13:24:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9741e72b2286de8b38de9db685588ac421a95c87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21649","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21649.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21634","title":"cgroup/cpuset: remove kernfs active break","status":"unfixed","project":false,"upstream":[{"sha":"3cb97a927fffe443e1e7e8eddbfebfdb062e86ed","url":"https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3cb97a927fffe443e1e7e8eddbfebfdb062e86ed","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58241","title":"Bluetooth: hci_core: Disable works on hci_unregister_dev","status":"unfixed","project":false,"upstream":[{"sha":"989fa5171f005ecf63440057218d8aeb1795287d","url":"https://git.kernel.org/stable/c/989fa5171f005ecf63440057218d8aeb1795287d"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"989fa5171f005ecf63440057218d8aeb1795287d","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/989fa5171f005ecf63440057218d8aeb1795287d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58241","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58241.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58237","title":"bpf: consider that tail calls invalidate packet pointers","status":"unfixed","project":false,"upstream":[{"sha":"1a4607ffba35bf2a630aab299e34dd3f6e658d70","url":"https://git.kernel.org/stable/c/1a4607ffba35bf2a630aab299e34dd3f6e658d70"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a4607ffba35bf2a630aab299e34dd3f6e658d70","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/1a4607ffba35bf2a630aab299e34dd3f6e658d70.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58100","title":"bpf: check changes_pkt_data property for extension programs","status":"unfixed","project":false,"upstream":[{"sha":"81f6d0530ba031b5f038a091619bf2ff29568852","url":"https://git.kernel.org/stable/c/81f6d0530ba031b5f038a091619bf2ff29568852"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"81f6d0530ba031b5f038a091619bf2ff29568852","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/81f6d0530ba031b5f038a091619bf2ff29568852.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58100","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58100.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58098","title":"bpf: track changes_pkt_data property for global functions","status":"unfixed","project":false,"upstream":[{"sha":"51081a3f25c742da5a659d7fc6fd77ebfdd555be","url":"https://git.kernel.org/stable/c/51081a3f25c742da5a659d7fc6fd77ebfdd555be"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"51081a3f25c742da5a659d7fc6fd77ebfdd555be","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/51081a3f25c742da5a659d7fc6fd77ebfdd555be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58098","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58098.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58097","title":"wifi: ath11k: fix RCU stall while reaping monitor destination ring","status":"backported","project":true,"upstream":[{"sha":"16c6c35c03ea73054a1f6d3302a4ce4a331b427d","url":"https://git.kernel.org/stable/c/16c6c35c03ea73054a1f6d3302a4ce4a331b427d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cdb32923699932502b0573f818643aae72ce0cd5","label":"cdb329236999","date":"2026-09-14T13:24:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"16c6c35c03ea73054a1f6d3302a4ce4a331b427d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58095","title":"jfs: add check read-only before txBeginAnon() call","status":"backported","project":true,"upstream":[{"sha":"0176e69743ecc02961f2ae1ea42439cd2bf9ed58","url":"https://git.kernel.org/stable/c/0176e69743ecc02961f2ae1ea42439cd2bf9ed58"}],"evidence":[{"url":"https://git.kernel.org/stable/c/469bd67fc338e77d7585e4f20d4212afd44fefdc","label":"469bd67fc338","date":"2026-09-02T14:28:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0176e69743ecc02961f2ae1ea42439cd2bf9ed58","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58095","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58095.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58094","title":"jfs: add check read-only before truncation in jfs_truncate_nolock()","status":"backported","project":true,"upstream":[{"sha":"b5799dd77054c1ec49b0088b006c9908e256843b","url":"https://git.kernel.org/stable/c/b5799dd77054c1ec49b0088b006c9908e256843b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b57a8983916fc2cf54fd8de3afc733c6b3d1c0e5","label":"b57a8983916f","date":"2026-09-02T14:28:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"b5799dd77054c1ec49b0088b006c9908e256843b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58094","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58094.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58089","title":"btrfs: fix double accounting race when btrfs_run_delalloc_range() failed","status":"unfixed","project":false,"upstream":[{"sha":"72dad8e377afa50435940adfb697e070d3556670","url":"https://git.kernel.org/stable/c/72dad8e377afa50435940adfb697e070d3556670"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"72dad8e377afa50435940adfb697e070d3556670","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/72dad8e377afa50435940adfb697e070d3556670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58053","title":"rxrpc: Fix handling of received connection abort","status":"unfixed","project":false,"upstream":[{"sha":"0e56ebde245e4799ce74d38419426f2a80d39950","url":"https://git.kernel.org/stable/c/0e56ebde245e4799ce74d38419426f2a80d39950"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0e56ebde245e4799ce74d38419426f2a80d39950","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/0e56ebde245e4799ce74d38419426f2a80d39950.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58053","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58053.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58015","title":"wifi: ath12k: Fix for out-of bound access error","status":"not-applicable","project":false,"upstream":[{"sha":"eb8c0534713865d190856f10bfc97cf0b88475b1","url":"https://git.kernel.org/stable/c/eb8c0534713865d190856f10bfc97cf0b88475b1"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb8c0534713865d190856f10bfc97cf0b88475b1","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/eb8c0534713865d190856f10bfc97cf0b88475b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58012","title":"ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params","status":"queued","project":false,"upstream":[{"sha":"569922b82ca660f8b24e705f6cf674e6b1f99cc7","url":"https://git.kernel.org/stable/c/569922b82ca660f8b24e705f6cf674e6b1f99cc7"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/asoc-sof-intel-hda-dai-ensure-dai-widget-is-valid-du.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"569922b82ca660f8b24e705f6cf674e6b1f99cc7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58012","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58012.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57984","title":"i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition","status":"unfixed","project":false,"upstream":[{"sha":"b75439c945b94dd8a2b645355bdb56f948052601","url":"https://git.kernel.org/stable/c/b75439c945b94dd8a2b645355bdb56f948052601"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b75439c945b94dd8a2b645355bdb56f948052601","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b75439c945b94dd8a2b645355bdb56f948052601.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57984","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57984.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57975","title":"btrfs: do proper folio cleanup when run_delalloc_nocow() failed","status":"unfixed","project":false,"upstream":[{"sha":"c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","url":"https://git.kernel.org/stable/c/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","lines":150,"reason":"","source":"https://github.com/torvalds/linux/commit/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57872","title":"scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()","status":"unfixed","project":false,"upstream":[{"sha":"897df60c16d54ad515a3d0887edab5c63da06d1f","url":"https://git.kernel.org/stable/c/897df60c16d54ad515a3d0887edab5c63da06d1f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"897df60c16d54ad515a3d0887edab5c63da06d1f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/897df60c16d54ad515a3d0887edab5c63da06d1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57857","title":"RDMA/siw: Remove direct link to net_device","status":"unfixed","project":false,"upstream":[{"sha":"16b87037b48889d21854c8e97aec8a1baf2642b3","url":"https://git.kernel.org/stable/c/16b87037b48889d21854c8e97aec8a1baf2642b3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"16b87037b48889d21854c8e97aec8a1baf2642b3","lines":204,"reason":"","source":"https://github.com/torvalds/linux/commit/16b87037b48889d21854c8e97aec8a1baf2642b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57857","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57857.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57809","title":"PCI: imx6: Fix suspend/resume support on i.MX6QDL","status":"unfixed","project":false,"upstream":[{"sha":"0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3","url":"https://git.kernel.org/stable/c/0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57809","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57809.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57795","title":"RDMA/rxe: Remove the direct link to net_device","status":"unfixed","project":false,"upstream":[{"sha":"2ac5415022d16d63d912a39a06f32f1f51140261","url":"https://git.kernel.org/stable/c/2ac5415022d16d63d912a39a06f32f1f51140261"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2ac5415022d16d63d912a39a06f32f1f51140261","lines":260,"reason":"","source":"https://github.com/torvalds/linux/commit/2ac5415022d16d63d912a39a06f32f1f51140261.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57795","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57795.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56775","title":"drm/amd/display: Fix handling of plane refcount","status":"not-applicable","project":false,"upstream":[{"sha":"27227a234c1487cb7a684615f0749c455218833a","url":"https://git.kernel.org/stable/c/27227a234c1487cb7a684615f0749c455218833a"}],"evidence":[],"submission_lore":[],"basis":"No effect: neither target contains restore_planes_and_stream_state() or the scratch plane-state overwrite that loses the live refcount. Do not import the later backup/restore mechanism. The operation corrected by the patch is absent, so an adapted patch would be a no-op or unrelated redesign.","review":{"id":"CVE-2024-56775","series":"6.1.y","upstream":["27227a234c1487cb7a684615f0749c455218833a"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"No effect: neither target contains restore_planes_and_stream_state() or the scratch plane-state overwrite that loses the live refcount. Do not import the later backup/restore mechanism. The operation corrected by the patch is absent, so an adapted patch would be a no-op or unrelated redesign.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"27227a234c1487cb7a684615f0749c455218833a","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/27227a234c1487cb7a684615f0749c455218833a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56591","title":"Bluetooth: hci_conn: Use disable_delayed_work_sync","status":"unfixed","project":false,"upstream":[{"sha":"2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df","url":"https://git.kernel.org/stable/c/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56544","title":"udmabuf: change folios array from kmalloc to kvmalloc","status":"unfixed","project":false,"upstream":[{"sha":"1c0844c6184e658064e14c4335885785ad3bf84b","url":"https://git.kernel.org/stable/c/1c0844c6184e658064e14c4335885785ad3bf84b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c0844c6184e658064e14c4335885785ad3bf84b","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/1c0844c6184e658064e14c4335885785ad3bf84b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56544","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56544.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56538","title":"drm: zynqmp_kms: Unplug DRM device before removal","status":"queued","project":false,"upstream":[{"sha":"2e07c88914fc5289c21820b1aa94f058feb38197","url":"https://git.kernel.org/stable/c/2e07c88914fc5289c21820b1aa94f058feb38197"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-zynqmp_kms-unplug-drm-device-before-removal.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/dri-devel/4d8f4c9b-2efb-4774-9a37-2f257f79b2c9@linux.dev/"]}],"submission_lore":[],"basis":"zynqmp_dpsub_remove() calls drm_dev_unregister() during teardown without drm_dev_unplug() synchronization before releasing device resources.","review":{"id":"CVE-2024-56538","series":"6.1.y","upstream":["2e07c88914fc5289c21820b1aa94f058feb38197"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"zynqmp_dpsub_remove() calls drm_dev_unregister() during teardown without drm_dev_unplug() synchronization before releasing device resources.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/xlnx/zynqmp_dpsub.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/xlnx/zynqmp_dpsub.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n251"},{"label":"Upstream fix 2e07c88914fc","url":"https://git.kernel.org/stable/c/2e07c88914fc5289c21820b1aa94f058feb38197"}]},"size":{"status":"unknown","patches":[{"sha":"2e07c88914fc5289c21820b1aa94f058feb38197","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53687","title":"riscv: Fix IPIs usage in kfence_protect_page()","status":"unfixed","project":false,"upstream":[{"sha":"b3431a8bb336cece8adc452437befa7d4534b2fd","url":"https://git.kernel.org/stable/c/b3431a8bb336cece8adc452437befa7d4534b2fd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b3431a8bb336cece8adc452437befa7d4534b2fd","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/b3431a8bb336cece8adc452437befa7d4534b2fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53687","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53687.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53219","title":"virtiofs: use pages instead of pointer for kernel direct IO","status":"unfixed","project":false,"upstream":[{"sha":"41748675c0bf252b3c5f600a95830f0936d366c1","url":"https://git.kernel.org/stable/c/41748675c0bf252b3c5f600a95830f0936d366c1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"41748675c0bf252b3c5f600a95830f0936d366c1","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/41748675c0bf252b3c5f600a95830f0936d366c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53219","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53219.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53218","title":"f2fs: fix race in concurrent f2fs_stop_gc_thread","status":"unfixed","project":false,"upstream":[{"sha":"7b0033dbc48340a1c1c3f12448ba17d6587ca092","url":"https://git.kernel.org/stable/c/7b0033dbc48340a1c1c3f12448ba17d6587ca092"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7b0033dbc48340a1c1c3f12448ba17d6587ca092","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/7b0033dbc48340a1c1c3f12448ba17d6587ca092.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53218","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53218.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53201","title":"drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe","status":"queued","project":false,"upstream":[{"sha":"6a057072ddd127255350357dd880903e8fa23f36","url":"https://git.kernel.org/stable/c/6a057072ddd127255350357dd880903e8fa23f36"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6a057072ddd127255350357dd880903e8fa23f36","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/6a057072ddd127255350357dd880903e8fa23f36.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53201","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53201.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53187","title":"io_uring: check for overflows in io_pin_pages","status":"queued","project":false,"upstream":[{"sha":"0c0a4eae26ac78379d0c1db053de168a8febc6c9","url":"https://git.kernel.org/stable/c/0c0a4eae26ac78379d0c1db053de168a8febc6c9"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/io_uring-check-for-overflows-in-io_pin_pages.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/1b7520ddb168e1d537d64be47414a0629d0d8f8f.1732581026.git.asml.silence@gmail.com"]}],"submission_lore":[],"basis":"io_pin_pages uses unchecked uaddr + len + PAGE_SIZE - 1","review":{"id":"CVE-2024-53187","series":"6.1.y","upstream":["0c0a4eae26ac78379d0c1db053de168a8febc6c9"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"io_pin_pages uses unchecked uaddr + len + PAGE_SIZE - 1","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: io_uring/rsrc.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/io_uring/rsrc.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n979"},{"label":"Upstream fix 0c0a4eae26ac","url":"https://git.kernel.org/stable/c/0c0a4eae26ac78379d0c1db053de168a8febc6c9"}]},"size":{"status":"unknown","patches":[{"sha":"0c0a4eae26ac78379d0c1db053de168a8febc6c9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53187","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53187.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53176","title":"smb: During unmount, ensure all cached dir instances drop their dentry","status":"unfixed","project":false,"upstream":[{"sha":"3fa640d035e5ae526769615c35cb9ed4be6e3662","url":"https://git.kernel.org/stable/c/3fa640d035e5ae526769615c35cb9ed4be6e3662"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3fa640d035e5ae526769615c35cb9ed4be6e3662","lines":357,"reason":"","source":"https://github.com/torvalds/linux/commit/3fa640d035e5ae526769615c35cb9ed4be6e3662.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53176","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53176.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53134","title":"pmdomain: imx93-blk-ctrl: correct remove path","status":"queued","project":false,"upstream":[{"sha":"f7c7c5aa556378a2c8da72c1f7f238b6648f95fb","url":"https://git.kernel.org/stable/c/f7c7c5aa556378a2c8da72c1f7f238b6648f95fb"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/pmdomain-imx93-blk-ctrl-correct-remove-path.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"imx93_blk_ctrl_remove loop condition ignores index and omits pm_runtime_disable","review":{"id":"CVE-2024-53134","series":"6.1.y","upstream":["f7c7c5aa556378a2c8da72c1f7f238b6648f95fb"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"imx93_blk_ctrl_remove loop condition ignores index and omits pm_runtime_disable","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/soc/imx/imx93-blk-ctrl.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/soc/imx/imx93-blk-ctrl.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n294"},{"label":"Upstream fix f7c7c5aa5563","url":"https://git.kernel.org/stable/c/f7c7c5aa556378a2c8da72c1f7f238b6648f95fb"}]},"size":{"status":"unknown","patches":[{"sha":"f7c7c5aa556378a2c8da72c1f7f238b6648f95fb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53134","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53134.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53114","title":"x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client","status":"queued","project":true,"upstream":[{"sha":"a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0","url":"https://git.kernel.org/stable/c/a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/x86-cpu-amd-clear-virtualized-vmload-vmsave-on-zen4-.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53114","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53114.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53089","title":"LoongArch: KVM: Mark hrtimer to expire in hard interrupt context","status":"not-applicable","project":false,"upstream":[{"sha":"73adbd92f3223dc0c3506822b71c6b259d5d537b","url":"https://git.kernel.org/stable/c/73adbd92f3223dc0c3506822b71c6b259d5d537b"}],"evidence":[],"submission_lore":[],"basis":"LoongArch KVM is absent from both targets.","review":{"id":"CVE-2024-53089","series":"6.1.y","upstream":["73adbd92f3223dc0c3506822b71c6b259d5d537b"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"LoongArch KVM is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"73adbd92f3223dc0c3506822b71c6b259d5d537b","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/73adbd92f3223dc0c3506822b71c6b259d5d537b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53085","title":"tpm: Lock TPM chip in tpm_pm_suspend() first","status":"unfixed","project":false,"upstream":[{"sha":"9265fed6db601ee2ec47577815387458ef4f047a","url":"https://git.kernel.org/stable/c/9265fed6db601ee2ec47577815387458ef4f047a"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9265fed6db601ee2ec47577815387458ef4f047a","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/9265fed6db601ee2ec47577815387458ef4f047a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53079","title":"mm/thp: fix deferred split unqueue naming and locking","status":"unfixed","project":false,"upstream":[{"sha":"f8f931bba0f92052cf842b7e30917b1afcc77d5a","url":"https://git.kernel.org/stable/c/f8f931bba0f92052cf842b7e30917b1afcc77d5a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"f8f931bba0f92052cf842b7e30917b1afcc77d5a","lines":214,"reason":"","source":"https://github.com/torvalds/linux/commit/f8f931bba0f92052cf842b7e30917b1afcc77d5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53056","title":"drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()","status":"queued","project":true,"upstream":[{"sha":"4018651ba5c409034149f297d3dd3328b91561fd","url":"https://git.kernel.org/stable/c/4018651ba5c409034149f297d3dd3328b91561fd"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-mediatek-fix-potential-null-dereference-in-mtk_c.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"mtk_drm_crtc_destroy() invokes mtk_drm_cmdq_pkt_destroy() before checking cmdq_client.chan, while the helper dereferences client->chan->mbox->dev.","review":{"id":"CVE-2024-53056","series":"6.1.y","upstream":["4018651ba5c409034149f297d3dd3328b91561fd"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"mtk_drm_crtc_destroy() invokes mtk_drm_cmdq_pkt_destroy() before checking cmdq_client.chan, while the helper dereferences client->chan->mbox->dev.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/mediatek/mtk_drm_crtc.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/mediatek/mtk_drm_crtc.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n157"},{"label":"Upstream fix 4018651ba5c4","url":"https://git.kernel.org/stable/c/4018651ba5c409034149f297d3dd3328b91561fd"}]},"size":{"status":"unknown","patches":[{"sha":"4018651ba5c409034149f297d3dd3328b91561fd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53056","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53056.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53051","title":"drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability","status":"queued","project":true,"upstream":[{"sha":"31b42af516afa1e184d1a9f9dd4096c54044269a","url":"https://git.kernel.org/stable/c/31b42af516afa1e184d1a9f9dd4096c54044269a"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-i915-hdcp-add-encoder-check-in-intel_hdcp_get_ca.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"31b42af516afa1e184d1a9f9dd4096c54044269a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53051","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53051.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53050","title":"drm/i915/hdcp: Add encoder check in hdcp2_get_capability","status":"queued","project":true,"upstream":[{"sha":"d34f4f058edf1235c103ca9c921dc54820d14d40","url":"https://git.kernel.org/stable/c/d34f4f058edf1235c103ca9c921dc54820d14d40"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-i915-hdcp-add-encoder-check-in-hdcp2_get_capabil.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"d34f4f058edf1235c103ca9c921dc54820d14d40","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53050","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53050.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50289","title":"media: av7110: fix a spectre vulnerability","status":"queued","project":true,"upstream":[{"sha":"458ea1c0be991573ec436aa0afa23baacfae101a","url":"https://git.kernel.org/stable/c/458ea1c0be991573ec436aa0afa23baacfae101a"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/media-av7110-fix-a-spectre-vulnerability.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"dvb_ca_ioctl indexes ci_slot without array_index_nospec","review":{"id":"CVE-2024-50289","series":"6.1.y","upstream":["458ea1c0be991573ec436aa0afa23baacfae101a"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"dvb_ca_ioctl indexes ci_slot without array_index_nospec","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/staging/media/deprecated/saa7146/av7110/av7110_ca.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/staging/media/deprecated/saa7146/av7110/av7110_ca.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n234"},{"label":"Upstream fix 458ea1c0be99","url":"https://git.kernel.org/stable/c/458ea1c0be991573ec436aa0afa23baacfae101a"}]},"size":{"status":"unknown","patches":[{"sha":"458ea1c0be991573ec436aa0afa23baacfae101a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50282","title":"drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()","status":"unfixed","project":false,"upstream":[{"sha":"4d75b9468021c73108b4439794d69e892b1d24e3","url":"https://git.kernel.org/stable/c/4d75b9468021c73108b4439794d69e892b1d24e3"}],"evidence":[],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"within-limit","patches":[{"sha":"4d75b9468021c73108b4439794d69e892b1d24e3","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/4d75b9468021c73108b4439794d69e892b1d24e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50282","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50282.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50225","title":"btrfs: fix error propagation of split bios","status":"not-applicable","project":false,"upstream":[{"sha":"d48e1dea3931de64c26717adc2b89743c7ab6594","url":"https://git.kernel.org/stable/c/d48e1dea3931de64c26717adc2b89743c7ab6594"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"d48e1dea3931de64c26717adc2b89743c7ab6594","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/d48e1dea3931de64c26717adc2b89743c7ab6594.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50225","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50225.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50217","title":"btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()","status":"not-applicable","project":false,"upstream":[{"sha":"aec8e6bf839101784f3ef037dcdb9432c3f32343","url":"https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343"}],"evidence":[],"submission_lore":[],"basis":"No effect: neither target has struct btrfs_device.bdev_file, which is the stale pointer cleared by the fix. Do not synthesize the newer bdev_file conversion merely to apply this fix. The older targets close and clear device->bdev and cannot execute the reported bdev_file use-after-free path.","review":{"id":"CVE-2024-50217","series":"6.1.y","upstream":["aec8e6bf839101784f3ef037dcdb9432c3f32343"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"No effect: neither target has struct btrfs_device.bdev_file, which is the stale pointer cleared by the fix. Do not synthesize the newer bdev_file conversion merely to apply this fix. The older targets close and clear device->bdev and cannot execute the reported bdev_file use-after-free path.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"aec8e6bf839101784f3ef037dcdb9432c3f32343","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/aec8e6bf839101784f3ef037dcdb9432c3f32343.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50211","title":"udf: refactor inode_bmap() to handle error","status":"unfixed","project":false,"upstream":[{"sha":"c226964ec786f3797ed389a16392ce4357697d24","url":"https://git.kernel.org/stable/c/c226964ec786f3797ed389a16392ce4357697d24"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c226964ec786f3797ed389a16392ce4357697d24","lines":173,"reason":"","source":"https://github.com/torvalds/linux/commit/c226964ec786f3797ed389a16392ce4357697d24.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50166","title":"fsl/fman: Fix refcount handling of fman-related devices","status":"unfixed","project":false,"upstream":[{"sha":"1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1","url":"https://git.kernel.org/stable/c/1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1","lines":151,"reason":"","source":"https://github.com/torvalds/linux/commit/1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50166","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50166.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50111","title":"LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context","status":"unfixed","project":false,"upstream":[{"sha":"69cc6fad5df4ce652d969be69acc60e269e5eea1","url":"https://git.kernel.org/stable/c/69cc6fad5df4ce652d969be69acc60e269e5eea1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"69cc6fad5df4ce652d969be69acc60e269e5eea1","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/69cc6fad5df4ce652d969be69acc60e269e5eea1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50111","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50111.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50102","title":"x86: fix user address masking non-canonical speculation issue","status":"not-applicable","project":false,"upstream":[{"sha":"86e6b1547b3d013bc392adf775b89318441403c2","url":"https://git.kernel.org/stable/c/86e6b1547b3d013bc392adf775b89318441403c2"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"86e6b1547b3d013bc392adf775b89318441403c2","lines":116,"reason":"","source":"https://github.com/torvalds/linux/commit/86e6b1547b3d013bc392adf775b89318441403c2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50057","title":"usb: typec: tipd: Free IRQ only if it was requested before","status":"unfixed","project":false,"upstream":[{"sha":"db63d9868f7f310de44ba7bea584e2454f8b4ed0","url":"https://git.kernel.org/stable/c/db63d9868f7f310de44ba7bea584e2454f8b4ed0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"db63d9868f7f310de44ba7bea584e2454f8b4ed0","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/db63d9868f7f310de44ba7bea584e2454f8b4ed0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50057","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50057.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50043","title":"nfsd: fix possible badness in FREE_STATEID","status":"not-applicable","project":false,"upstream":[{"sha":"c88c150a467fcb670a1608e2272beeee3e86df6e","url":"https://git.kernel.org/stable/c/c88c150a467fcb670a1608e2272beeee3e86df6e"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c88c150a467fcb670a1608e2272beeee3e86df6e","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/c88c150a467fcb670a1608e2272beeee3e86df6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50028","title":"thermal: core: Reference count the zone in thermal_zone_get_by_id()","status":"unfixed","project":false,"upstream":[{"sha":"a42a5839f400e929c489bb1b58f54596c4535167","url":"https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a42a5839f400e929c489bb1b58f54596c4535167","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/a42a5839f400e929c489bb1b58f54596c4535167.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50017","title":"x86/mm/ident_map: Use gbpages only where full GB page should be mapped.","status":"backported","project":true,"upstream":[{"sha":"cc31744a294584a36bf764a0ffa3255a8e69f036","url":"https://git.kernel.org/stable/c/cc31744a294584a36bf764a0ffa3255a8e69f036"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fe9bab1d6441ed49dc3dd0acce4c2215e8d85447","label":"fe9bab1d6441","date":"2026-09-14T13:24:33+02:00","lore":["https://lore.kernel.org/all/20240717213121.3064030-3-steve.wahl@hpe.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"cc31744a294584a36bf764a0ffa3255a8e69f036","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49988","title":"ksmbd: add refcnt to ksmbd_conn struct","status":"unfixed","project":false,"upstream":[{"sha":"ee426bfb9d09b29987369b897fe9b6485ac2be27","url":"https://git.kernel.org/stable/c/ee426bfb9d09b29987369b897fe9b6485ac2be27"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ee426bfb9d09b29987369b897fe9b6485ac2be27","lines":186,"reason":"","source":"https://github.com/torvalds/linux/commit/ee426bfb9d09b29987369b897fe9b6485ac2be27.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49970","title":"drm/amd/display: Implement bounds check for stream encoder creation in DCN401","status":"queued","project":false,"upstream":[{"sha":"bdf606810210e8e07a0cdf1af3c467291363b295","url":"https://git.kernel.org/stable/c/bdf606810210e8e07a0cdf1af3c467291363b295"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-implement-bounds-check-for-stream-en.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The DCN401 stream-encoder factory and fixed register array are absent from both targets.","review":{"id":"CVE-2024-49970","series":"6.1.y","upstream":["bdf606810210e8e07a0cdf1af3c467291363b295"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The DCN401 stream-encoder factory and fixed register array are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"bdf606810210e8e07a0cdf1af3c467291363b295","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49970","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49970.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49923","title":"drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags","status":"queued","project":false,"upstream":[{"sha":"5559598742fb4538e4c51c48ef70563c49c2af23","url":"https://git.kernel.org/stable/c/5559598742fb4538e4c51c48ef70563c49c2af23"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-pass-non-null-to-dcn20_validate_appl.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"dcn20_fast_validate_bw() and dcn21_fast_validate_bw() pass NULL for the merge output; dcn20_validate_apply_pipe_split_flags() writes merge[i] results through that pointer.","review":{"id":"CVE-2024-49923","series":"6.1.y","upstream":["5559598742fb4538e4c51c48ef70563c49c2af23"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"dcn20_fast_validate_bw() and dcn21_fast_validate_bw() pass NULL for the merge output; dcn20_validate_apply_pipe_split_flags() writes merge[i] results through that pointer.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1825"},{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n811"},{"label":"Upstream fix 5559598742fb","url":"https://git.kernel.org/stable/c/5559598742fb4538e4c51c48ef70563c49c2af23"}]},"size":{"status":"unknown","patches":[{"sha":"5559598742fb4538e4c51c48ef70563c49c2af23","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49923","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49923.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49922","title":"drm/amd/display: Check null pointers before using them","status":"queued","project":false,"upstream":[{"sha":"1ff12bcd7deaeed25efb5120433c6a45dd5504a8","url":"https://git.kernel.org/stable/c/1ff12bcd7deaeed25efb5120433c6a45dd5504a8"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-check-null-pointers-before-using-the.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"1ff12bcd7deaeed25efb5120433c6a45dd5504a8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49922","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49922.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49919","title":"drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer","status":"queued","project":false,"upstream":[{"sha":"f22f4754aaa47d8c59f166ba3042182859e5dff7","url":"https://git.kernel.org/stable/c/f22f4754aaa47d8c59f166ba3042182859e5dff7"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-add-null-check-for-head_pipe-in-dcn2.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"dcn201_acquire_idle_pipe_for_layer() ASSERTs when find_idle_secondary_pipe() returns NULL but continues and dereferences head_pipe->stream.","review":{"id":"CVE-2024-49919","series":"6.1.y","upstream":["f22f4754aaa47d8c59f166ba3042182859e5dff7"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"dcn201_acquire_idle_pipe_for_layer() ASSERTs when find_idle_secondary_pipe() returns NULL but continues and dereferences head_pipe->stream.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn201/dcn201_resource.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn201/dcn201_resource.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1003"},{"label":"Upstream fix f22f4754aaa4","url":"https://git.kernel.org/stable/c/f22f4754aaa47d8c59f166ba3042182859e5dff7"}]},"size":{"status":"unknown","patches":[{"sha":"f22f4754aaa47d8c59f166ba3042182859e5dff7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49919","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49919.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49918","title":"drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer","status":"queued","project":false,"upstream":[{"sha":"ac2140449184a26eac99585b7f69814bd3ba8f2d","url":"https://git.kernel.org/stable/c/ac2140449184a26eac99585b7f69814bd3ba8f2d"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-add-null-check-for-head_pipe-in-dcn3.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The sole target caller dereferences the candidate before the new NULL guard, so the isolated backport does not prevent the fault.","review":{"id":"CVE-2024-49918","series":"6.1.y","upstream":["ac2140449184a26eac99585b7f69814bd3ba8f2d"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"ineffective-fix","applicability":"affected","reason":"The sole target caller dereferences the candidate before the new NULL guard, so the isolated backport does not prevent the fault.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"ac2140449184a26eac99585b7f69814bd3ba8f2d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49916","title":"drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw","status":"not-applicable","project":false,"upstream":[{"sha":"4b6377f0e96085cbec96eb7f0b282430ccdd3d75","url":"https://git.kernel.org/stable/c/4b6377f0e96085cbec96eb7f0b282430ccdd3d75"}],"evidence":[],"submission_lore":[],"basis":"The DCN401 init path is absent from both targets.","review":{"id":"CVE-2024-49916","series":"6.1.y","upstream":["4b6377f0e96085cbec96eb7f0b282430ccdd3d75"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The DCN401 init path is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"4b6377f0e96085cbec96eb7f0b282430ccdd3d75","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/4b6377f0e96085cbec96eb7f0b282430ccdd3d75.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49916","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49916.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49914","title":"drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe","status":"queued","project":false,"upstream":[{"sha":"8e4ed3cf1642df0c4456443d865cff61a9598aa8","url":"https://git.kernel.org/stable/c/8e4ed3cf1642df0c4456443d865cff61a9598aa8"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-add-null-check-for-pipe_ctx-plane_st.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"dcn20_program_pipe() still performs update-flag and transfer-function accesses through plane_state without consistent NULL checks.","review":{"id":"CVE-2024-49914","series":"6.1.y","upstream":["8e4ed3cf1642df0c4456443d865cff61a9598aa8"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"dcn20_program_pipe() still performs update-flag and transfer-function accesses through plane_state without consistent NULL checks.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1638"},{"label":"Upstream fix 8e4ed3cf1642","url":"https://git.kernel.org/stable/c/8e4ed3cf1642df0c4456443d865cff61a9598aa8"}]},"size":{"status":"unknown","patches":[{"sha":"8e4ed3cf1642df0c4456443d865cff61a9598aa8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49910","title":"drm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func","status":"not-applicable","project":false,"upstream":[{"sha":"dd340acd42c24a3f28dd22fae6bf38662334264c","url":"https://git.kernel.org/stable/c/dd340acd42c24a3f28dd22fae6bf38662334264c"}],"evidence":[],"submission_lore":[],"basis":"The DCN401 output-transfer function is absent from both targets.","review":{"id":"CVE-2024-49910","series":"6.1.y","upstream":["dd340acd42c24a3f28dd22fae6bf38662334264c"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The DCN401 output-transfer function is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"dd340acd42c24a3f28dd22fae6bf38662334264c","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/dd340acd42c24a3f28dd22fae6bf38662334264c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49910","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49910.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49908","title":"drm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2)","status":"not-applicable","project":false,"upstream":[{"sha":"0fe20258b4989b9112b5e9470df33a0939403fd4","url":"https://git.kernel.org/stable/c/0fe20258b4989b9112b5e9470df33a0939403fd4"}],"evidence":[],"submission_lore":[],"basis":"The amdgpu_dm_update_cursor() path and its afb pitch use are absent from both targets.","review":{"id":"CVE-2024-49908","series":"6.1.y","upstream":["0fe20258b4989b9112b5e9470df33a0939403fd4"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The amdgpu_dm_update_cursor() path and its afb pitch use are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"0fe20258b4989b9112b5e9470df33a0939403fd4","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/0fe20258b4989b9112b5e9470df33a0939403fd4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49908","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49908.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49906","title":"drm/amd/display: Check null pointer before try to access it","status":"queued","project":false,"upstream":[{"sha":"1b686053c06ffb9f4524b288110cf2a831ff7a25","url":"https://git.kernel.org/stable/c/1b686053c06ffb9f4524b288110cf2a831ff7a25"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-check-null-pointer-before-try-to-acc.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"dcn20_program_pipe() still dereferences plane_state->update_flags in branches without guarding plane_state; the upstream change adds these guards.","review":{"id":"CVE-2024-49906","series":"6.1.y","upstream":["1b686053c06ffb9f4524b288110cf2a831ff7a25"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"dcn20_program_pipe() still dereferences plane_state->update_flags in branches without guarding plane_state; the upstream change adds these guards.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1638"},{"label":"Upstream fix 1b686053c06f","url":"https://git.kernel.org/stable/c/1b686053c06ffb9f4524b288110cf2a831ff7a25"}]},"size":{"status":"unknown","patches":[{"sha":"1b686053c06ffb9f4524b288110cf2a831ff7a25","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49893","title":"drm/amd/display: Check stream_status before it is used","status":"not-applicable","project":false,"upstream":[{"sha":"58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9","url":"https://git.kernel.org/stable/c/58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9"}],"evidence":[],"submission_lore":[],"basis":"The FAMS2 fast-update path and nullable stream_status consumer are absent from both targets.","review":{"id":"CVE-2024-49893","series":"6.1.y","upstream":["58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The FAMS2 fast-update path and nullable stream_status consumer are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49893","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49893.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47752","title":"media: mediatek: vcodec: Fix H264 stateless decoder smatch warning","status":"queued","project":false,"upstream":[{"sha":"7878d3a385efab560dce793b595447867fb163f2","url":"https://git.kernel.org/stable/c/7878d3a385efab560dce793b595447867fb163f2"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/media-mediatek-vcodec-fix-h264-stateless-decoder-sma.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"vdec_h264_slice_decode dereferences fb without NULL return","review":{"id":"CVE-2024-47752","series":"6.1.y","upstream":["7878d3a385efab560dce793b595447867fb163f2"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"vdec_h264_slice_decode dereferences fb without NULL return","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_if.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_if.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n334"},{"label":"Upstream fix 7878d3a385ef","url":"https://git.kernel.org/stable/c/7878d3a385efab560dce793b595447867fb163f2"}]},"size":{"status":"unknown","patches":[{"sha":"7878d3a385efab560dce793b595447867fb163f2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47703","title":"bpf, lsm: Add check for BPF LSM return value","status":"unfixed","project":false,"upstream":[{"sha":"5d99e198be279045e6ecefe220f5c52f8ce9bfd5","url":"https://git.kernel.org/stable/c/5d99e198be279045e6ecefe220f5c52f8ce9bfd5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"5d99e198be279045e6ecefe220f5c52f8ce9bfd5","lines":200,"reason":"","source":"https://github.com/torvalds/linux/commit/5d99e198be279045e6ecefe220f5c52f8ce9bfd5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47703","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47703.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47702","title":"bpf: Fail verification for sign-extension of packet data/data_end/data_meta","status":"not-applicable","project":false,"upstream":[{"sha":"92de36080c93296ef9005690705cba260b9bd68a","url":"https://git.kernel.org/stable/c/92de36080c93296ef9005690705cba260b9bd68a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"92de36080c93296ef9005690705cba260b9bd68a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47702","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47702.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47691","title":"f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()","status":"unfixed","project":false,"upstream":[{"sha":"c7f114d864ac91515bb07ac271e9824a20f5ed95","url":"https://git.kernel.org/stable/c/c7f114d864ac91515bb07ac271e9824a20f5ed95"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7f114d864ac91515bb07ac271e9824a20f5ed95","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/c7f114d864ac91515bb07ac271e9824a20f5ed95.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47691","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47691.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47683","title":"drm/amd/display: Skip Recompute DSC Params if no Stream on Link","status":"backported","project":false,"upstream":[{"sha":"8151a6c13111b465dbabe07c19f572f7cbd16fef","url":"https://git.kernel.org/stable/c/8151a6c13111b465dbabe07c19f572f7cbd16fef"},{"sha":"50e376f1fe3bf571d0645ddf48ad37eb58323919","url":"https://git.kernel.org/stable/c/50e376f1fe3bf571d0645ddf48ad37eb58323919"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7c887efda1201110211fed8921a92a713e0b6bcd","label":"7c887efda120","date":"2024-10-17T15:21:17+02:00","lore":[]},{"url":"https://git.kernel.org/stable/c/282f0a482ee61d5e863512f3c4fcec90216c20d9","label":"282f0a482ee6","date":"2024-08-14T13:52:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8151a6c13111b465dbabe07c19f572f7cbd16fef","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/8151a6c13111b465dbabe07c19f572f7cbd16fef.patch"},{"sha":"50e376f1fe3bf571d0645ddf48ad37eb58323919","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/50e376f1fe3bf571d0645ddf48ad37eb58323919.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47683","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47683.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47662","title":"drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection","status":"not-applicable","project":false,"upstream":[{"sha":"466423c6dd8af23ebb3a69d43434d01aed0db356","url":"https://git.kernel.org/stable/c/466423c6dd8af23ebb3a69d43434d01aed0db356"}],"evidence":[],"submission_lore":[],"basis":"The DCN35 diagnostic path and prohibited register read are absent from both targets.","review":{"id":"CVE-2024-47662","series":"6.1.y","upstream":["466423c6dd8af23ebb3a69d43434d01aed0db356"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The DCN35 diagnostic path and prohibited register read are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"466423c6dd8af23ebb3a69d43434d01aed0db356","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/466423c6dd8af23ebb3a69d43434d01aed0db356.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47662","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47662.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47661","title":"drm/amd/display: Avoid overflow from uint32_t to uint8_t","status":"queued","project":false,"upstream":[{"sha":"d6b54900c564e35989cf6813e4071504fa0a90e0","url":"https://git.kernel.org/stable/c/d6b54900c564e35989cf6813e4071504fa0a90e0"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-avoid-overflow-from-uint32_t-to-uint.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The local 0xFFFF value is assigned to an 8-bit ramping_boundary field, producing 0xFF, identical to the upstream 8-bit value; the command byte and behavior are equivalent.","review":{"id":"CVE-2024-47661","series":"6.1.y","upstream":["d6b54900c564e35989cf6813e4071504fa0a90e0"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"no-op","applicability":"unaffected","reason":"The local 0xFFFF value is assigned to an 8-bit ramping_boundary field, producing 0xFF, identical to the upstream 8-bit value; the command byte and behavior are equivalent.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Checked source: drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n2628"},{"label":"Upstream fix d6b54900c564","url":"https://git.kernel.org/stable/c/d6b54900c564e35989cf6813e4071504fa0a90e0"}]},"size":{"status":"unknown","patches":[{"sha":"d6b54900c564e35989cf6813e4071504fa0a90e0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46870","title":"drm/amd/display: Disable DMCUB timeout for DCN35","status":"not-applicable","project":false,"upstream":[{"sha":"7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f","url":"https://git.kernel.org/stable/c/7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f"}],"evidence":[],"submission_lore":[],"basis":"The DCN35 IPS and DMCUB timeout path is absent from both targets.","review":{"id":"CVE-2024-46870","series":"6.1.y","upstream":["7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The DCN35 IPS and DMCUB timeout path is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46842","title":"scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info","status":"not-applicable","project":false,"upstream":[{"sha":"ede596b1434b57c0b3fd5c02b326efe5c54f6e48","url":"https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"ede596b1434b57c0b3fd5c02b326efe5c54f6e48","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46842","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46842.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46834","title":"ethtool: fail closed if we can't get max channel used in indirection tables","status":"queued","project":true,"upstream":[{"sha":"2899d58462ba868287d6ff3acad3675e7adf934f","url":"https://git.kernel.org/stable/c/2899d58462ba868287d6ff3acad3675e7adf934f"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/ethtool-fail-closed-if-we-can-t-get-max-channel-used.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"2899d58462ba868287d6ff3acad3675e7adf934f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46813","title":"drm/amd/display: Check link_index before accessing dc->links[]","status":"queued","project":false,"upstream":[{"sha":"8aa2864044b9d13e95fe224f32e808afbf79ecdf","url":"https://git.kernel.org/stable/c/8aa2864044b9d13e95fe224f32e808afbf79ecdf"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-check-link_index-before-accessing-dc.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The inline dc_get_link_at_index() returns dc->links[link_index] without checking the index against the link-array bound.","review":{"id":"CVE-2024-46813","series":"6.1.y","upstream":["8aa2864044b9d13e95fe224f32e808afbf79ecdf"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"The inline dc_get_link_at_index() returns dc->links[link_index] without checking the index against the link-array bound.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dc_link.h","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dc_link.h?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n280"},{"label":"Upstream fix 8aa2864044b9","url":"https://git.kernel.org/stable/c/8aa2864044b9d13e95fe224f32e808afbf79ecdf"}]},"size":{"status":"unknown","patches":[{"sha":"8aa2864044b9d13e95fe224f32e808afbf79ecdf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46813","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46813.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46808","title":"drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range","status":"queued","project":false,"upstream":[{"sha":"5524fa301ba649f8cf00848f91468e0ba7e4f24c","url":"https://git.kernel.org/stable/c/5524fa301ba649f8cf00848f91468e0ba7e4f24c"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-add-missing-null-pointer-check-withi.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The allocation path is absent, and the upstream ASSERT would not prevent a NULL dereference if transplanted elsewhere.","review":{"id":"CVE-2024-46808","series":"6.1.y","upstream":["5524fa301ba649f8cf00848f91468e0ba7e4f24c"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The allocation path is absent, and the upstream ASSERT would not prevent a NULL dereference if transplanted elsewhere.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"5524fa301ba649f8cf00848f91468e0ba7e4f24c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46806","title":"drm/amdgpu: Fix the warning division or modulo by zero","status":"not-applicable","project":false,"upstream":[{"sha":"1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c","url":"https://git.kernel.org/stable/c/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c"}],"evidence":[],"submission_lore":[],"basis":"The pinned target has no Aqua Vanjaram implementation or ASIC-specific partition path corresponding to the affected source.","review":{"id":"CVE-2024-46806","series":"6.1.y","upstream":["1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The pinned target has no Aqua Vanjaram implementation or ASIC-specific partition path corresponding to the affected source.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/gpu/drm/amd/display absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 1a00f2ac82d6","url":"https://git.kernel.org/stable/c/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c"}]},"size":{"status":"within-limit","patches":[{"sha":"1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46776","title":"drm/amd/display: Run DC_LOG_DC after checking link->link_enc","status":"not-applicable","project":false,"upstream":[{"sha":"3a82f62b0d9d7687eac47603bb6cd14a50fa718b","url":"https://git.kernel.org/stable/c/3a82f62b0d9d7687eac47603bb6cd14a50fa718b"}],"evidence":[],"submission_lore":[],"basis":"dc_link.c checks link->link_enc for NULL and takes the failure path before logging BIOS feature fields, matching the fix.","review":{"id":"CVE-2024-46776","series":"6.1.y","upstream":["3a82f62b0d9d7687eac47603bb6cd14a50fa718b"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"already-fixed","applicability":"fixed","reason":"dc_link.c checks link->link_enc for NULL and takes the failure path before logging BIOS feature fields, matching the fix.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/core/dc_link.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/core/dc_link.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 3a82f62b0d9d","url":"https://git.kernel.org/stable/c/3a82f62b0d9d7687eac47603bb6cd14a50fa718b"}]},"size":{"status":"within-limit","patches":[{"sha":"3a82f62b0d9d7687eac47603bb6cd14a50fa718b","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/3a82f62b0d9d7687eac47603bb6cd14a50fa718b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46776","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46776.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46775","title":"drm/amd/display: Validate function returns","status":"queued","project":true,"upstream":[{"sha":"673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c","url":"https://git.kernel.org/stable/c/673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-validate-function-returns.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46760","title":"wifi: rtw88: usb: schedule rx work after everything is set up","status":"not-applicable","project":false,"upstream":[{"sha":"adc539784c98a7cc602cbf557debfc2e7b9be8b3","url":"https://git.kernel.org/stable/c/adc539784c98a7cc602cbf557debfc2e7b9be8b3"}],"evidence":[],"submission_lore":[],"basis":"The target lacks the rtw88 USB setup path changed by this fix.","review":{"id":"CVE-2024-46760","series":"6.1.y","upstream":["adc539784c98a7cc602cbf557debfc2e7b9be8b3"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The target lacks the rtw88 USB setup path changed by this fix.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/net/wireless/realtek/rtw88/usb.c absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/realtek/rtw88?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix adc539784c98","url":"https://git.kernel.org/stable/c/adc539784c98a7cc602cbf557debfc2e7b9be8b3"}]},"size":{"status":"within-limit","patches":[{"sha":"adc539784c98a7cc602cbf557debfc2e7b9be8b3","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/adc539784c98a7cc602cbf557debfc2e7b9be8b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46760","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46760.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46754","title":"bpf: Remove tst_run from lwt_seg6local_prog_ops.","status":"backported","project":true,"upstream":[{"sha":"c13fda93aca118b8e5cd202e339046728ee7dddb","url":"https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b05c2e25a5c168dbb46b6f7fcb741fd4e4f3b54a","label":"b05c2e25a5c1","date":"2026-09-02T14:28:31+02:00","lore":["https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"c13fda93aca118b8e5cd202e339046728ee7dddb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46754","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46754.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46730","title":"drm/amd/display: Ensure array index tg_inst won't be -1","status":"queued","project":false,"upstream":[{"sha":"687fe329f18ab0ab0496b20ed2cb003d4879d931","url":"https://git.kernel.org/stable/c/687fe329f18ab0ab0496b20ed2cb003d4879d931"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-ensure-array-index-tg_inst-won-t-be-.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"687fe329f18ab0ab0496b20ed2cb003d4879d931","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46730","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46730.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46729","title":"drm/amd/display: Fix incorrect size calculation for loop","status":"not-applicable","project":false,"upstream":[{"sha":"3941a3aa4b653b69876d894d08f3fff1cc965267","url":"https://git.kernel.org/stable/c/3941a3aa4b653b69876d894d08f3fff1cc965267"}],"evidence":[],"submission_lore":[],"basis":"The DCN35 DCCG path and fe_clk_en loop are absent from both targets.","review":{"id":"CVE-2024-46729","series":"6.1.y","upstream":["3941a3aa4b653b69876d894d08f3fff1cc965267"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The DCN35 DCCG path and fe_clk_en loop are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"3941a3aa4b653b69876d894d08f3fff1cc965267","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3941a3aa4b653b69876d894d08f3fff1cc965267.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46729","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46729.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46728","title":"drm/amd/display: Check index for aux_rd_interval before using","status":"queued","project":false,"upstream":[{"sha":"9ba2ea6337b4f159aecb177555a6a81da92d302e","url":"https://git.kernel.org/stable/c/9ba2ea6337b4f159aecb177555a6a81da92d302e"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-check-index-for-aux_rd_interval-befo.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"configure_lttpr_mode_non_transparent() decrements the repeater count and iterates repeater data without bounding the count against available AUX interval entries.","review":{"id":"CVE-2024-46728","series":"6.1.y","upstream":["9ba2ea6337b4f159aecb177555a6a81da92d302e"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"configure_lttpr_mode_non_transparent() decrements the repeater count and iterates repeater data without bounding the count against available AUX interval entries.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1632"},{"label":"Upstream fix 9ba2ea6337b4","url":"https://git.kernel.org/stable/c/9ba2ea6337b4f159aecb177555a6a81da92d302e"}]},"size":{"status":"unknown","patches":[{"sha":"9ba2ea6337b4f159aecb177555a6a81da92d302e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46728","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46728.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46727","title":"drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update","status":"not-applicable","project":false,"upstream":[{"sha":"871cd9d881fa791d3f82885000713de07041c0ae","url":"https://git.kernel.org/stable/c/871cd9d881fa791d3f82885000713de07041c0ae"}],"evidence":[],"submission_lore":[],"basis":"The topology logger, phantom-stream lookup, and otg_master consumer are absent from both targets.","review":{"id":"CVE-2024-46727","series":"6.1.y","upstream":["871cd9d881fa791d3f82885000713de07041c0ae"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The topology logger, phantom-stream lookup, and otg_master consumer are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"871cd9d881fa791d3f82885000713de07041c0ae","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/871cd9d881fa791d3f82885000713de07041c0ae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46727","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46727.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46701","title":"libfs: fix infinite directory reads for offset dir","status":"not-applicable","project":false,"upstream":[{"sha":"64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a","url":"https://git.kernel.org/stable/c/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46701","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46701.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46698","title":"video/aperture: optionally match the device in sysfb_disable()","status":"unfixed","project":false,"upstream":[{"sha":"b49420d6a1aeb399e5b107fc6eb8584d0860fbd7","url":"https://git.kernel.org/stable/c/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"b49420d6a1aeb399e5b107fc6eb8584d0860fbd7","lines":108,"reason":"","source":"https://github.com/torvalds/linux/commit/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46698","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46698.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46682","title":"nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open","status":"not-applicable","project":false,"upstream":[{"sha":"a204501e1743d695ca2930ed25a2be9f8ced96d3","url":"https://git.kernel.org/stable/c/a204501e1743d695ca2930ed25a2be9f8ced96d3"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a204501e1743d695ca2930ed25a2be9f8ced96d3","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/a204501e1743d695ca2930ed25a2be9f8ced96d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46682","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46682.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46678","title":"bonding: change ipsec_lock from spin lock to mutex","status":"unfixed","project":false,"upstream":[{"sha":"2aeeef906d5a526dc60cf4af92eda69836c39b1f","url":"https://git.kernel.org/stable/c/2aeeef906d5a526dc60cf4af92eda69836c39b1f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2aeeef906d5a526dc60cf4af92eda69836c39b1f","lines":199,"reason":"","source":"https://github.com/torvalds/linux/commit/2aeeef906d5a526dc60cf4af92eda69836c39b1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46678","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46678.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-45015","title":"drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()","status":"unfixed","project":false,"upstream":[{"sha":"aedf02e46eb549dac8db4821a6b9f0c6bf6e3990","url":"https://git.kernel.org/stable/c/aedf02e46eb549dac8db4821a6b9f0c6bf6e3990"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aedf02e46eb549dac8db4821a6b9f0c6bf6e3990","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/aedf02e46eb549dac8db4821a6b9f0c6bf6e3990.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-45015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-45015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43901","title":"drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401","status":"not-applicable","project":false,"upstream":[{"sha":"5af757124792817f8eb1bd0c80ad60fab519586b","url":"https://git.kernel.org/stable/c/5af757124792817f8eb1bd0c80ad60fab519586b"}],"evidence":[],"submission_lore":[],"basis":"The DCN401 color-state logging path fixed upstream is absent from both targets.","review":{"id":"CVE-2024-43901","series":"6.1.y","upstream":["5af757124792817f8eb1bd0c80ad60fab519586b"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The DCN401 color-state logging path fixed upstream is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"5af757124792817f8eb1bd0c80ad60fab519586b","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/5af757124792817f8eb1bd0c80ad60fab519586b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43899","title":"drm/amd/display: Fix null pointer deref in dcn20_resource.c","status":"queued","project":false,"upstream":[{"sha":"ecbf60782662f0a388493685b85a645a0ba1613c","url":"https://git.kernel.org/stable/c/ecbf60782662f0a388493685b85a645a0ba1613c"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-fix-null-pointer-deref-in-dcn20_reso.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"dcn20_get_dcc_compression_cap() still calls the hubbub callback without checking whether that function pointer exists.","review":{"id":"CVE-2024-43899","series":"6.1.y","upstream":["ecbf60782662f0a388493685b85a645a0ba1613c"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"dcn20_get_dcc_compression_cap() still calls the hubbub callback without checking whether that function pointer exists.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n2172"},{"label":"Upstream fix ecbf60782662","url":"https://git.kernel.org/stable/c/ecbf60782662f0a388493685b85a645a0ba1613c"}]},"size":{"status":"unknown","patches":[{"sha":"ecbf60782662f0a388493685b85a645a0ba1613c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43888","title":"mm: list_lru: fix UAF for memory cgroup","status":"not-applicable","project":false,"upstream":[{"sha":"5161b48712dcd08ec427c450399d4d1483e21dea","url":"https://git.kernel.org/stable/c/5161b48712dcd08ec427c450399d4d1483e21dea"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5161b48712dcd08ec427c450399d4d1483e21dea","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/5161b48712dcd08ec427c450399d4d1483e21dea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43888","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43888.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43872","title":"RDMA/hns: Fix soft lockup under heavy CEQE load","status":"queued","project":false,"upstream":[{"sha":"2fdf34038369c0a27811e7b4680662a14ada1d6b","url":"https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/rdma-hns-fix-soft-lockup-under-heavy-ceqe-load.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/20240710133705.896445-3-huangjunxian6@hisilicon.com"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2fdf34038369c0a27811e7b4680662a14ada1d6b","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/2fdf34038369c0a27811e7b4680662a14ada1d6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43824","title":"PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()","status":"queued","project":false,"upstream":[{"sha":"5a5095a8bd1bd349cce1c879e5e44407a34dda8a","url":"https://git.kernel.org/stable/c/5a5095a8bd1bd349cce1c879e5e44407a34dda8a"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/pci-endpoint-pci-epf-test-make-use-of-cached-epc_fea.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/linux-pci/024b5826-7180-4076-ae08-57d2584cca3f@moroto.mountain","https://lore.kernel.org/linux-pci/20240418-pci-epf-test-fix-v2-1-eacd54831444@linaro.org"]}],"submission_lore":[],"basis":"The upstream changelog identifies a false-positive warning and states that the alleged NULL dereference is impossible.","review":{"id":"CVE-2024-43824","series":"6.1.y","upstream":["5a5095a8bd1bd349cce1c879e5e44407a34dda8a"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"no-op","applicability":"unaffected","reason":"The upstream changelog identifies a false-positive warning and states that the alleged NULL dereference is impossible.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"5a5095a8bd1bd349cce1c879e5e44407a34dda8a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43824","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43824.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43819","title":"kvm: s390: Reject memory region operations for ucontrol VMs","status":"queued","project":true,"upstream":[{"sha":"7816e58967d0e6cadce05c8540b47ed027dc2499","url":"https://git.kernel.org/stable/c/7816e58967d0e6cadce05c8540b47ed027dc2499"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/kvm-s390-reject-memory-region-operations-for-ucontro.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/20240624095902.29375-1-schlameuss@linux.ibm.com"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"7816e58967d0e6cadce05c8540b47ed027dc2499","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43819","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43819.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42317","title":"mm/huge_memory: avoid PMD-size page cache if needed","status":"unfixed","project":false,"upstream":[{"sha":"d659b715e94ac039803d7601505d3473393fc0be","url":"https://git.kernel.org/stable/c/d659b715e94ac039803d7601505d3473393fc0be"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d659b715e94ac039803d7601505d3473393fc0be","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/d659b715e94ac039803d7601505d3473393fc0be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42239","title":"bpf: Fail bpf_timer_cancel when callback is being cancelled","status":"queued","project":true,"upstream":[{"sha":"d4523831f07a267a943f0dde844bf8ead7495f13","url":"https://git.kernel.org/stable/c/d4523831f07a267a943f0dde844bf8ead7495f13"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/bpf-fail-bpf_timer_cancel-when-callback-is-being-can.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/20240709185440.1104957-2-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"d4523831f07a267a943f0dde844bf8ead7495f13","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42239","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42239.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42162","title":"gve: Account for stopped queues when reading NIC stats","status":"unfixed","project":false,"upstream":[{"sha":"af9bcf910b1f86244f39e15e701b2dc564b469a6","url":"https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"af9bcf910b1f86244f39e15e701b2dc564b469a6","lines":107,"reason":"","source":"https://github.com/torvalds/linux/commit/af9bcf910b1f86244f39e15e701b2dc564b469a6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42162","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42162.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42158","title":"s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings","status":"queued","project":false,"upstream":[{"sha":"22e6824622e8a8889df0f8fc4ed5aea0e702a694","url":"https://git.kernel.org/stable/c/22e6824622e8a8889df0f8fc4ed5aea0e702a694"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/s390-pkey-use-kfree_sensitive-to-fix-coccinelle-warn.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/ZjqZkNi_JUJu73Rg@octinomon.home"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"22e6824622e8a8889df0f8fc4ed5aea0e702a694","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/22e6824622e8a8889df0f8fc4ed5aea0e702a694.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42158","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42158.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42123","title":"drm/amdgpu: fix double free err_addr pointer warnings","status":"queued","project":false,"upstream":[{"sha":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","url":"https://git.kernel.org/stable/c/506c245f3f1cd989cb89811a7f06e04ff8813a0d"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amdgpu-fix-double-free-err_addr-pointer-warnings.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The repeated UMC polling loop affected upstream is absent from these targets, so clearing the pointer has no observable effect.","review":{"id":"CVE-2024-42123","series":"6.1.y","upstream":["506c245f3f1cd989cb89811a7f06e04ff8813a0d"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The repeated UMC polling loop affected upstream is absent from these targets, so clearing the pointer has no observable effect.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42118","title":"drm/amd/display: Do not return negative stream id for array","status":"not-applicable","project":false,"upstream":[{"sha":"3ac31c9a707dd1c7c890b95333182f955e9dcb57","url":"https://git.kernel.org/stable/c/3ac31c9a707dd1c7c890b95333182f955e9dcb57"}],"evidence":[],"submission_lore":[],"basis":"The resource_stream_to_stream_idx() consumer and topology logger are absent from both targets.","review":{"id":"CVE-2024-42118","series":"6.1.y","upstream":["3ac31c9a707dd1c7c890b95333182f955e9dcb57"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The resource_stream_to_stream_idx() consumer and topology logger are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"3ac31c9a707dd1c7c890b95333182f955e9dcb57","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/3ac31c9a707dd1c7c890b95333182f955e9dcb57.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41932","title":"sched: fix warning in sched_setaffinity","status":"not-applicable","project":false,"upstream":[{"sha":"70ee7947a29029736a1a06c73a48ff37674a851b","url":"https://git.kernel.org/stable/c/70ee7947a29029736a1a06c73a48ff37674a851b"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"70ee7947a29029736a1a06c73a48ff37674a851b","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/70ee7947a29029736a1a06c73a48ff37674a851b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41085","title":"cxl/mem: Fix no cxl_nvd during pmem region auto-assembling","status":"not-applicable","project":false,"upstream":[{"sha":"84ec985944ef34a34a1605b93ce401aa8737af96","url":"https://git.kernel.org/stable/c/84ec985944ef34a34a1605b93ce401aa8737af96"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"84ec985944ef34a34a1605b93ce401aa8737af96","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41082","title":"nvme-fabrics: use reserved tag for reg read/write command","status":"queued","project":true,"upstream":[{"sha":"7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa","url":"https://git.kernel.org/stable/c/7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/nvme-fabrics-use-reserved-tag-for-reg-read-write-com.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41082","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41082.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41045","title":"bpf: Defer work in bpf_timer_cancel_and_free","status":"queued","project":true,"upstream":[{"sha":"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69","url":"https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/bpf-defer-work-in-bpf_timer_cancel_and_free.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/20240709185440.1104957-3-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41045","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41045.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41023","title":"sched/deadline: Fix task_struct reference leak","status":"queued","project":false,"upstream":[{"sha":"b58652db66c910c2245f5bee7deca41c12d707b9","url":"https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/sched-deadline-fix-task_struct-reference-leak.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/20240620125618.11419-1-wander@redhat.com"]}],"submission_lore":[],"basis":"The leaking path is part of dl_server support, which is absent from both target scheduler trees. Backporting the isolated put_task_struct change would have no call site; importing dl_server is out of this small-fix tranche.","review":{"id":"CVE-2024-41023","series":"6.1.y","upstream":["b58652db66c910c2245f5bee7deca41c12d707b9"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The leaking path is part of dl_server support, which is absent from both target scheduler trees. Backporting the isolated put_task_struct change would have no call site; importing dl_server is out of this small-fix tranche.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"b58652db66c910c2245f5bee7deca41c12d707b9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41023","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41023.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40999","title":"net: ena: Add validation for completion descriptors consistency","status":"queued","project":true,"upstream":[{"sha":"b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7","url":"https://git.kernel.org/stable/c/b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/net-ena-add-validation-for-completion-descriptors-co.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/20240512134637.25299-4-darinzon@amazon.com"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40979","title":"wifi: ath12k: fix kernel crash during resume","status":"not-applicable","project":false,"upstream":[{"sha":"303c017821d88ebad887814114d4e5966d320b28","url":"https://git.kernel.org/stable/c/303c017821d88ebad887814114d4e5966d320b28"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"303c017821d88ebad887814114d4e5966d320b28","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40979","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40979.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40975","title":"platform/x86: x86-android-tablets: Unregister devices in reverse order","status":"queued","project":false,"upstream":[{"sha":"3de0f2627ef849735f155c1818247f58404dddfe","url":"https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/platform-x86-x86-android-tablets-unregister-devices-.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/20240406125058.13624-1-hdegoede@redhat.com"]}],"submission_lore":[],"basis":"x86_android_tablet_cleanup unregisters platform/I2C/serdev children in unsafe forward order","review":{"id":"CVE-2024-40975","series":"6.1.y","upstream":["3de0f2627ef849735f155c1818247f58404dddfe"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"x86_android_tablet_cleanup unregisters platform/I2C/serdev children in unsafe forward order","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/platform/x86/x86-android-tablets.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/x86-android-tablets.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n1747"},{"label":"Upstream fix 3de0f2627ef8","url":"https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe"}]},"size":{"status":"unknown","patches":[{"sha":"3de0f2627ef849735f155c1818247f58404dddfe","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40969","title":"f2fs: don't set RO when shutting down f2fs","status":"unfixed","project":false,"upstream":[{"sha":"3bdb7f161697e2d5123b89fe1778ef17a44858e7","url":"https://git.kernel.org/stable/c/3bdb7f161697e2d5123b89fe1778ef17a44858e7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3bdb7f161697e2d5123b89fe1778ef17a44858e7","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/3bdb7f161697e2d5123b89fe1778ef17a44858e7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40969","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40969.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40965","title":"i2c: lpi2c: Avoid calling clk_get_rate during transfer","status":"unfixed","project":false,"upstream":[{"sha":"4268254a39484fc11ba991ae148bacbe75d9cc0a","url":"https://git.kernel.org/stable/c/4268254a39484fc11ba991ae148bacbe75d9cc0a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4268254a39484fc11ba991ae148bacbe75d9cc0a","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/4268254a39484fc11ba991ae148bacbe75d9cc0a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40965","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40965.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40918","title":"parisc: Try to fix random segmentation faults in package builds","status":"unfixed","project":false,"upstream":[{"sha":"72d95924ee35c8cd16ef52f912483ee938a34d49","url":"https://git.kernel.org/stable/c/72d95924ee35c8cd16ef52f912483ee938a34d49"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"72d95924ee35c8cd16ef52f912483ee938a34d49","lines":655,"reason":"","source":"https://github.com/torvalds/linux/commit/72d95924ee35c8cd16ef52f912483ee938a34d49.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-39508","title":"io_uring/io-wq: Use set_bit() and test_bit() at worker->flags","status":"unfixed","project":false,"upstream":[{"sha":"8a565304927fbd28c9f028c492b5c1714002cbab","url":"https://git.kernel.org/stable/c/8a565304927fbd28c9f028c492b5c1714002cbab"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8a565304927fbd28c9f028c492b5c1714002cbab","lines":137,"reason":"","source":"https://github.com/torvalds/linux/commit/8a565304927fbd28c9f028c492b5c1714002cbab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-39508","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-39508.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-39478","title":"crypto: starfive - Do not free stack buffer","status":"not-applicable","project":false,"upstream":[{"sha":"d7f01649f4eaf1878472d3d3f480ae1e50d98f6c","url":"https://git.kernel.org/stable/c/d7f01649f4eaf1878472d3d3f480ae1e50d98f6c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"d7f01649f4eaf1878472d3d3f480ae1e50d98f6c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-39478","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-39478.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-38608","title":"net/mlx5e: Fix netif state handling","status":"queued","project":true,"upstream":[{"sha":"3d5918477f94e4c2f064567875c475468e264644","url":"https://git.kernel.org/stable/c/3d5918477f94e4c2f064567875c475468e264644"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/net-mlx5e-fix-netif-state-handling.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/20240509112951.590184-2-tariqt@nvidia.com"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"3d5918477f94e4c2f064567875c475468e264644","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-38608","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-38608.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-38595","title":"net/mlx5: Fix peer devlink set for SF representor devlink port","status":"not-applicable","project":false,"upstream":[{"sha":"3c453e8cc672de1f9c662948dba43176bc68d7f0","url":"https://git.kernel.org/stable/c/3c453e8cc672de1f9c662948dba43176bc68d7f0"}],"evidence":[],"submission_lore":[],"basis":"The older SF probe does not contain the peer-devlink assignment-after-registration flow fixed upstream.","review":{"id":"CVE-2024-38595","series":"6.1.y","upstream":["3c453e8cc672de1f9c662948dba43176bc68d7f0"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The older SF probe does not contain the peer-devlink assignment-after-registration flow fixed upstream.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"3c453e8cc672de1f9c662948dba43176bc68d7f0","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/3c453e8cc672de1f9c662948dba43176bc68d7f0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-38595","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-38595.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36951","title":"drm/amdkfd: range check cp bad op exception interrupts","status":"unfixed","project":false,"upstream":[{"sha":"0cac183b98d8a8c692c98e8dba37df15a9e9210d","url":"https://git.kernel.org/stable/c/0cac183b98d8a8c692c98e8dba37df15a9e9210d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0cac183b98d8a8c692c98e8dba37df15a9e9210d","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/0cac183b98d8a8c692c98e8dba37df15a9e9210d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36951","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36951.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36949","title":"amd/amdkfd: sync all devices to wait all processes being evicted","status":"unfixed","project":false,"upstream":[{"sha":"d06af584be5a769d124b7302b32a033e9559761d","url":"https://git.kernel.org/stable/c/d06af584be5a769d124b7302b32a033e9559761d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d06af584be5a769d124b7302b32a033e9559761d","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/d06af584be5a769d124b7302b32a033e9559761d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36024","title":"drm/amd/display: Disable idle reallow as part of command/gpint execution","status":"not-applicable","project":false,"upstream":[{"sha":"6226a5aa77370329e01ee8abe50a95e60618ce97","url":"https://git.kernel.org/stable/c/6226a5aa77370329e01ee8abe50a95e60618ce97"}],"evidence":[],"submission_lore":[],"basis":"The DCN35 wake, execute, and idle-reallow paths fixed upstream are absent from both targets.","review":{"id":"CVE-2024-36024","series":"6.1.y","upstream":["6226a5aa77370329e01ee8abe50a95e60618ce97"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The DCN35 wake, execute, and idle-reallow paths fixed upstream are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"6226a5aa77370329e01ee8abe50a95e60618ce97","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/6226a5aa77370329e01ee8abe50a95e60618ce97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36024","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36024.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35961","title":"net/mlx5: Register devlink first under devlink lock","status":"unfixed","project":false,"upstream":[{"sha":"c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8","url":"https://git.kernel.org/stable/c/c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8","lines":106,"reason":"","source":"https://github.com/torvalds/linux/commit/c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35942","title":"pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain","status":"queued","project":false,"upstream":[{"sha":"697624ee8ad557ab5417f985d2c804241a7ad30d","url":"https://git.kernel.org/stable/c/697624ee8ad557ab5417f985d2c804241a7ad30d"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/pmdomain-imx8mp-blk-ctrl-imx8mp_blk-add-fdcc-clock-t.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/r/20240203165307.7806-5-aford173@gmail.com"]}],"submission_lore":[],"basis":"LCDIF/HDMI_TX power domains: only two clocks, no FDCC clock","review":{"id":"CVE-2024-35942","series":"6.1.y","upstream":["697624ee8ad557ab5417f985d2c804241a7ad30d"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"LCDIF/HDMI_TX power domains: only two clocks, no FDCC clock","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/soc/imx/imx8mp-blk-ctrl.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/soc/imx/imx8mp-blk-ctrl.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 697624ee8ad5","url":"https://git.kernel.org/stable/c/697624ee8ad557ab5417f985d2c804241a7ad30d"}]},"size":{"status":"unknown","patches":[{"sha":"697624ee8ad557ab5417f985d2c804241a7ad30d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35942","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35942.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35931","title":"drm/amdgpu: Skip do PCI error slot reset during RAS recovery","status":"unfixed","project":false,"upstream":[{"sha":"601429cca96b4af3be44172c3b64e4228515dbe1","url":"https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"601429cca96b4af3be44172c3b64e4228515dbe1","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/601429cca96b4af3be44172c3b64e4228515dbe1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35931","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35931.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35887","title":"ax25: fix use-after-free bugs caused by ax25_ds_del_timer","status":"backported","project":true,"upstream":[{"sha":"fd819ad3ecf6f3c232a06b27423ce9ed8c20da89","url":"https://git.kernel.org/stable/c/fd819ad3ecf6f3c232a06b27423ce9ed8c20da89"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8a912ef5b7c5d14fb41b9a7935d1df5bb87058bf","label":"8a912ef5b7c5","date":"2026-09-14T13:24:33+02:00","lore":["https://lore.kernel.org/r/20240329015023.9223-1-duoming@zju.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fd819ad3ecf6f3c232a06b27423ce9ed8c20da89","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35887","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35887.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35843","title":"iommu/vt-d: Use device rbtree in iopf reporting path","status":"not-applicable","project":false,"upstream":[{"sha":"def054b01a867822254e1dda13d587f5c7a99e2a","url":"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"}],"evidence":[],"submission_lore":[],"basis":"The targets use a referenced pci_dev lookup and release it with pci_dev_put; the later raw-rbtree UAF path is absent.","review":{"id":"CVE-2024-35843","series":"6.1.y","upstream":["def054b01a867822254e1dda13d587f5c7a99e2a"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The targets use a referenced pci_dev lookup and release it with pci_dev_put; the later raw-rbtree UAF path is absent.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"def054b01a867822254e1dda13d587f5c7a99e2a","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/def054b01a867822254e1dda13d587f5c7a99e2a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35843","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35843.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35808","title":"md/dm-raid: don't call md_reap_sync_thread() directly","status":"not-applicable","project":false,"upstream":[{"sha":"cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","url":"https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0"}],"evidence":[],"submission_lore":[],"basis":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","review":{"id":"CVE-2024-35808","series":"6.1.y","upstream":["cd32b27a66db8776d8b8e82ec7d7dde97a8693b0"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35799","title":"drm/amd/display: Prevent crash when disable stream","status":"queued","project":false,"upstream":[{"sha":"72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c","url":"https://git.kernel.org/stable/c/72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-prevent-crash-when-disable-stream.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The target dce110_disable_stream() implementation contains no set_dtbclk_dto callback call, so the nullable callback path fixed upstream is absent.","review":{"id":"CVE-2024-35799","series":"6.1.y","upstream":["72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The target dce110_disable_stream() implementation contains no set_dtbclk_dto callback call, so the nullable callback path fixed upstream is absent.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 72d72e8fddbc","url":"https://git.kernel.org/stable/c/72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c"}]},"size":{"status":"unknown","patches":[{"sha":"72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35794","title":"dm-raid: really frozen sync_thread during suspend","status":"not-applicable","project":false,"upstream":[{"sha":"16c4770c75b1223998adbeb7286f9a15c65fba73","url":"https://git.kernel.org/stable/c/16c4770c75b1223998adbeb7286f9a15c65fba73"}],"evidence":[],"submission_lore":[],"basis":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","review":{"id":"CVE-2024-35794","series":"6.1.y","upstream":["16c4770c75b1223998adbeb7286f9a15c65fba73"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"16c4770c75b1223998adbeb7286f9a15c65fba73","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/16c4770c75b1223998adbeb7286f9a15c65fba73.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35794","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35794.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27079","title":"iommu/vt-d: Fix NULL domain on device release","status":"unfixed","project":false,"upstream":[{"sha":"81e921fd321614c2ad8ac333b041aae1da7a1c6d","url":"https://git.kernel.org/stable/c/81e921fd321614c2ad8ac333b041aae1da7a1c6d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"81e921fd321614c2ad8ac333b041aae1da7a1c6d","lines":121,"reason":"","source":"https://github.com/torvalds/linux/commit/81e921fd321614c2ad8ac333b041aae1da7a1c6d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27012","title":"netfilter: nf_tables: restore set elements when delete set fails","status":"backported","project":false,"upstream":[{"sha":"e79b47a8615d42c68aaeb68971593333667382ed","url":"https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed"}],"evidence":[{"url":"https://git.kernel.org/stable/c/faa0deee272128b95a838fe7c6ebf6a2a426df14","label":"faa0deee2721","date":"2026-06-19T13:37:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"over-limit","patches":[{"sha":"e79b47a8615d42c68aaeb68971593333667382ed","lines":201,"reason":"","source":"https://github.com/torvalds/linux/commit/e79b47a8615d42c68aaeb68971593333667382ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27012","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27012.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27010","title":"net/sched: Fix mirred deadlock on device recursion","status":"queued","project":false,"upstream":[{"sha":"0f022d32c3eca477fbf79a205243a6123ed0fe11","url":"https://git.kernel.org/stable/c/0f022d32c3eca477fbf79a205243a6123ed0fe11"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/net-sched-fix-mirred-deadlock-on-device-recursion.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/netdev/20240314111713.5979-1-renmingshuai@huawei.com/","https://lore.kernel.org/r/20240415210728.36949-1-victor@mojatatu.com"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"0f022d32c3eca477fbf79a205243a6123ed0fe11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26962","title":"dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape","status":"unfixed","project":false,"upstream":[{"sha":"41425f96d7aa59bc865f60f5dda3d7697b555677","url":"https://git.kernel.org/stable/c/41425f96d7aa59bc865f60f5dda3d7697b555677"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"41425f96d7aa59bc865f60f5dda3d7697b555677","lines":217,"reason":"","source":"https://github.com/torvalds/linux/commit/41425f96d7aa59bc865f60f5dda3d7697b555677.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26962","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26962.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26948","title":"drm/amd/display: Add a dc_state NULL check in dc_state_release","status":"queued","project":false,"upstream":[{"sha":"334b56cea5d9df5989be6cf1a5898114fa70ad98","url":"https://git.kernel.org/stable/c/334b56cea5d9df5989be6cf1a5898114fa70ad98"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-add-a-dc_state-null-check-in-dc_stat.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"The renamed dc_release_state() wrapper unconditionally dereferences context->refcount in kref_put() and lacks the NULL guard added to its upstream equivalent.","review":{"id":"CVE-2024-26948","series":"6.1.y","upstream":["334b56cea5d9df5989be6cf1a5898114fa70ad98"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"The renamed dc_release_state() wrapper unconditionally dereferences context->refcount in kref_put() and lacks the NULL guard added to its upstream equivalent.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/core/dc.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/core/dc.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n2284"},{"label":"Upstream fix 334b56cea5d9","url":"https://git.kernel.org/stable/c/334b56cea5d9df5989be6cf1a5898114fa70ad98"}]},"size":{"status":"unknown","patches":[{"sha":"334b56cea5d9df5989be6cf1a5898114fa70ad98","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26948","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26948.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26944","title":"btrfs: zoned: fix use-after-free in do_zone_finish()","status":"unfixed","project":false,"upstream":[{"sha":"1ec17ef59168a1a6f1105f5dc517f783839a5302","url":"https://git.kernel.org/stable/c/1ec17ef59168a1a6f1105f5dc517f783839a5302"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1ec17ef59168a1a6f1105f5dc517f783839a5302","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/1ec17ef59168a1a6f1105f5dc517f783839a5302.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26914","title":"drm/amd/display: fix incorrect mpc_combine array size","status":"not-applicable","project":false,"upstream":[{"sha":"39079fe8e660851abbafa90cd55cbf029210661f","url":"https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"}],"evidence":[],"submission_lore":[],"basis":"The pipe_slice_table and mpc_combines array fixed upstream are absent from both targets.","review":{"id":"CVE-2024-26914","series":"6.1.y","upstream":["39079fe8e660851abbafa90cd55cbf029210661f"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The pipe_slice_table and mpc_combines array fixed upstream are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"39079fe8e660851abbafa90cd55cbf029210661f","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/39079fe8e660851abbafa90cd55cbf029210661f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26913","title":"drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue","status":"not-applicable","project":false,"upstream":[{"sha":"faf51b201bc42adf500945732abb6220c707d6f3","url":"https://git.kernel.org/stable/c/faf51b201bc42adf500945732abb6220c707d6f3"}],"evidence":[],"submission_lore":[],"basis":"The DML2/DCN35 translation path is absent from both targets.","review":{"id":"CVE-2024-26913","series":"6.1.y","upstream":["faf51b201bc42adf500945732abb6220c707d6f3"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The DML2/DCN35 translation path is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"faf51b201bc42adf500945732abb6220c707d6f3","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/faf51b201bc42adf500945732abb6220c707d6f3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26913","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26913.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26836","title":"platform/x86: think-lmi: Fix password opcode ordering for workstations","status":"unfixed","project":false,"upstream":[{"sha":"6f7d0f5fd8e440c3446560100ac4ff9a55eec340","url":"https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f7d0f5fd8e440c3446560100ac4ff9a55eec340","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/6f7d0f5fd8e440c3446560100ac4ff9a55eec340.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26836","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26836.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26768","title":"LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]","status":"unfixed","project":false,"upstream":[{"sha":"4551b30525cf3d2f026b92401ffe241eb04dfebe","url":"https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4551b30525cf3d2f026b92401ffe241eb04dfebe","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/4551b30525cf3d2f026b92401ffe241eb04dfebe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26758","title":"md: Don't ignore suspended array in md_check_recovery()","status":"not-applicable","project":false,"upstream":[{"sha":"1baae052cccd08daf9a9d64c3f959d8cdb689757","url":"https://git.kernel.org/stable/c/1baae052cccd08daf9a9d64c3f959d8cdb689757"}],"evidence":[],"submission_lore":[],"basis":"The upstream change is for v6.7+ and fixes the f52f5c71 recovery flow, which is absent from both targets.","review":{"id":"CVE-2024-26758","series":"6.1.y","upstream":["1baae052cccd08daf9a9d64c3f959d8cdb689757"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The upstream change is for v6.7+ and fixes the f52f5c71 recovery flow, which is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"1baae052cccd08daf9a9d64c3f959d8cdb689757","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/1baae052cccd08daf9a9d64c3f959d8cdb689757.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26758","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26758.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26757","title":"md: Don't ignore read-only array in md_check_recovery()","status":"not-applicable","project":false,"upstream":[{"sha":"55a48ad2db64737f7ffc0407634218cc6e4c513b","url":"https://git.kernel.org/stable/c/55a48ad2db64737f7ffc0407634218cc6e4c513b"}],"evidence":[],"submission_lore":[],"basis":"The upstream change is for v6.7+ and fixes the f52f5c71 recovery flow, which is absent from both targets.","review":{"id":"CVE-2024-26757","series":"6.1.y","upstream":["55a48ad2db64737f7ffc0407634218cc6e4c513b"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The upstream change is for v6.7+ and fixes the f52f5c71 recovery flow, which is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"55a48ad2db64737f7ffc0407634218cc6e4c513b","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/55a48ad2db64737f7ffc0407634218cc6e4c513b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26757","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26757.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26756","title":"md: Don't register sync_thread for reshape directly","status":"not-applicable","project":false,"upstream":[{"sha":"ad39c08186f8a0f221337985036ba86731d6aafe","url":"https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe"}],"evidence":[],"submission_lore":[],"basis":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","review":{"id":"CVE-2024-26756","series":"6.1.y","upstream":["ad39c08186f8a0f221337985036ba86731d6aafe"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"ad39c08186f8a0f221337985036ba86731d6aafe","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/ad39c08186f8a0f221337985036ba86731d6aafe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26756","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26756.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26691","title":"KVM: arm64: Fix circular locking dependency","status":"unfixed","project":false,"upstream":[{"sha":"10c02aad111df02088d1a81792a709f6a7eca6cc","url":"https://git.kernel.org/stable/c/10c02aad111df02088d1a81792a709f6a7eca6cc"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"10c02aad111df02088d1a81792a709f6a7eca6cc","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/10c02aad111df02088d1a81792a709f6a7eca6cc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26691","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26691.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26672","title":"drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'","status":"not-applicable","project":false,"upstream":[{"sha":"4f32504a2f85a7b40fe149436881381f48e9c0c0","url":"https://git.kernel.org/stable/c/4f32504a2f85a7b40fe149436881381f48e9c0c0"}],"evidence":[],"submission_lore":[],"basis":"The amdgpu_mca_smu_get_mca_entry() path and its mca_funcs getter are absent from both targets.","review":{"id":"CVE-2024-26672","series":"6.1.y","upstream":["4f32504a2f85a7b40fe149436881381f48e9c0c0"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"The amdgpu_mca_smu_get_mca_entry() path and its mca_funcs getter are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"4f32504a2f85a7b40fe149436881381f48e9c0c0","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/4f32504a2f85a7b40fe149436881381f48e9c0c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26672","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26672.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26662","title":"drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'","status":"queued","project":false,"upstream":[{"sha":"e96fddb32931d007db12b1fce9b5e8e4c080401b","url":"https://git.kernel.org/stable/c/e96fddb32931d007db12b1fce9b5e8e4c080401b"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-fix-panel_cntl-could-be-null-in-dcn2.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"dcn21_set_backlight_level() uses the timing-generator and panel-control pointers without NULL guards.","review":{"id":"CVE-2024-26662","series":"6.1.y","upstream":["e96fddb32931d007db12b1fce9b5e8e4c080401b"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"dcn21_set_backlight_level() uses the timing-generator and panel-control pointers without NULL guards.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n198"},{"label":"Upstream fix e96fddb32931","url":"https://git.kernel.org/stable/c/e96fddb32931d007db12b1fce9b5e8e4c080401b"}]},"size":{"status":"unknown","patches":[{"sha":"e96fddb32931d007db12b1fce9b5e8e4c080401b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26662","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26662.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26661","title":"drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'","status":"unfixed","project":false,"upstream":[{"sha":"66951d98d9bf45ba25acf37fe0747253fafdf298","url":"https://git.kernel.org/stable/c/66951d98d9bf45ba25acf37fe0747253fafdf298"},{"sha":"17ba9cde11c2bfebbd70867b0a2ac4a22e573379","url":"https://git.kernel.org/stable/c/17ba9cde11c2bfebbd70867b0a2ac4a22e573379"}],"evidence":[],"submission_lore":[],"basis":"dcn21_set_pipe() still dereferences tg->inst without the required timing-generator NULL guard.","review":{"id":"CVE-2024-26661","series":"6.1.y","upstream":["66951d98d9bf45ba25acf37fe0747253fafdf298","17ba9cde11c2bfebbd70867b0a2ac4a22e573379"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"dcn21_set_pipe() still dereferences tg->inst without the required timing-generator NULL guard.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n182"},{"label":"Upstream fix 17ba9cde11c2","url":"https://git.kernel.org/stable/c/17ba9cde11c2bfebbd70867b0a2ac4a22e573379"},{"label":"Upstream fix 66951d98d9bf","url":"https://git.kernel.org/stable/c/66951d98d9bf45ba25acf37fe0747253fafdf298"}]},"size":{"status":"within-limit","patches":[{"sha":"66951d98d9bf45ba25acf37fe0747253fafdf298","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/66951d98d9bf45ba25acf37fe0747253fafdf298.patch"},{"sha":"17ba9cde11c2bfebbd70867b0a2ac4a22e573379","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/17ba9cde11c2bfebbd70867b0a2ac4a22e573379.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54280","title":"cifs: fix potential race when tree connecting ipc","status":"unfixed","project":false,"upstream":[{"sha":"ee20d7c6100752eaf2409d783f4f1449c29ea33d","url":"https://git.kernel.org/stable/c/ee20d7c6100752eaf2409d783f4f1449c29ea33d"}],"evidence":[],"submission_lore":[],"basis":"The older CIFS DFS IPC tree-connect path in connect.c still reads server->hostname without the synchronization and status handling added by the fix.","review":{"id":"CVE-2023-54280","series":"6.1.y","upstream":["ee20d7c6100752eaf2409d783f4f1449c29ea33d"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"The older CIFS DFS IPC tree-connect path in connect.c still reads server->hostname without the synchronization and status handling added by the fix.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/smb/client/connect.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/smb/client/connect.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n4699"},{"label":"Upstream fix ee20d7c61007","url":"https://git.kernel.org/stable/c/ee20d7c6100752eaf2409d783f4f1449c29ea33d"}]},"size":{"status":"within-limit","patches":[{"sha":"ee20d7c6100752eaf2409d783f4f1449c29ea33d","lines":81,"reason":"","source":"https://github.com/torvalds/linux/commit/ee20d7c6100752eaf2409d783f4f1449c29ea33d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54280","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54280.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54263","title":"drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP","status":"backported","project":true,"upstream":[{"sha":"ea293f823a8805735d9e00124df81a8f448ed1ae","url":"https://git.kernel.org/stable/c/ea293f823a8805735d9e00124df81a8f448ed1ae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a63fa556ac5772d004025c1164b7bd5a8b95eaef","label":"a63fa556ac57","date":"2026-09-02T14:28:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ea293f823a8805735d9e00124df81a8f448ed1ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54263","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54263.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54233","title":"ASoC: SOF: avoid a NULL dereference with unsupported widgets","status":"backported","project":true,"upstream":[{"sha":"e3720f92e0237921da537e47a0b24e27899203f8","url":"https://git.kernel.org/stable/c/e3720f92e0237921da537e47a0b24e27899203f8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d42fe2721111138d7656d4f621f38c171979c8a0","label":"d42fe2721111","date":"2026-10-03T12:28:42+02:00","lore":["https://lore.kernel.org/r/20230329113828.28562-1-peter.ujfalusi@linux.intel.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e3720f92e0237921da537e47a0b24e27899203f8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54233","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54233.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54227","title":"blk-mq: fix tags leak when shrink nr_hw_queues","status":"backported","project":true,"upstream":[{"sha":"e1dd7bc93029024af5688253b0c05181d6e01f8e","url":"https://git.kernel.org/stable/c/e1dd7bc93029024af5688253b0c05181d6e01f8e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/26d495f0f64d8cd4fcd29206ee5c653ee0e0cbcd","label":"26d495f0f64d","date":"2026-10-03T12:28:42+02:00","lore":["https://lore.kernel.org/r/20230821095602.70742-1-chengming.zhou@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e1dd7bc93029024af5688253b0c05181d6e01f8e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54227","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54227.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54141","title":"wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018","status":"backported","project":true,"upstream":[{"sha":"ce282d8de71f07f0056ea319541141152c65f552","url":"https://git.kernel.org/stable/c/ce282d8de71f07f0056ea319541141152c65f552"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d49d420e4833fdf6d7c506de23884a0cb9b08e0a","label":"d49d420e4833","date":"2026-09-02T14:28:31+02:00","lore":["https://lore.kernel.org/r/TYZPR01MB5556D6E3F63EAB5129D11420C953A@TYZPR01MB5556.apcprd01.prod.exchangelabs.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"ce282d8de71f07f0056ea319541141152c65f552","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54141","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54141.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54030","title":"io_uring/net: don't overflow multishot recv","status":"not-applicable","project":false,"upstream":[{"sha":"b2e74db55dd93d6db22a813c9a775b5dbf87c560","url":"https://git.kernel.org/stable/c/b2e74db55dd93d6db22a813c9a775b5dbf87c560"}],"evidence":[],"submission_lore":[],"basis":"The affected io_uring multishot receive path is absent in 6.1.y.","review":{"id":"CVE-2023-54030","series":"6.1.y","upstream":["b2e74db55dd93d6db22a813c9a775b5dbf87c560"],"checked_sha":null,"checked_version":"6.1.y (revision unrecorded)","kind":"not-applicable","applicability":"unaffected","reason":"The affected io_uring multishot receive path is absent in 6.1.y.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"b2e74db55dd93d6db22a813c9a775b5dbf87c560","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b2e74db55dd93d6db22a813c9a775b5dbf87c560.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54030","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54030.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53999","title":"net/mlx5e: TC, Fix internal port memory leak","status":"backported","project":true,"upstream":[{"sha":"ac5da544a3c2047cbfd715acd9cec8380d7fe5c6","url":"https://git.kernel.org/stable/c/ac5da544a3c2047cbfd715acd9cec8380d7fe5c6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9079ef5fb26ff38ced50cc15199ce56a009b8605","label":"9079ef5fb26f","date":"2026-10-03T12:28:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ac5da544a3c2047cbfd715acd9cec8380d7fe5c6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53857","title":"bpf: bpf_sk_storage: Fix invalid wait context lockdep report","status":"backported","project":true,"upstream":[{"sha":"a96a44aba556c42b432929d37d60158aca21ad4c","url":"https://git.kernel.org/stable/c/a96a44aba556c42b432929d37d60158aca21ad4c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/47cf3387de902e8f61f705b06cb2fc1315d26932","label":"47cf3387de90","date":"2026-10-03T12:28:43+02:00","lore":["https://lore.kernel.org/bpf/20230901231129.578493-2-martin.lau@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a96a44aba556c42b432929d37d60158aca21ad4c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53857","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53857.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53851","title":"drm/msm/dp: Drop aux devices together with DP controller","status":"backported","project":true,"upstream":[{"sha":"a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d","url":"https://git.kernel.org/stable/c/a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ff1338a3bfaa2f35b5f49a434f2ad6884b75fafe","label":"ff1338a3bfaa","date":"2026-10-03T12:28:43+02:00","lore":["https://lore.kernel.org/r/20230612220106.1884039-1-quic_bjorande@quicinc.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53851","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53851.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53762","title":"Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync","status":"backported","project":true,"upstream":[{"sha":"94d9ba9f9888b748d4abd2aa1547af56ae85f772","url":"https://git.kernel.org/stable/c/94d9ba9f9888b748d4abd2aa1547af56ae85f772"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5e3ee972f185eb7957ce789b3bf13a3cb790f178","label":"5e3ee972f185","date":"2026-10-03T12:28:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"94d9ba9f9888b748d4abd2aa1547af56ae85f772","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53627","title":"scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list","status":"backported","project":true,"upstream":[{"sha":"71fb36b5ff113a7674710b9d6063241eada84ff7","url":"https://git.kernel.org/stable/c/71fb36b5ff113a7674710b9d6063241eada84ff7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6fb177f10d87b8d816402c488e83506d0fb5340a","label":"6fb177f10d87","date":"2026-10-03T12:28:44+02:00","lore":["https://lore.kernel.org/r/1679283265-115066-2-git-send-email-chenxiang66@hisilicon.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"71fb36b5ff113a7674710b9d6063241eada84ff7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53627","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53627.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53574","title":"wifi: rtw88: delete timer and free skb queue when unloading","status":"backported","project":true,"upstream":[{"sha":"634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216","url":"https://git.kernel.org/stable/c/634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216"}],"evidence":[{"url":"https://git.kernel.org/stable/c/60ee0f6fea7ba5681ebf7d70b8ebe592227188a4","label":"60ee0f6fea7b","date":"2026-10-03T12:28:43+02:00","lore":["https://lore.kernel.org/r/20230628072327.167196-1-dmantipov@yandex.ru"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53574","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53574.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53538","title":"btrfs: insert tree mod log move in push_node_left","status":"backported","project":true,"upstream":[{"sha":"5cead5422a0e3d13b0bcee986c0f5c4ebb94100b","url":"https://git.kernel.org/stable/c/5cead5422a0e3d13b0bcee986c0f5c4ebb94100b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7e0ee4cb02e6b485103ecd125743b2818a68993d","label":"7e0ee4cb02e6","date":"2026-10-03T12:28:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5cead5422a0e3d13b0bcee986c0f5c4ebb94100b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53529","title":"wifi: rtw88: Fix memory leak in rtw88_usb","status":"not-applicable","project":false,"upstream":[{"sha":"59a3a312009723e3e5082899655fdcc420e2b47a","url":"https://git.kernel.org/stable/c/59a3a312009723e3e5082899655fdcc420e2b47a"}],"evidence":[],"submission_lore":[],"basis":"rtw88 USB interface teardown implementation is absent from this target; upstream fix only changes its deinit path.","review":{"id":"CVE-2023-53529","series":"6.1.y","upstream":["59a3a312009723e3e5082899655fdcc420e2b47a"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"rtw88 USB interface teardown implementation is absent from this target; upstream fix only changes its deinit path.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/net/wireless/realtek/rtw88/usb.c absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/realtek/rtw88?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 59a3a3120097","url":"https://git.kernel.org/stable/c/59a3a312009723e3e5082899655fdcc420e2b47a"}]},"size":{"status":"within-limit","patches":[{"sha":"59a3a312009723e3e5082899655fdcc420e2b47a","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/59a3a312009723e3e5082899655fdcc420e2b47a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53529","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53529.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53460","title":"wifi: rtw88: fix memory leak in rtw_usb_probe()","status":"not-applicable","project":false,"upstream":[{"sha":"48181d285623198c33bb9698992502687b258efa","url":"https://git.kernel.org/stable/c/48181d285623198c33bb9698992502687b258efa"}],"evidence":[],"submission_lore":[],"basis":"rtw88 USB probe implementation is absent from this target; upstream fix only changes rtw_usb_probe().","review":{"id":"CVE-2023-53460","series":"6.1.y","upstream":["48181d285623198c33bb9698992502687b258efa"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"rtw88 USB probe implementation is absent from this target; upstream fix only changes rtw_usb_probe().","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/net/wireless/realtek/rtw88/usb.c absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/realtek/rtw88?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 48181d285623","url":"https://git.kernel.org/stable/c/48181d285623198c33bb9698992502687b258efa"}]},"size":{"status":"within-limit","patches":[{"sha":"48181d285623198c33bb9698992502687b258efa","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/48181d285623198c33bb9698992502687b258efa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53460","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53460.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53429","title":"btrfs: don't check PageError in __extent_writepage","status":"backported","project":true,"upstream":[{"sha":"3e92499e3b004baffb479d61e191b41b604ece9a","url":"https://git.kernel.org/stable/c/3e92499e3b004baffb479d61e191b41b604ece9a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3c26023365a955d2d69355f5167508a963e44333","label":"3c26023365a9","date":"2026-10-03T12:28:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3e92499e3b004baffb479d61e191b41b604ece9a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53429","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53429.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53367","title":"accel/habanalabs: fix mem leak in capture user mappings","status":"not-applicable","project":false,"upstream":[{"sha":"314a7ffd7c196b27eedd50cb7553029e17789b55","url":"https://git.kernel.org/stable/c/314a7ffd7c196b27eedd50cb7553029e17789b55"}],"evidence":[],"submission_lore":[],"basis":"struct hl_error_info has only cs_timeout, razwi, undef_opcode; capture user_mappings state is absent","review":{"id":"CVE-2023-53367","series":"6.1.y","upstream":["314a7ffd7c196b27eedd50cb7553029e17789b55"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"not-applicable","applicability":"unaffected","reason":"struct hl_error_info has only cs_timeout, razwi, undef_opcode; capture user_mappings state is absent","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/misc/habanalabs/common/habanalabs.h","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/misc/habanalabs/common/habanalabs.h?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f"},{"label":"Upstream fix 314a7ffd7c19","url":"https://git.kernel.org/stable/c/314a7ffd7c196b27eedd50cb7553029e17789b55"}]},"size":{"status":"within-limit","patches":[{"sha":"314a7ffd7c196b27eedd50cb7553029e17789b55","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/314a7ffd7c196b27eedd50cb7553029e17789b55.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53367","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53367.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53353","title":"accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()","status":"backported","project":true,"upstream":[{"sha":"2e8e9a895c4589f124a37fc84d123b5114406e94","url":"https://git.kernel.org/stable/c/2e8e9a895c4589f124a37fc84d123b5114406e94"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c96cc6b46fdce89a8feb270a35bbe5086c142534","label":"c96cc6b46fdc","date":"2026-10-03T12:28:36+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2e8e9a895c4589f124a37fc84d123b5114406e94","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53353","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53353.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53336","title":"media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings","status":"backported","project":true,"upstream":[{"sha":"284be5693163343e1cf17c03917eecd1d6681bcf","url":"https://git.kernel.org/stable/c/284be5693163343e1cf17c03917eecd1d6681bcf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bca783c943cefea97c27f02fdd16bf414e8057df","label":"bca783c943ce","date":"2026-10-03T12:28:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"284be5693163343e1cf17c03917eecd1d6681bcf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53336","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53336.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53231","title":"erofs: Fix detection of atomic context","status":"backported","project":true,"upstream":[{"sha":"12d0a24afd9ea58e581ea64d64e066f2027b28d9","url":"https://git.kernel.org/stable/c/12d0a24afd9ea58e581ea64d64e066f2027b28d9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/96bcd9650e15901201d964eef5f79d18a81daac8","label":"96bcd9650e15","date":"2026-10-03T12:28:43+02:00","lore":["https://lore.kernel.org/all/20210317035448.13921-1-huangjianan@oppo.com/","https://lore.kernel.org/r/20230621220848.3379029-1-dhavale@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"12d0a24afd9ea58e581ea64d64e066f2027b28d9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53231","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53231.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53218","title":"rxrpc: Make it so that a waiting process can be aborted","status":"not-applicable","project":false,"upstream":[{"sha":"0eb362d254814ce04848730bf32e75b8ee1a4d6c","url":"https://git.kernel.org/stable/c/0eb362d254814ce04848730bf32e75b8ee1a4d6c"}],"evidence":[],"submission_lore":[],"basis":"The target terminally completes and disconnects an interrupted waiting call, so the stuck-EBUSY path is absent; the code delta would add unrelated concurrent-abort behavior without fixing this CVE.","review":{"id":"CVE-2023-53218","series":"6.1.y","upstream":["0eb362d254814ce04848730bf32e75b8ee1a4d6c"],"checked_sha":null,"checked_version":"6.1.y (revision unrecorded)","kind":"not-applicable","applicability":"unaffected","reason":"The target terminally completes and disconnects an interrupted waiting call, so the stuck-EBUSY path is absent; the code delta would add unrelated concurrent-abort behavior without fixing this CVE.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"0eb362d254814ce04848730bf32e75b8ee1a4d6c","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/0eb362d254814ce04848730bf32e75b8ee1a4d6c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53218","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53218.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52920","title":"bpf: support non-r10 register spill/fill to/from stack in precision tracking","status":"unfixed","project":false,"upstream":[{"sha":"41f6f64e6999a837048b1bd13a2f8742964eca6b","url":"https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"41f6f64e6999a837048b1bd13a2f8742964eca6b","lines":496,"reason":"","source":"https://github.com/torvalds/linux/commit/41f6f64e6999a837048b1bd13a2f8742964eca6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52888","title":"media: mediatek: vcodec: Only free buffer VA that is not NULL","status":"queued","project":false,"upstream":[{"sha":"eb005c801ec70ff4307727bd3bd6e8280169ef32","url":"https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/media-mediatek-vcodec-only-free-buffer-va-that-is-no.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"h264_enc_free_work_buf: unguarded frees of nullable work-buffer VAs; AV1 absence does not remove affected H.264 path","review":{"id":"CVE-2023-52888","series":"6.1.y","upstream":["eb005c801ec70ff4307727bd3bd6e8280169ef32"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"h264_enc_free_work_buf: unguarded frees of nullable work-buffer VAs; AV1 absence does not remove affected H.264 path","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/media/platform/mediatek/vcodec/venc/venc_h264_if.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/media/platform/mediatek/vcodec/venc/venc_h264_if.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n297"},{"label":"Upstream fix eb005c801ec7","url":"https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32"}]},"size":{"status":"unknown","patches":[{"sha":"eb005c801ec70ff4307727bd3bd6e8280169ef32","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52888","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52888.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52797","title":"drivers: perf: Check find_first_bit() return value","status":"unfixed","project":false,"upstream":[{"sha":"c6e316ac05532febb0c966fa9b55f5258ed037be","url":"https://git.kernel.org/stable/c/c6e316ac05532febb0c966fa9b55f5258ed037be"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6e316ac05532febb0c966fa9b55f5258ed037be","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/c6e316ac05532febb0c966fa9b55f5258ed037be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52676","title":"bpf: Guard stack limits against 32bit overflow","status":"backported","project":true,"upstream":[{"sha":"1d38a9ee81570c4bd61f557832dead4d6f816760","url":"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e160b2ed94a20fa940369ebd914277f88005e70d","label":"e160b2ed94a2","date":"2026-09-14T13:24:33+02:00","lore":["https://lore.kernel.org/bpf/20231207041150.229139-4-andreimatei1@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1d38a9ee81570c4bd61f557832dead4d6f816760","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52676","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52676.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52671","title":"drm/amd/display: Fix hang/underflow when transitioning to ODM4:1","status":"queued","project":false,"upstream":[{"sha":"e7b2b108cdeab76a7e7324459e50b0c1214c0386","url":"https://git.kernel.org/stable/c/e7b2b108cdeab76a7e7324459e50b0c1214c0386"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/drm-amd-display-fix-hang-underflow-when-transitionin.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"optc32_disable_crtc() does not reset the OPTC input segment selectors, leaving stale ODM4:1 state across disable/transition.","review":{"id":"CVE-2023-52671","series":"6.1.y","upstream":["e7b2b108cdeab76a7e7324459e50b0c1214c0386"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"applicable","applicability":"affected","reason":"optc32_disable_crtc() does not reset the OPTC input segment selectors, leaving stale ODM4:1 state across disable/transition.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n138"},{"label":"Upstream fix e7b2b108cdea","url":"https://git.kernel.org/stable/c/e7b2b108cdeab76a7e7324459e50b0c1214c0386"}]},"size":{"status":"unknown","patches":[{"sha":"e7b2b108cdeab76a7e7324459e50b0c1214c0386","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52671","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52671.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52648","title":"drm/vmwgfx: Unmap the surface before resetting it on a plane state","status":"unfixed","project":false,"upstream":[{"sha":"27571c64f1855881753e6f33c3186573afbab7ba","url":"https://git.kernel.org/stable/c/27571c64f1855881753e6f33c3186573afbab7ba"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"27571c64f1855881753e6f33c3186573afbab7ba","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/27571c64f1855881753e6f33c3186573afbab7ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52648","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52648.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52629","title":"sh: push-switch: Reorder cleanup operations to avoid use-after-free bug","status":"backported","project":true,"upstream":[{"sha":"246f80a0b17f8f582b2c0996db02998239057c65","url":"https://git.kernel.org/stable/c/246f80a0b17f8f582b2c0996db02998239057c65"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ff635d1f143b55fa005e9e43b16e6d8f677e90a5","label":"ff635d1f143b","date":"2026-10-03T12:28:43+02:00","lore":["https://lore.kernel.org/r/20230802033737.9738-1-duoming@zju.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"246f80a0b17f8f582b2c0996db02998239057c65","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52629","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52629.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52625","title":"drm/amd/display: Refactor DMCUB enter/exit idle interface","status":"unfixed","project":false,"upstream":[{"sha":"8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa","url":"https://git.kernel.org/stable/c/8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa","lines":118,"reason":"","source":"https://github.com/torvalds/linux/commit/8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52625","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52625.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52624","title":"drm/amd/display: Wake DMCUB before executing GPINT commands","status":"unfixed","project":false,"upstream":[{"sha":"e5ffd1263dd5b44929c676171802e7b6af483f21","url":"https://git.kernel.org/stable/c/e5ffd1263dd5b44929c676171802e7b6af483f21"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"e5ffd1263dd5b44929c676171802e7b6af483f21","lines":213,"reason":"","source":"https://github.com/torvalds/linux/commit/e5ffd1263dd5b44929c676171802e7b6af483f21.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52624","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52624.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52590","title":"ocfs2: Avoid touching renamed directory if parent does not change","status":"queued","project":true,"upstream":[{"sha":"9d618d19b29c2943527e3a43da0a35aea91062fc","url":"https://git.kernel.org/stable/c/9d618d19b29c2943527e3a43da0a35aea91062fc"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.1/ocfs2-avoid-touching-renamed-directory-if-parent-doe.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"unknown","patches":[{"sha":"9d618d19b29c2943527e3a43da0a35aea91062fc","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52590","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52590.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2021-47645","title":"media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com","status":"not-applicable","project":false,"upstream":[{"sha":"e3b86f4e558cea9eed71d894df2f19b10d60a207","url":"https://git.kernel.org/stable/c/e3b86f4e558cea9eed71d894df2f19b10d60a207"},{"sha":"8dce4b265a5357731058f69645840dabc718c687","url":"https://git.kernel.org/stable/c/8dce4b265a5357731058f69645840dabc718c687"}],"evidence":[],"submission_lore":[],"basis":"The relocated Zoran driver already uses the corrected even buffer index and checks for a NULL buffer in zoran_reap_stat_com. Both effective fix changes are present. The separate 2019 driver-removal commit is not required for this restored driver implementation.","review":{"id":"CVE-2021-47645","series":"6.1.y","upstream":["e3b86f4e558cea9eed71d894df2f19b10d60a207","8dce4b265a5357731058f69645840dabc718c687"],"checked_sha":"1a8763b93150b2c8f3992c27a5ce7857fee4ab0f","checked_version":"6.1.188","kind":"already-fixed","applicability":"fixed","reason":"The relocated Zoran driver already uses the corrected even buffer index and checks for a NULL buffer in zoran_reap_stat_com. Both effective fix changes are present. The separate 2019 driver-removal commit is not required for this restored driver implementation.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/media/pci/zoran/zoran_device.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/media/pci/zoran/zoran_device.c?id=1a8763b93150b2c8f3992c27a5ce7857fee4ab0f#n794"},{"label":"Upstream fix 8dce4b265a53","url":"https://git.kernel.org/stable/c/8dce4b265a5357731058f69645840dabc718c687"},{"label":"Upstream fix e3b86f4e558c","url":"https://git.kernel.org/stable/c/e3b86f4e558cea9eed71d894df2f19b10d60a207"}]},"size":{"status":"over-limit","patches":[{"sha":"e3b86f4e558cea9eed71d894df2f19b10d60a207","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/e3b86f4e558cea9eed71d894df2f19b10d60a207.patch"},{"sha":"8dce4b265a5357731058f69645840dabc718c687","lines":11302,"reason":"","source":"https://github.com/torvalds/linux/commit/8dce4b265a5357731058f69645840dabc718c687.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2021-47645","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2021/CVE-2021-47645.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"}],"counts":{"backported":63,"queued":15,"unfixed":516,"unknown":6,"not-applicable":256},"triage_counts":{"over-limit":117,"within-limit":399,"size-unknown":0,"already-fixed":2,"applicable":59,"ineffective-fix":1,"needs-review":1,"no-op":8,"not-applicable":51}},{"series":"6.6.y","ref":"FETCH_HEAD","sha":"0aebf2870d53a8d97e02a99e2103ea0b38950c1b","committed_at":"2026-10-21T10:28:39+02:00","version":"6.6.160","records":[{"id":"CVE-2026-100073","title":"ext4: fix transaction overflow during writeback","status":"not-applicable","project":false,"upstream":[{"sha":"46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","url":"https://git.kernel.org/stable/c/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-100073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-100073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-100072","title":"ACPI: platform: Use acpi_bus_get_primary_device()","status":"backported","project":false,"upstream":[{"sha":"a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","url":"https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a75e5de593ef158feb17989bff7730c5a3d82503","label":"a75e5de593ef","date":"2026-10-21T10:28:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-100072","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-100072.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99215","title":"power: supply: core: prevent unregistering a power supply while a callback runs","status":"unfixed","project":false,"upstream":[{"sha":"5b4bd13e0552926648a46c2c9a12a24dfaee3715","url":"https://git.kernel.org/stable/c/5b4bd13e0552926648a46c2c9a12a24dfaee3715"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5b4bd13e0552926648a46c2c9a12a24dfaee3715","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/5b4bd13e0552926648a46c2c9a12a24dfaee3715.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99215","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99215.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99211","title":"netlink: reset skb headers before unicast and multicast filtering","status":"queued","project":false,"upstream":[{"sha":"8bf659bd54e1f00e34cf5244b1d289c506fa47c0","url":"https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.6/netlink-reset-skb-headers-before-unicast-and-multica.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8bf659bd54e1f00e34cf5244b1d289c506fa47c0","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/8bf659bd54e1f00e34cf5244b1d289c506fa47c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99209","title":"drm/xe: skip eviction of a BO with no resource","status":"not-applicable","project":false,"upstream":[{"sha":"448e76cbdc6652ccd3ba337b7a6e1f028859f2ed","url":"https://git.kernel.org/stable/c/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"448e76cbdc6652ccd3ba337b7a6e1f028859f2ed","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99209","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99209.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99208","title":"drm/xe/oa: Zero OA buffer at allocation","status":"not-applicable","project":false,"upstream":[{"sha":"fd8662823caa114a63f07222d2aa448f6ac5e864","url":"https://git.kernel.org/stable/c/fd8662823caa114a63f07222d2aa448f6ac5e864"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd8662823caa114a63f07222d2aa448f6ac5e864","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/fd8662823caa114a63f07222d2aa448f6ac5e864.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99208","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99208.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99191","title":"calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()","status":"queued","project":false,"upstream":[{"sha":"8070ed578b6b9134e045627fb745c887a806d46e","url":"https://git.kernel.org/stable/c/8070ed578b6b9134e045627fb745c887a806d46e"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.6/calipso-keep-big-tcp-payload_len-in-calipso_skbuff_s.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8070ed578b6b9134e045627fb745c887a806d46e","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/8070ed578b6b9134e045627fb745c887a806d46e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99191","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99191.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99189","title":"gpio: mxc: fix race between chained IRQ handler install and probe completion","status":"unfixed","project":false,"upstream":[{"sha":"38d44f78f041ffe60c8e2443b99434a199e7541d","url":"https://git.kernel.org/stable/c/38d44f78f041ffe60c8e2443b99434a199e7541d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"38d44f78f041ffe60c8e2443b99434a199e7541d","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/38d44f78f041ffe60c8e2443b99434a199e7541d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99189","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99189.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99183","title":"accel/rocket: search every core slot when looking up a scheduler","status":"not-applicable","project":false,"upstream":[{"sha":"89c2c777df17eb0201c8e22afabbf3691f2a28fe","url":"https://git.kernel.org/stable/c/89c2c777df17eb0201c8e22afabbf3691f2a28fe"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"89c2c777df17eb0201c8e22afabbf3691f2a28fe","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/89c2c777df17eb0201c8e22afabbf3691f2a28fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99183","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99183.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99178","title":"x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context","status":"unfixed","project":false,"upstream":[{"sha":"81d99abe2bd81379abfb595e403bbbee6fbfc624","url":"https://git.kernel.org/stable/c/81d99abe2bd81379abfb595e403bbbee6fbfc624"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"81d99abe2bd81379abfb595e403bbbee6fbfc624","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/81d99abe2bd81379abfb595e403bbbee6fbfc624.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99178","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99178.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99172","title":"ipc: drop the mqueue mount with kern_unmount() on setup failure","status":"unfixed","project":false,"upstream":[{"sha":"f0e48172a59e517e613b73f73cc35f24fd123aeb","url":"https://git.kernel.org/stable/c/f0e48172a59e517e613b73f73cc35f24fd123aeb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0e48172a59e517e613b73f73cc35f24fd123aeb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f0e48172a59e517e613b73f73cc35f24fd123aeb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99172","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99172.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99146","title":"drm/i915/dmc: Add sanity check for DMC load address","status":"unfixed","project":false,"upstream":[{"sha":"7dedc5bb11f95e96fe80757c924d8d9aa7327759","url":"https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7dedc5bb11f95e96fe80757c924d8d9aa7327759","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/7dedc5bb11f95e96fe80757c924d8d9aa7327759.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99146","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99146.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99125","title":"s390/pai: Handle multiple PMU stop callback invocations","status":"not-applicable","project":false,"upstream":[{"sha":"f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40","url":"https://git.kernel.org/stable/c/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99122","title":"vsock/vmci: validate packet source for connected sockets","status":"unfixed","project":false,"upstream":[{"sha":"ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7","url":"https://git.kernel.org/stable/c/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99122","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99122.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99109","title":"smb: client: reject SetEA requests that do not fit the request buffer","status":"unfixed","project":false,"upstream":[{"sha":"4aa2c106aef4bf3dfd97c30842db0767b26e8428","url":"https://git.kernel.org/stable/c/4aa2c106aef4bf3dfd97c30842db0767b26e8428"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4aa2c106aef4bf3dfd97c30842db0767b26e8428","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/4aa2c106aef4bf3dfd97c30842db0767b26e8428.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99109","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99109.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99101","title":"ntfs: move attribute payload before shrinking its record","status":"unknown","project":false,"upstream":[{"sha":"0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","url":"https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99090","title":"drm/amdgpu: serialize vblank counter reads against GPU reset","status":"backported","project":false,"upstream":[{"sha":"1a6023edfbb5673f55fab6348f135fb3b1428ea5","url":"https://git.kernel.org/stable/c/1a6023edfbb5673f55fab6348f135fb3b1428ea5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/037796d9ca1da97978deaefd88ca5649f6cb69f5","label":"037796d9ca1d","date":"2026-10-21T10:27:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a6023edfbb5673f55fab6348f135fb3b1428ea5","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/1a6023edfbb5673f55fab6348f135fb3b1428ea5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99090","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99090.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99087","title":"dm-integrity: fix NULL pointer dereference when the 'R' flag is used","status":"unfixed","project":false,"upstream":[{"sha":"7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84","url":"https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99087","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99087.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99086","title":"dm-integrity: validate the superblock on resume","status":"unfixed","project":false,"upstream":[{"sha":"fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2","url":"https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2","lines":80,"reason":"","source":"https://github.com/torvalds/linux/commit/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99086","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99086.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99076","title":"ipv6: udp: Create exceptions before socket matching","status":"unfixed","project":false,"upstream":[{"sha":"ac76cab50e899a7346408b8d3c3a4192c2eefb9f","url":"https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac76cab50e899a7346408b8d3c3a4192c2eefb9f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/ac76cab50e899a7346408b8d3c3a4192c2eefb9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99076","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99076.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99026","title":"net: team: free skb when broadcast has no txable port","status":"unfixed","project":false,"upstream":[{"sha":"489114c9ecae44e523361a4b3e610ee5ebd9189c","url":"https://git.kernel.org/stable/c/489114c9ecae44e523361a4b3e610ee5ebd9189c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"489114c9ecae44e523361a4b3e610ee5ebd9189c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/489114c9ecae44e523361a4b3e610ee5ebd9189c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99021","title":"regulator: of: fill in supply names in of_regulator_bulk_get_all()","status":"unfixed","project":false,"upstream":[{"sha":"e2151c29cec73f6cc70abf1c7cbc7b9b202489f5","url":"https://git.kernel.org/stable/c/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e2151c29cec73f6cc70abf1c7cbc7b9b202489f5","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99021","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99021.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98999","title":"drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin","status":"not-applicable","project":false,"upstream":[{"sha":"cf238c067eaae1cbfb00738e29219b9568d2313e","url":"https://git.kernel.org/stable/c/cf238c067eaae1cbfb00738e29219b9568d2313e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf238c067eaae1cbfb00738e29219b9568d2313e","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/cf238c067eaae1cbfb00738e29219b9568d2313e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98996","title":"fs: don't silently unmount busy mounts","status":"unfixed","project":false,"upstream":[{"sha":"6857e209015f95be7a8f19a9cd5dac345b9b9859","url":"https://git.kernel.org/stable/c/6857e209015f95be7a8f19a9cd5dac345b9b9859"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"6857e209015f95be7a8f19a9cd5dac345b9b9859","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/6857e209015f95be7a8f19a9cd5dac345b9b9859.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98996","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98996.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98989","title":"namespace: check a recursive bind mount for mount namespace loops","status":"unfixed","project":false,"upstream":[{"sha":"c640a01a78e42302879006ed7b7d5a9a943ba815","url":"https://git.kernel.org/stable/c/c640a01a78e42302879006ed7b7d5a9a943ba815"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c640a01a78e42302879006ed7b7d5a9a943ba815","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c640a01a78e42302879006ed7b7d5a9a943ba815.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98983","title":"unshare: don't drop active namespace references that were never taken","status":"unfixed","project":false,"upstream":[{"sha":"0b6f31a3c0b16066f812e94b52a704174a6f23cd","url":"https://git.kernel.org/stable/c/0b6f31a3c0b16066f812e94b52a704174a6f23cd"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0b6f31a3c0b16066f812e94b52a704174a6f23cd","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/0b6f31a3c0b16066f812e94b52a704174a6f23cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98983","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98983.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98980","title":"namei: don't reveal overmounted entries in refwalk","status":"unfixed","project":false,"upstream":[{"sha":"8189ab688f5a2c745dc90b63374da02f213d6994","url":"https://git.kernel.org/stable/c/8189ab688f5a2c745dc90b63374da02f213d6994"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8189ab688f5a2c745dc90b63374da02f213d6994","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/8189ab688f5a2c745dc90b63374da02f213d6994.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98980","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98980.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98978","title":"namespace: never expire a locked mount","status":"unfixed","project":false,"upstream":[{"sha":"f78ddcc872248c7aa1d7e904928441a0be4c6d5d","url":"https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f78ddcc872248c7aa1d7e904928441a0be4c6d5d","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/f78ddcc872248c7aa1d7e904928441a0be4c6d5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98978","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98978.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98975","title":"xfs: stop exchanging reflink flags when exchanging mappings","status":"unfixed","project":false,"upstream":[{"sha":"d84d6c1a7f1e2de9e601703a326a4c1b7b421943","url":"https://git.kernel.org/stable/c/d84d6c1a7f1e2de9e601703a326a4c1b7b421943"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d84d6c1a7f1e2de9e601703a326a4c1b7b421943","lines":160,"reason":"","source":"https://github.com/torvalds/linux/commit/d84d6c1a7f1e2de9e601703a326a4c1b7b421943.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98972","title":"cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()","status":"unfixed","project":false,"upstream":[{"sha":"e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469","url":"https://git.kernel.org/stable/c/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98972","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98972.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98966","title":"bonding: fix the program leak when XDP is replaced","status":"unfixed","project":false,"upstream":[{"sha":"184b5ddf82d45d6f75cc83719a2e453392512bd2","url":"https://git.kernel.org/stable/c/184b5ddf82d45d6f75cc83719a2e453392512bd2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"184b5ddf82d45d6f75cc83719a2e453392512bd2","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/184b5ddf82d45d6f75cc83719a2e453392512bd2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98966","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98966.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98960","title":"btrfs: don't stash io_uring encoded data across -EAGAIN","status":"not-applicable","project":false,"upstream":[{"sha":"51562a8cb11628d3a5e105b4c347ec5473e5745f","url":"https://git.kernel.org/stable/c/51562a8cb11628d3a5e105b4c347ec5473e5745f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"51562a8cb11628d3a5e105b4c347ec5473e5745f","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/51562a8cb11628d3a5e105b4c347ec5473e5745f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98960","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98960.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98959","title":"btrfs: fix xattr replace when multiple xattrs are packed in the same item","status":"backported","project":false,"upstream":[{"sha":"858bee1c77857aabcc2327cd32dd8266332de332","url":"https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7a53bb4668b319fc6c8a3ce2c21635125c7d2712","label":"7a53bb4668b3","date":"2026-10-21T10:27:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"858bee1c77857aabcc2327cd32dd8266332de332","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/858bee1c77857aabcc2327cd32dd8266332de332.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98959","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98959.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98958","title":"wifi: mt76: account non-AQL frames per peer rather than per link","status":"not-applicable","project":false,"upstream":[{"sha":"752770d7a58c821c17909c3ca67f9f14ab146a40","url":"https://git.kernel.org/stable/c/752770d7a58c821c17909c3ca67f9f14ab146a40"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"752770d7a58c821c17909c3ca67f9f14ab146a40","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/752770d7a58c821c17909c3ca67f9f14ab146a40.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98958","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98958.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98957","title":"wifi: mt76: mt7915: disable rx napi when removing device","status":"unfixed","project":false,"upstream":[{"sha":"916c484d29d82f45c281da2786fcd6a1284430ce","url":"https://git.kernel.org/stable/c/916c484d29d82f45c281da2786fcd6a1284430ce"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"916c484d29d82f45c281da2786fcd6a1284430ce","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/916c484d29d82f45c281da2786fcd6a1284430ce.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98957","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98957.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98954","title":"net: always dissect GSO packets in __virtio_net_hdr_to_skb()","status":"unfixed","project":false,"upstream":[{"sha":"44378d02c5aaae24b60a75fbbb539b4aa4db503d","url":"https://git.kernel.org/stable/c/44378d02c5aaae24b60a75fbbb539b4aa4db503d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"44378d02c5aaae24b60a75fbbb539b4aa4db503d","lines":139,"reason":"","source":"https://github.com/torvalds/linux/commit/44378d02c5aaae24b60a75fbbb539b4aa4db503d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98954","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98954.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98951","title":"riscv: ptrace: Zero-initialize regset buffers before copyin","status":"unfixed","project":false,"upstream":[{"sha":"59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97","url":"https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98951","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98951.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98947","title":"vsock: Fix memory leak in vmci_transport_recv_dgram_cb()","status":"unfixed","project":false,"upstream":[{"sha":"7c24a4e87e219072e5e106f6791146cbf3b056b3","url":"https://git.kernel.org/stable/c/7c24a4e87e219072e5e106f6791146cbf3b056b3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c24a4e87e219072e5e106f6791146cbf3b056b3","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7c24a4e87e219072e5e106f6791146cbf3b056b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98946","title":"drm/vc4: Disable the V3D interrupt across runtime suspend","status":"unfixed","project":false,"upstream":[{"sha":"6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f","url":"https://git.kernel.org/stable/c/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f","lines":67,"reason":"","source":"https://github.com/torvalds/linux/commit/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98946","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98946.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98938","title":"rust: irq: pass RegistrationInner as cookie to request_irq","status":"not-applicable","project":false,"upstream":[{"sha":"9a7931e847f338a687e96cde9f37e0cff83ddd84","url":"https://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"9a7931e847f338a687e96cde9f37e0cff83ddd84","lines":185,"reason":"","source":"https://github.com/torvalds/linux/commit/9a7931e847f338a687e96cde9f37e0cff83ddd84.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98937","title":"perf/core: Check kernel access when kernel callchains are requested","status":"unfixed","project":false,"upstream":[{"sha":"a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f","url":"https://git.kernel.org/stable/c/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98937","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98937.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98932","title":"EDAC/altera: Fix use-after-free in error paths","status":"unfixed","project":false,"upstream":[{"sha":"eef3b67f9c6782127163b631c9043011a68016e2","url":"https://git.kernel.org/stable/c/eef3b67f9c6782127163b631c9043011a68016e2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"eef3b67f9c6782127163b631c9043011a68016e2","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/eef3b67f9c6782127163b631c9043011a68016e2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98930","title":"KVM: s390: Fix IRQ injection with SIGP Stop and Store Status","status":"unfixed","project":false,"upstream":[{"sha":"d343407b728a80b74be3c24b59f15e60289ea527","url":"https://git.kernel.org/stable/c/d343407b728a80b74be3c24b59f15e60289ea527"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d343407b728a80b74be3c24b59f15e60289ea527","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/d343407b728a80b74be3c24b59f15e60289ea527.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98930","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98930.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98929","title":"macsec: initialize SecY before registering the netdevice","status":"unfixed","project":false,"upstream":[{"sha":"c2de369c5c5b8599ca10fd5ca8d11fcd845c1331","url":"https://git.kernel.org/stable/c/c2de369c5c5b8599ca10fd5ca8d11fcd845c1331"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c2de369c5c5b8599ca10fd5ca8d11fcd845c1331","lines":141,"reason":"","source":"https://github.com/torvalds/linux/commit/c2de369c5c5b8599ca10fd5ca8d11fcd845c1331.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98926","title":"drm/amd/display: Remove sink usage from DPMS","status":"unfixed","project":false,"upstream":[{"sha":"8fa813b7fd1eccbed13e126166cf764f1f11a7d3","url":"https://git.kernel.org/stable/c/8fa813b7fd1eccbed13e126166cf764f1f11a7d3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8fa813b7fd1eccbed13e126166cf764f1f11a7d3","lines":384,"reason":"","source":"https://github.com/torvalds/linux/commit/8fa813b7fd1eccbed13e126166cf764f1f11a7d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98926","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98926.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98924","title":"fs: avoid repeated scans in evict_inodes()","status":"unfixed","project":false,"upstream":[{"sha":"7459c021874246c196f397686e100702f059b9e7","url":"https://git.kernel.org/stable/c/7459c021874246c196f397686e100702f059b9e7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7459c021874246c196f397686e100702f059b9e7","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/7459c021874246c196f397686e100702f059b9e7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98924","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98924.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98920","title":"netfs: Fix missing alloc tagging of direct mempool allocations","status":"not-applicable","project":false,"upstream":[{"sha":"b78b728e21c32ec4c330b299f657fb1eb02dffc2","url":"https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b78b728e21c32ec4c330b299f657fb1eb02dffc2","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/b78b728e21c32ec4c330b299f657fb1eb02dffc2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98917","title":"parisc: Increase kernel stack size to 32kb","status":"unfixed","project":false,"upstream":[{"sha":"94b7e3a7e871ae27d4935c76959dfc61829f27f9","url":"https://git.kernel.org/stable/c/94b7e3a7e871ae27d4935c76959dfc61829f27f9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"94b7e3a7e871ae27d4935c76959dfc61829f27f9","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/94b7e3a7e871ae27d4935c76959dfc61829f27f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98917","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98917.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98916","title":"wifi: nl80211: check link is beaconing for color change","status":"backported","project":false,"upstream":[{"sha":"55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4","url":"https://git.kernel.org/stable/c/55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/51423d370739aa3f701fdfbfcc52ecf321dfd71a","label":"51423d370739","date":"2026-10-21T10:28:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98916","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98916.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98914","title":"drm/amdgpu: cap ATOM command table nesting depth","status":"unfixed","project":false,"upstream":[{"sha":"27ef1795bc4e47cae838e0a3ced531c549f9b23d","url":"https://git.kernel.org/stable/c/27ef1795bc4e47cae838e0a3ced531c549f9b23d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"27ef1795bc4e47cae838e0a3ced531c549f9b23d","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/27ef1795bc4e47cae838e0a3ced531c549f9b23d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98906","title":"net: lan966x: restore RX state on reload failure","status":"unfixed","project":false,"upstream":[{"sha":"aa97f11a76e545ed73cc455bcdd1ece4b480b507","url":"https://git.kernel.org/stable/c/aa97f11a76e545ed73cc455bcdd1ece4b480b507"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa97f11a76e545ed73cc455bcdd1ece4b480b507","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/aa97f11a76e545ed73cc455bcdd1ece4b480b507.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98904","title":"mailbox: imx: Use devm_pm_runtime_enable()","status":"unfixed","project":false,"upstream":[{"sha":"1f602619e408b6e9655ee76656a2a5ab6e89c5e4","url":"https://git.kernel.org/stable/c/1f602619e408b6e9655ee76656a2a5ab6e89c5e4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1f602619e408b6e9655ee76656a2a5ab6e89c5e4","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/1f602619e408b6e9655ee76656a2a5ab6e89c5e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98904","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98904.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98903","title":"mailbox: imx: Add a channel shutdown field","status":"unfixed","project":false,"upstream":[{"sha":"5ccea7eacb7786c358833634f45700365f6c1d99","url":"https://git.kernel.org/stable/c/5ccea7eacb7786c358833634f45700365f6c1d99"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5ccea7eacb7786c358833634f45700365f6c1d99","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/5ccea7eacb7786c358833634f45700365f6c1d99.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98903","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98903.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98901","title":"ksmbd: fix lease break and ack state handling","status":"backported","project":false,"upstream":[{"sha":"5015191096db311759fef98769270336cd8b1324","url":"https://git.kernel.org/stable/c/5015191096db311759fef98769270336cd8b1324"}],"evidence":[{"url":"https://git.kernel.org/stable/c/17699905a381621c1cee5b6528feb05acedc86a4","label":"17699905a381","date":"2026-10-03T12:30:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"5015191096db311759fef98769270336cd8b1324","lines":184,"reason":"","source":"https://github.com/torvalds/linux/commit/5015191096db311759fef98769270336cd8b1324.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98897","title":"ksmbd: don't hold ci->m_lock while waiting for a lease break ack","status":"unfixed","project":false,"upstream":[{"sha":"27a9bc968d4ae809a3f5ca2f2b136856ee613cb4","url":"https://git.kernel.org/stable/c/27a9bc968d4ae809a3f5ca2f2b136856ee613cb4"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"27a9bc968d4ae809a3f5ca2f2b136856ee613cb4","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/27a9bc968d4ae809a3f5ca2f2b136856ee613cb4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98897","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98897.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98880","title":"ntfs3: handle set_blocksize failures","status":"backported","project":false,"upstream":[{"sha":"24f7d1824b7581ae3daf9d443c5dfeabd89df6d8","url":"https://git.kernel.org/stable/c/24f7d1824b7581ae3daf9d443c5dfeabd89df6d8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/df9dac4dbe557f6455a61e68cc09ef98b22f3686","label":"df9dac4dbe55","date":"2026-10-03T12:30:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"24f7d1824b7581ae3daf9d443c5dfeabd89df6d8","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/24f7d1824b7581ae3daf9d443c5dfeabd89df6d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98880","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98880.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98875","title":"drm/nouveau/gsp: add SEC2 to GA100 chip table","status":"backported","project":false,"upstream":[{"sha":"604d0efb17cc0dd197e089134736ac2698d5fca7","url":"https://git.kernel.org/stable/c/604d0efb17cc0dd197e089134736ac2698d5fca7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/feb1ad41281aed00e8a741942e56a1cd774e8342","label":"feb1ad41281a","date":"2026-10-03T12:30:04+02:00","lore":[]}],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"604d0efb17cc0dd197e089134736ac2698d5fca7","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/604d0efb17cc0dd197e089134736ac2698d5fca7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98875","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98875.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98869","title":"bpf: Infer zext_dst based on static register liveness analysis","status":"not-applicable","project":false,"upstream":[{"sha":"7ce090afbf725e25fff29caacce1eaf8459b1117","url":"https://git.kernel.org/stable/c/7ce090afbf725e25fff29caacce1eaf8459b1117"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"7ce090afbf725e25fff29caacce1eaf8459b1117","lines":429,"reason":"","source":"https://github.com/torvalds/linux/commit/7ce090afbf725e25fff29caacce1eaf8459b1117.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98869","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98869.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98863","title":"KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails","status":"unfixed","project":false,"upstream":[{"sha":"10180a277549339020b08000206092c07e0bff5a","url":"https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"10180a277549339020b08000206092c07e0bff5a","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/10180a277549339020b08000206092c07e0bff5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98863","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98863.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98859","title":"HID: multitouch: stop the release timer from being rearmed on remove","status":"backported","project":false,"upstream":[{"sha":"5acb2dace582f061aab5e14c399ac9480315f44b","url":"https://git.kernel.org/stable/c/5acb2dace582f061aab5e14c399ac9480315f44b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3776f34fbce990af45978f1628d2e1adc0d67d0f","label":"3776f34fbce9","date":"2026-10-21T10:27:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5acb2dace582f061aab5e14c399ac9480315f44b","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/5acb2dace582f061aab5e14c399ac9480315f44b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98859","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98859.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98853","title":"net: gso: limit recursive IP-in-IP segmentation","status":"unfixed","project":false,"upstream":[{"sha":"006c8b834aed8b02bd8fb9fb05e9e7ead37d1763","url":"https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"006c8b834aed8b02bd8fb9fb05e9e7ead37d1763","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98853","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98853.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98852","title":"net: extend IPv6 exthdr detection of tunneled packets","status":"backported","project":false,"upstream":[{"sha":"5f0764cb1c81a9712bce605d38efe6d844a70b29","url":"https://git.kernel.org/stable/c/5f0764cb1c81a9712bce605d38efe6d844a70b29"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fdbd83c2d929ec968b37d2f75149a79440e328ff","label":"fdbd83c2d929","date":"2026-10-21T10:27:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"5f0764cb1c81a9712bce605d38efe6d844a70b29","lines":67,"reason":"","source":"https://github.com/torvalds/linux/commit/5f0764cb1c81a9712bce605d38efe6d844a70b29.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98852","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98852.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98843","title":"netfs: zero gaps in read-gaps folio to avoid writing back stale data","status":"not-applicable","project":false,"upstream":[{"sha":"8db55c5cd831a786a1a2a2d391aa80354535a353","url":"https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8db55c5cd831a786a1a2a2d391aa80354535a353","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/8db55c5cd831a786a1a2a2d391aa80354535a353.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98843","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98843.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98839","title":"vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()","status":"unfixed","project":false,"upstream":[{"sha":"39495ef5d6f8019e62d65807f217a7ca8232727a","url":"https://git.kernel.org/stable/c/39495ef5d6f8019e62d65807f217a7ca8232727a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"39495ef5d6f8019e62d65807f217a7ca8232727a","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/39495ef5d6f8019e62d65807f217a7ca8232727a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98839","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98839.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98834","title":"mtd: core: avoid double-free of OTP NVMEM device","status":"unfixed","project":false,"upstream":[{"sha":"26300879cd8e4612dce66bb8f6ff7cd35fcf3e59","url":"https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"26300879cd8e4612dce66bb8f6ff7cd35fcf3e59","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98829","title":"wifi: mac80211: drop oversized fragments to avoid extra_len overflow","status":"unfixed","project":false,"upstream":[{"sha":"5e4f3509793b4db2c0835340224743db680e861f","url":"https://git.kernel.org/stable/c/5e4f3509793b4db2c0835340224743db680e861f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5e4f3509793b4db2c0835340224743db680e861f","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/5e4f3509793b4db2c0835340224743db680e861f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98829","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98829.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98828","title":"wifi: ath9k: reject short WMI command responses","status":"unfixed","project":false,"upstream":[{"sha":"93ce8ea70451e800601bc9444aa33043de15d67b","url":"https://git.kernel.org/stable/c/93ce8ea70451e800601bc9444aa33043de15d67b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"93ce8ea70451e800601bc9444aa33043de15d67b","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/93ce8ea70451e800601bc9444aa33043de15d67b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98828","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98828.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98827","title":"wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE","status":"unfixed","project":false,"upstream":[{"sha":"aeaca27c1db3106967ffbb2b517d98c835f6d500","url":"https://git.kernel.org/stable/c/aeaca27c1db3106967ffbb2b517d98c835f6d500"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aeaca27c1db3106967ffbb2b517d98c835f6d500","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/aeaca27c1db3106967ffbb2b517d98c835f6d500.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98827","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98827.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98826","title":"rtc: ac100: Fix clock provider use-after-free on probe failure","status":"unfixed","project":false,"upstream":[{"sha":"fcf0b58e976e83adf246b014518e49c662b96f5e","url":"https://git.kernel.org/stable/c/fcf0b58e976e83adf246b014518e49c662b96f5e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fcf0b58e976e83adf246b014518e49c662b96f5e","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/fcf0b58e976e83adf246b014518e49c662b96f5e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98824","title":"wifi: mac80211: validate TX status rate metadata","status":"unfixed","project":false,"upstream":[{"sha":"6bdcdb31318c10e6369cff8e5b32c37397e98091","url":"https://git.kernel.org/stable/c/6bdcdb31318c10e6369cff8e5b32c37397e98091"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"6bdcdb31318c10e6369cff8e5b32c37397e98091","lines":165,"reason":"","source":"https://github.com/torvalds/linux/commit/6bdcdb31318c10e6369cff8e5b32c37397e98091.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98824","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98824.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98822","title":"wifi: mac80211: prevent AP VLAN tx from other interfaces","status":"backported","project":false,"upstream":[{"sha":"7f93ca31f7fd9b42e7d692f59514436d448ac908","url":"https://git.kernel.org/stable/c/7f93ca31f7fd9b42e7d692f59514436d448ac908"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2fe08c8ff26841430a3c98ab755337325b5d47b5","label":"2fe08c8ff268","date":"2026-10-21T10:26:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f93ca31f7fd9b42e7d692f59514436d448ac908","lines":80,"reason":"","source":"https://github.com/torvalds/linux/commit/7f93ca31f7fd9b42e7d692f59514436d448ac908.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98822","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98822.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98820","title":"blk-mq: set RQF_USE_SCHED when the operation is known","status":"unfixed","project":false,"upstream":[{"sha":"ab6c756f28c741d704a7c3e04814bfc3adf6f818","url":"https://git.kernel.org/stable/c/ab6c756f28c741d704a7c3e04814bfc3adf6f818"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ab6c756f28c741d704a7c3e04814bfc3adf6f818","lines":134,"reason":"","source":"https://github.com/torvalds/linux/commit/ab6c756f28c741d704a7c3e04814bfc3adf6f818.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98820","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98820.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98818","title":"mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()","status":"not-applicable","project":false,"upstream":[{"sha":"af2fb3ee6679b517e2fdbd3ba16ec276a8b74312","url":"https://git.kernel.org/stable/c/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"af2fb3ee6679b517e2fdbd3ba16ec276a8b74312","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98818","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98818.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98816","title":"bpf: Fix overflow of jump offset in constant blinding","status":"unfixed","project":false,"upstream":[{"sha":"ad139384ecddb6f3e7e3c3c12765aafae0e39670","url":"https://git.kernel.org/stable/c/ad139384ecddb6f3e7e3c3c12765aafae0e39670"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad139384ecddb6f3e7e3c3c12765aafae0e39670","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/ad139384ecddb6f3e7e3c3c12765aafae0e39670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98816","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98816.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98815","title":"nvme: fix cdev lifetime","status":"unfixed","project":false,"upstream":[{"sha":"9952f3882ecba709092379b71e02b09762b26f96","url":"https://git.kernel.org/stable/c/9952f3882ecba709092379b71e02b09762b26f96"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9952f3882ecba709092379b71e02b09762b26f96","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/9952f3882ecba709092379b71e02b09762b26f96.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98815","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98815.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98814","title":"nvme: fix command effects log lifetime for multipath heads","status":"unfixed","project":false,"upstream":[{"sha":"72ece656abd4de8645a421fb482d7a11e6533a45","url":"https://git.kernel.org/stable/c/72ece656abd4de8645a421fb482d7a11e6533a45"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"72ece656abd4de8645a421fb482d7a11e6533a45","lines":126,"reason":"","source":"https://github.com/torvalds/linux/commit/72ece656abd4de8645a421fb482d7a11e6533a45.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98814","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98814.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98813","title":"bpf: Hold map BTF for the memory allocator destructor record","status":"not-applicable","project":false,"upstream":[{"sha":"ab39974240a0cff765f3bb9cce81d8001ffdb144","url":"https://git.kernel.org/stable/c/ab39974240a0cff765f3bb9cce81d8001ffdb144"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ab39974240a0cff765f3bb9cce81d8001ffdb144","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/ab39974240a0cff765f3bb9cce81d8001ffdb144.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98813","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98813.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98810","title":"wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()","status":"unfixed","project":false,"upstream":[{"sha":"6f63e919fe1e335b8abcb3a28bfd4804a98d875a","url":"https://git.kernel.org/stable/c/6f63e919fe1e335b8abcb3a28bfd4804a98d875a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f63e919fe1e335b8abcb3a28bfd4804a98d875a","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/6f63e919fe1e335b8abcb3a28bfd4804a98d875a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98810","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98810.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98808","title":"net: systemport: Fix buffer overflow in bcm_sysport_get_stats()","status":"backported","project":false,"upstream":[{"sha":"eb7b84af0ec5c71b4920e999611b466b3784496c","url":"https://git.kernel.org/stable/c/eb7b84af0ec5c71b4920e999611b466b3784496c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/96a2b042051553df0d9f03b518dd3b7105b36935","label":"96a2b0420515","date":"2026-10-21T10:26:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb7b84af0ec5c71b4920e999611b466b3784496c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/eb7b84af0ec5c71b4920e999611b466b3784496c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98807","title":"net/mlx5: Fix slab-out-of-bounds when handling team device events","status":"unfixed","project":false,"upstream":[{"sha":"04c824940d52871c49866a4ac67b504146f7cf35","url":"https://git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"04c824940d52871c49866a4ac67b504146f7cf35","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/04c824940d52871c49866a4ac67b504146f7cf35.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98807.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98806","title":"octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled","status":"not-applicable","project":false,"upstream":[{"sha":"056994563935e049093f100efaad7e63ad113814","url":"https://git.kernel.org/stable/c/056994563935e049093f100efaad7e63ad113814"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"056994563935e049093f100efaad7e63ad113814","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/056994563935e049093f100efaad7e63ad113814.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98803","title":"net: stmmac: fix rx Scatter-Gather support","status":"unfixed","project":false,"upstream":[{"sha":"88095728511e0df9c89528944f5a1762ad298983","url":"https://git.kernel.org/stable/c/88095728511e0df9c89528944f5a1762ad298983"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"88095728511e0df9c89528944f5a1762ad298983","lines":180,"reason":"","source":"https://github.com/torvalds/linux/commit/88095728511e0df9c89528944f5a1762ad298983.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98803","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98803.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98802","title":"seg6: ensure packet data is writable before modifying SRH and IPv6 DA","status":"unfixed","project":false,"upstream":[{"sha":"8ae3f4067ba4ae3a15581392f6dac422e3d3def0","url":"https://git.kernel.org/stable/c/8ae3f4067ba4ae3a15581392f6dac422e3d3def0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8ae3f4067ba4ae3a15581392f6dac422e3d3def0","lines":292,"reason":"","source":"https://github.com/torvalds/linux/commit/8ae3f4067ba4ae3a15581392f6dac422e3d3def0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98802","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98802.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98801","title":"net: restrict SO_RESERVE_MEM to TCP sockets and cap max value","status":"unfixed","project":false,"upstream":[{"sha":"37e02c42a00be692c06343e11779aadc45f45971","url":"https://git.kernel.org/stable/c/37e02c42a00be692c06343e11779aadc45f45971"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"37e02c42a00be692c06343e11779aadc45f45971","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/37e02c42a00be692c06343e11779aadc45f45971.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98801","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98801.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98800","title":"bpf: Wait for an RCU tasks grace period before freeing trampoline progs","status":"unfixed","project":false,"upstream":[{"sha":"0fb5751a6e411b1b466c06e50021818d9391df98","url":"https://git.kernel.org/stable/c/0fb5751a6e411b1b466c06e50021818d9391df98"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fb5751a6e411b1b466c06e50021818d9391df98","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/0fb5751a6e411b1b466c06e50021818d9391df98.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98800","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98800.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98799","title":"bpf: Skip detached progs in trampoline images that are still in use","status":"unfixed","project":false,"upstream":[{"sha":"17637e1a581a22466ac3620a91e099683ff9cc6f","url":"https://git.kernel.org/stable/c/17637e1a581a22466ac3620a91e099683ff9cc6f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"17637e1a581a22466ac3620a91e099683ff9cc6f","lines":955,"reason":"","source":"https://github.com/torvalds/linux/commit/17637e1a581a22466ac3620a91e099683ff9cc6f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98797","title":"net: cap skb->queue_mapping when the tx queue is picked","status":"unfixed","project":false,"upstream":[{"sha":"ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d","url":"https://git.kernel.org/stable/c/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98796","title":"net: ethernet: mtk_eth_soc: allocate dummy netdev sooner","status":"backported","project":false,"upstream":[{"sha":"6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b","url":"https://git.kernel.org/stable/c/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/efc91ab1d97bd991faf50baa0ead35029f341eb9","label":"efc91ab1d97b","date":"2026-10-21T10:26:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98796","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98796.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98795","title":"net: sparx5: skip ptp deinit if init was skipped","status":"unfixed","project":false,"upstream":[{"sha":"0d2c49915bc3aea4521cda5e4d42f24f63b94585","url":"https://git.kernel.org/stable/c/0d2c49915bc3aea4521cda5e4d42f24f63b94585"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0d2c49915bc3aea4521cda5e4d42f24f63b94585","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/0d2c49915bc3aea4521cda5e4d42f24f63b94585.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98795","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98795.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98792","title":"netfilter: flowtable: generalize pending status bit","status":"backported","project":false,"upstream":[{"sha":"7c549fb7eecd01fdba7c0d12c01da876ef8a3214","url":"https://git.kernel.org/stable/c/7c549fb7eecd01fdba7c0d12c01da876ef8a3214"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f7e292f3c8c853f27a1af7eaf3428a0e76fe5fcc","label":"f7e292f3c8c8","date":"2026-10-21T10:26:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c549fb7eecd01fdba7c0d12c01da876ef8a3214","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/7c549fb7eecd01fdba7c0d12c01da876ef8a3214.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98792","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98792.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98789","title":"bpf: Fix objects stuck in free_by_rcu_ttrace","status":"unfixed","project":false,"upstream":[{"sha":"fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043","url":"https://git.kernel.org/stable/c/fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98789","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98789.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98788","title":"futex: Fix private hash use-after-free on resize","status":"not-applicable","project":false,"upstream":[{"sha":"f35e3b5784221654f9cdbd6222275a7fa203f6c3","url":"https://git.kernel.org/stable/c/f35e3b5784221654f9cdbd6222275a7fa203f6c3"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"f35e3b5784221654f9cdbd6222275a7fa203f6c3","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/f35e3b5784221654f9cdbd6222275a7fa203f6c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98788","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98788.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98786","title":"drm/amd/display: guard dc_sink dereferences in MST mode validation","status":"unfixed","project":false,"upstream":[{"sha":"217f64f348c90cba62164e7ff38e0ccf78a5ca09","url":"https://git.kernel.org/stable/c/217f64f348c90cba62164e7ff38e0ccf78a5ca09"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"217f64f348c90cba62164e7ff38e0ccf78a5ca09","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/217f64f348c90cba62164e7ff38e0ccf78a5ca09.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98786","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98786.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98758","title":"usb: typec: ucsi: glink: fix use-after-free of ucsi on remove","status":"unfixed","project":false,"upstream":[{"sha":"63b269ec537dc0fd26d0bd64872c26860d108c9d","url":"https://git.kernel.org/stable/c/63b269ec537dc0fd26d0bd64872c26860d108c9d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"63b269ec537dc0fd26d0bd64872c26860d108c9d","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/63b269ec537dc0fd26d0bd64872c26860d108c9d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98758","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98758.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98747","title":"serial: core: fix NULL pointer dereference in serial_core_unregister_port()","status":"unfixed","project":false,"upstream":[{"sha":"499485a67fbacf4d9afbdb43522388c64f853428","url":"https://git.kernel.org/stable/c/499485a67fbacf4d9afbdb43522388c64f853428"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"499485a67fbacf4d9afbdb43522388c64f853428","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/499485a67fbacf4d9afbdb43522388c64f853428.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98747","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98747.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98740","title":"EDAC/altera: Drop __init from ECC setup paths for re-probe safety","status":"unfixed","project":false,"upstream":[{"sha":"b62a264163ca51bee04785c581344751812395df","url":"https://git.kernel.org/stable/c/b62a264163ca51bee04785c581344751812395df"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b62a264163ca51bee04785c581344751812395df","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/b62a264163ca51bee04785c581344751812395df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98740","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98740.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98738","title":"Bluetooth: Serialize SMP remote OOB data access","status":"backported","project":false,"upstream":[{"sha":"81a2345f1984f0b36d3226571bc196316a01b648","url":"https://git.kernel.org/stable/c/81a2345f1984f0b36d3226571bc196316a01b648"}],"evidence":[{"url":"https://git.kernel.org/stable/c/94afa17d6bfd5c1d367c56c8b63df5f695380861","label":"94afa17d6bfd","date":"2026-10-21T10:27:07+02:00","lore":["https://lore.kernel.org/r/00660cd3-7d71-13a4-f617-229e6defb701@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"81a2345f1984f0b36d3226571bc196316a01b648","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/81a2345f1984f0b36d3226571bc196316a01b648.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98738","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98738.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98737","title":"Bluetooth: hci_sync: Fix inquiry cache use-after-free","status":"backported","project":false,"upstream":[{"sha":"8ed67535fdff40ca652bcd4ac7da68d11d01bd34","url":"https://git.kernel.org/stable/c/8ed67535fdff40ca652bcd4ac7da68d11d01bd34"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ddc9edb244cc8b5266595e8fc220e7813f2b603a","label":"ddc9edb244cc","date":"2026-10-21T10:27:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ed67535fdff40ca652bcd4ac7da68d11d01bd34","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/8ed67535fdff40ca652bcd4ac7da68d11d01bd34.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98737","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98737.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98734","title":"Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown","status":"backported","project":false,"upstream":[{"sha":"848a7a91c7f03675d3bd8db6f7721cbf9cb50e21","url":"https://git.kernel.org/stable/c/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f997e03e2ef58aa7114828c9d924e515a9a1db9c","label":"f997e03e2ef5","date":"2026-10-21T10:27:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"848a7a91c7f03675d3bd8db6f7721cbf9cb50e21","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98734","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98734.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98720","title":"KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified","status":"unfixed","project":false,"upstream":[{"sha":"2abb25273c82061dd4670690c81c319c03740bf6","url":"https://git.kernel.org/stable/c/2abb25273c82061dd4670690c81c319c03740bf6"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2abb25273c82061dd4670690c81c319c03740bf6","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/2abb25273c82061dd4670690c81c319c03740bf6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98720","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98720.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98715","title":"KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN","status":"unfixed","project":false,"upstream":[{"sha":"60d93c27859fb3ec5b5a689e24de303f166477d0","url":"https://git.kernel.org/stable/c/60d93c27859fb3ec5b5a689e24de303f166477d0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"60d93c27859fb3ec5b5a689e24de303f166477d0","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/60d93c27859fb3ec5b5a689e24de303f166477d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98715","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98715.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98714","title":"KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded","status":"unfixed","project":false,"upstream":[{"sha":"e27fc915c8f575ab5630e27d97465c2077d4b9d1","url":"https://git.kernel.org/stable/c/e27fc915c8f575ab5630e27d97465c2077d4b9d1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e27fc915c8f575ab5630e27d97465c2077d4b9d1","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/e27fc915c8f575ab5630e27d97465c2077d4b9d1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98714","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98714.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98692","title":"thunderbolt: Make the DP tunnel activation callback mandatory","status":"not-applicable","project":false,"upstream":[{"sha":"12f5d8b85a66a0ac08d082517d92ce136f8c0d42","url":"https://git.kernel.org/stable/c/12f5d8b85a66a0ac08d082517d92ce136f8c0d42"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"12f5d8b85a66a0ac08d082517d92ce136f8c0d42","lines":243,"reason":"","source":"https://github.com/torvalds/linux/commit/12f5d8b85a66a0ac08d082517d92ce136f8c0d42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98692","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98692.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98685","title":"smb: client: discard post-EOF pagecache when extending a file via clone range","status":"unfixed","project":false,"upstream":[{"sha":"4721587f96cb8de8164f3fd203093a0875560999","url":"https://git.kernel.org/stable/c/4721587f96cb8de8164f3fd203093a0875560999"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4721587f96cb8de8164f3fd203093a0875560999","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/4721587f96cb8de8164f3fd203093a0875560999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98685","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98685.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98684","title":"smb: client: flush and commit data before querying allocated ranges","status":"unfixed","project":false,"upstream":[{"sha":"aa994489bd835547c191827acc460192e147032d","url":"https://git.kernel.org/stable/c/aa994489bd835547c191827acc460192e147032d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa994489bd835547c191827acc460192e147032d","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/aa994489bd835547c191827acc460192e147032d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98684","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98684.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98683","title":"smb: client: flush dirty data before zeroing a range","status":"unfixed","project":false,"upstream":[{"sha":"8f8d32c1044f70e46e87550e039a15ff20a4b21c","url":"https://git.kernel.org/stable/c/8f8d32c1044f70e46e87550e039a15ff20a4b21c"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f8d32c1044f70e46e87550e039a15ff20a4b21c","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/8f8d32c1044f70e46e87550e039a15ff20a4b21c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98683","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98683.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98682","title":"smb: client: drain and invalidate before server-side copy/clone","status":"unfixed","project":false,"upstream":[{"sha":"c9b1194e8ec99d95db25db45edd2fbf690f043ab","url":"https://git.kernel.org/stable/c/c9b1194e8ec99d95db25db45edd2fbf690f043ab"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c9b1194e8ec99d95db25db45edd2fbf690f043ab","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/c9b1194e8ec99d95db25db45edd2fbf690f043ab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98682","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98682.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98674","title":"iio: adc: adi-axi-adc: Initialize state mutex","status":"not-applicable","project":false,"upstream":[{"sha":"549b71ce050637dd32678371ad76c445a2f8c9aa","url":"https://git.kernel.org/stable/c/549b71ce050637dd32678371ad76c445a2f8c9aa"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"549b71ce050637dd32678371ad76c445a2f8c9aa","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/549b71ce050637dd32678371ad76c445a2f8c9aa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98674","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98674.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98665","title":"iio: health: max30102: fix NULL dereference in interrupt handler","status":"backported","project":false,"upstream":[{"sha":"f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d","url":"https://git.kernel.org/stable/c/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2a74f30a7bb305cdc5c3e3e9239b32bb84f3529f","label":"2a74f30a7bb3","date":"2026-10-21T10:27:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98665","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98665.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98661","title":"iio: light: rohm-bu27034: Fix infinite delay on error","status":"unknown","project":false,"upstream":[{"sha":"8065a6c02f629187131f3136bedb26f9080e3cca","url":"https://git.kernel.org/stable/c/8065a6c02f629187131f3136bedb26f9080e3cca"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"over-limit","patches":[{"sha":"8065a6c02f629187131f3136bedb26f9080e3cca","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/8065a6c02f629187131f3136bedb26f9080e3cca.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98652","title":"KVM: s390: Add missing srcu in kvm_s390_set_irq_state()","status":"unknown","project":false,"upstream":[{"sha":"f3a557067d57ce6ae98d485c8009b223e16f5f36","url":"https://git.kernel.org/stable/c/f3a557067d57ce6ae98d485c8009b223e16f5f36"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"f3a557067d57ce6ae98d485c8009b223e16f5f36","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/f3a557067d57ce6ae98d485c8009b223e16f5f36.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98652","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98652.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98642","title":"bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk","status":"unfixed","project":false,"upstream":[{"sha":"1c21452d02eec2f008e2c5535820f85adbd7587a","url":"https://git.kernel.org/stable/c/1c21452d02eec2f008e2c5535820f85adbd7587a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c21452d02eec2f008e2c5535820f85adbd7587a","lines":94,"reason":"","source":"https://github.com/torvalds/linux/commit/1c21452d02eec2f008e2c5535820f85adbd7587a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98642","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98642.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98634","title":"scsi: sd_zbc: Reject disks with too many zones","status":"unfixed","project":false,"upstream":[{"sha":"b6ec0f79745967c751c85df373062c8d15e45fc4","url":"https://git.kernel.org/stable/c/b6ec0f79745967c751c85df373062c8d15e45fc4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b6ec0f79745967c751c85df373062c8d15e45fc4","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/b6ec0f79745967c751c85df373062c8d15e45fc4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98628","title":"bpf: Make post-verification instruction rewrites killable","status":"unfixed","project":false,"upstream":[{"sha":"261b61d3735b042ae25634f795c4540be0fc140c","url":"https://git.kernel.org/stable/c/261b61d3735b042ae25634f795c4540be0fc140c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"261b61d3735b042ae25634f795c4540be0fc140c","lines":113,"reason":"","source":"https://github.com/torvalds/linux/commit/261b61d3735b042ae25634f795c4540be0fc140c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98628","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98628.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98620","title":"net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure","status":"backported","project":false,"upstream":[{"sha":"310d1ac61a4d5a2ca8356a3a48d263acf54503ce","url":"https://git.kernel.org/stable/c/310d1ac61a4d5a2ca8356a3a48d263acf54503ce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/245bea0c7ab278150c70366bdeb69b901327133c","label":"245bea0c7ab2","date":"2026-10-03T12:31:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"310d1ac61a4d5a2ca8356a3a48d263acf54503ce","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/310d1ac61a4d5a2ca8356a3a48d263acf54503ce.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98620","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98620.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98617","title":"eth: fbnic: use the Rx queue napi pointer to find the napi vector","status":"not-applicable","project":false,"upstream":[{"sha":"b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e","url":"https://git.kernel.org/stable/c/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98617","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98617.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98616","title":"eth: fbnic: reset num_napi when the napi vectors are freed","status":"not-applicable","project":false,"upstream":[{"sha":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","url":"https://git.kernel.org/stable/c/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98616","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98616.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98599","title":"bpf: Reject non-negative offsets in stack_slot_obj_get_spi()","status":"unfixed","project":false,"upstream":[{"sha":"79a9172f3ab4ad8392c5e5c8944b9b7710ade620","url":"https://git.kernel.org/stable/c/79a9172f3ab4ad8392c5e5c8944b9b7710ade620"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"79a9172f3ab4ad8392c5e5c8944b9b7710ade620","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/79a9172f3ab4ad8392c5e5c8944b9b7710ade620.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98599","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98599.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98598","title":"ipv6: Prevent rt6_insert_exception() for dying fib6_info.","status":"unfixed","project":false,"upstream":[{"sha":"0346ec2f080b40d95ed05b853bb9226289e75212","url":"https://git.kernel.org/stable/c/0346ec2f080b40d95ed05b853bb9226289e75212"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0346ec2f080b40d95ed05b853bb9226289e75212","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/0346ec2f080b40d95ed05b853bb9226289e75212.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98598","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98598.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98589","title":"bpf: Reject pkt arguments in mutating subprogs","status":"unfixed","project":false,"upstream":[{"sha":"a6c1edfbe240e4377038a0e1d233ad81fde9a21b","url":"https://git.kernel.org/stable/c/a6c1edfbe240e4377038a0e1d233ad81fde9a21b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6c1edfbe240e4377038a0e1d233ad81fde9a21b","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/a6c1edfbe240e4377038a0e1d233ad81fde9a21b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98589","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98589.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98570","title":"net: ipv6: keep room for the mac header in dst_dev_overhead()","status":"unfixed","project":false,"upstream":[{"sha":"87cd6b717e4069dca34e0866e57eaeb44d3b173e","url":"https://git.kernel.org/stable/c/87cd6b717e4069dca34e0866e57eaeb44d3b173e"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"87cd6b717e4069dca34e0866e57eaeb44d3b173e","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/87cd6b717e4069dca34e0866e57eaeb44d3b173e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98570","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98570.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98565","title":"net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621","status":"backported","project":false,"upstream":[{"sha":"c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4","url":"https://git.kernel.org/stable/c/c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bd172580e624bac00d83abd5c4320d2e14d853bc","label":"bd172580e624","date":"2026-10-03T12:31:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98565","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98565.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98562","title":"net: libwx: fix races in Tx timestamp handling","status":"not-applicable","project":false,"upstream":[{"sha":"3173cba1170131816972ed2b6185cb970ba8b747","url":"https://git.kernel.org/stable/c/3173cba1170131816972ed2b6185cb970ba8b747"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"3173cba1170131816972ed2b6185cb970ba8b747","lines":295,"reason":"","source":"https://github.com/torvalds/linux/commit/3173cba1170131816972ed2b6185cb970ba8b747.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98562","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98562.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98558","title":"net: flush skb_defer_nodes in dev_cpu_dead()","status":"unfixed","project":false,"upstream":[{"sha":"06e3f54e8b22040ada01a28343badf1990b4dd7d","url":"https://git.kernel.org/stable/c/06e3f54e8b22040ada01a28343badf1990b4dd7d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"06e3f54e8b22040ada01a28343badf1990b4dd7d","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/06e3f54e8b22040ada01a28343badf1990b4dd7d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98558","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98558.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98556","title":"gve: DQO: reject TSO packets with an out of range MSS","status":"unfixed","project":false,"upstream":[{"sha":"296c83b5ccc808c080865eb20fd7a477b0355bb7","url":"https://git.kernel.org/stable/c/296c83b5ccc808c080865eb20fd7a477b0355bb7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"296c83b5ccc808c080865eb20fd7a477b0355bb7","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/296c83b5ccc808c080865eb20fd7a477b0355bb7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98556","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98556.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98551","title":"perf/core: Fill branch entries with a single assignment","status":"unfixed","project":false,"upstream":[{"sha":"24b620729e53d978b3e425f55bc66efd3bab1f59","url":"https://git.kernel.org/stable/c/24b620729e53d978b3e425f55bc66efd3bab1f59"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"24b620729e53d978b3e425f55bc66efd3bab1f59","lines":163,"reason":"","source":"https://github.com/torvalds/linux/commit/24b620729e53d978b3e425f55bc66efd3bab1f59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98551","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98551.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98539","title":"fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga","status":"unfixed","project":false,"upstream":[{"sha":"1abd643f3783ea8f8e273c18697ff0413aa92dc7","url":"https://git.kernel.org/stable/c/1abd643f3783ea8f8e273c18697ff0413aa92dc7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1abd643f3783ea8f8e273c18697ff0413aa92dc7","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/1abd643f3783ea8f8e273c18697ff0413aa92dc7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98539","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98539.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98525","title":"mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()","status":"unfixed","project":false,"upstream":[{"sha":"26cc0e69cce062cd3aa6fae33074684669c35a71","url":"https://git.kernel.org/stable/c/26cc0e69cce062cd3aa6fae33074684669c35a71"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"26cc0e69cce062cd3aa6fae33074684669c35a71","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/26cc0e69cce062cd3aa6fae33074684669c35a71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98525","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98525.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98509","title":"drm/virtio: fix memory leak of fence event on execbuffer failure","status":"backported","project":false,"upstream":[{"sha":"b74aad23d99b279bb34d135795f39a6d8ecdc075","url":"https://git.kernel.org/stable/c/b74aad23d99b279bb34d135795f39a6d8ecdc075"}],"evidence":[{"url":"https://git.kernel.org/stable/c/43bfe2b60c149bf6effda25f245a00509061fa15","label":"43bfe2b60c14","date":"2026-10-03T12:31:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b74aad23d99b279bb34d135795f39a6d8ecdc075","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/b74aad23d99b279bb34d135795f39a6d8ecdc075.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98509","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98509.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98508","title":"drm/virtio: fix NULL pointer dereference on fence allocation failure","status":"backported","project":false,"upstream":[{"sha":"846b3c64fe3e77d9db20a7e3e62dbbb637c773e1","url":"https://git.kernel.org/stable/c/846b3c64fe3e77d9db20a7e3e62dbbb637c773e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9571ab7493561afb4624d69572a7ebb67d76d10f","label":"9571ab749356","date":"2026-10-03T12:31:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"846b3c64fe3e77d9db20a7e3e62dbbb637c773e1","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/846b3c64fe3e77d9db20a7e3e62dbbb637c773e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98508","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98508.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98506","title":"mm/hugetlb: do not dissolve gigantic pages without runtime support","status":"unfixed","project":false,"upstream":[{"sha":"a363c62a653cc8b3e21da9545fa4e028ef50f9c3","url":"https://git.kernel.org/stable/c/a363c62a653cc8b3e21da9545fa4e028ef50f9c3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a363c62a653cc8b3e21da9545fa4e028ef50f9c3","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/a363c62a653cc8b3e21da9545fa4e028ef50f9c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98506","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98506.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98505","title":"mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()","status":"backported","project":false,"upstream":[{"sha":"39c0ceedd54557bdc1542de08d22b2ed33e534e4","url":"https://git.kernel.org/stable/c/39c0ceedd54557bdc1542de08d22b2ed33e534e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7ed1062d154ec2401f2c894fd6858598bb1160b6","label":"7ed1062d154e","date":"2026-10-21T10:26:51+02:00","lore":["https://lore.kernel.org/20260830160545.98969-1-sj@kernel.org","https://lore.kernel.org/20260907170358.100168-1-sj@kernel.org"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"39c0ceedd54557bdc1542de08d22b2ed33e534e4","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/39c0ceedd54557bdc1542de08d22b2ed33e534e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98505","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98505.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98503","title":"packet: use ubuf_info completion for TX_RING packets","status":"unfixed","project":false,"upstream":[{"sha":"9518405613863d0bf0700927a21367f5942cf058","url":"https://git.kernel.org/stable/c/9518405613863d0bf0700927a21367f5942cf058"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"9518405613863d0bf0700927a21367f5942cf058","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/9518405613863d0bf0700927a21367f5942cf058.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98503","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98503.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98473","title":"s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config","status":"unfixed","project":false,"upstream":[{"sha":"65e05ec252a9b79e75930d3c4dd42d8877db04c5","url":"https://git.kernel.org/stable/c/65e05ec252a9b79e75930d3c4dd42d8877db04c5"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"65e05ec252a9b79e75930d3c4dd42d8877db04c5","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/65e05ec252a9b79e75930d3c4dd42d8877db04c5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98473","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98473.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98471","title":"KVM: SEV: Do cache maintenance on the source VM during intra-host migration","status":"unfixed","project":false,"upstream":[{"sha":"93de2a6a4b91b72607136dd656edf03fb399d27f","url":"https://git.kernel.org/stable/c/93de2a6a4b91b72607136dd656edf03fb399d27f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"93de2a6a4b91b72607136dd656edf03fb399d27f","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/93de2a6a4b91b72607136dd656edf03fb399d27f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98471","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98471.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98466","title":"KVM: arm64: Transfer the hyp stack pages out of the host stage-2","status":"unfixed","project":false,"upstream":[{"sha":"3a8c562892b96f35bba1e00d5e455a15963bbb92","url":"https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a8c562892b96f35bba1e00d5e455a15963bbb92","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/3a8c562892b96f35bba1e00d5e455a15963bbb92.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98466","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98466.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98458","title":"Bluetooth: ISO: release unused CIS holds after channel attach","status":"unfixed","project":false,"upstream":[{"sha":"0fcd4dad555c96e0bd3a1b8c569f989be85c7341","url":"https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fcd4dad555c96e0bd3a1b8c569f989be85c7341","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/0fcd4dad555c96e0bd3a1b8c569f989be85c7341.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98458","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98458.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98452","title":"smb: client: clean up failed cached directory opens","status":"unfixed","project":false,"upstream":[{"sha":"d2ff5fb93ea83034025850266b5eed391f96b825","url":"https://git.kernel.org/stable/c/d2ff5fb93ea83034025850266b5eed391f96b825"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2ff5fb93ea83034025850266b5eed391f96b825","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/d2ff5fb93ea83034025850266b5eed391f96b825.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98452","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98452.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98449","title":"smb: client: delete compound mids on send failure before unlock","status":"unfixed","project":false,"upstream":[{"sha":"8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9","url":"https://git.kernel.org/stable/c/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98444","title":"xfs: drop dquot flush lock when we can't find a buffer to flush","status":"not-applicable","project":false,"upstream":[{"sha":"ffb48dccce1960a9ea24463a2f3c21d124d6b672","url":"https://git.kernel.org/stable/c/ffb48dccce1960a9ea24463a2f3c21d124d6b672"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ffb48dccce1960a9ea24463a2f3c21d124d6b672","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/ffb48dccce1960a9ea24463a2f3c21d124d6b672.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98444","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98444.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98439","title":"smb/server: cancel async requests when closing connection","status":"unfixed","project":false,"upstream":[{"sha":"4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851","url":"https://git.kernel.org/stable/c/4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98439","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98439.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98436","title":"accel/amdxdna: Disable device buffer exporting","status":"not-applicable","project":false,"upstream":[{"sha":"9480dd7ec3fcadd4217503e4bb32c16e19e4b21f","url":"https://git.kernel.org/stable/c/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"9480dd7ec3fcadd4217503e4bb32c16e19e4b21f","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98436","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98436.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98435","title":"EDAC/altera: Use parent device for devres in altr_portb_setup()","status":"unfixed","project":false,"upstream":[{"sha":"9868f5c077dfe0b606331f2e782484f91a5789a5","url":"https://git.kernel.org/stable/c/9868f5c077dfe0b606331f2e782484f91a5789a5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9868f5c077dfe0b606331f2e782484f91a5789a5","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/9868f5c077dfe0b606331f2e782484f91a5789a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98435","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98435.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98431","title":"RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency","status":"not-applicable","project":false,"upstream":[{"sha":"a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","url":"https://git.kernel.org/stable/c/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98431","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98431.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98427","title":"net/sched: codel: bound the dropping loop per dequeue call","status":"unfixed","project":false,"upstream":[{"sha":"7f4a5ec6258fd7c92633ec4b0493fc51166d9398","url":"https://git.kernel.org/stable/c/7f4a5ec6258fd7c92633ec4b0493fc51166d9398"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f4a5ec6258fd7c92633ec4b0493fc51166d9398","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7f4a5ec6258fd7c92633ec4b0493fc51166d9398.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98427","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98427.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98425","title":"wifi: mac80211: don't warn when an IBSS has no channel to scan","status":"unfixed","project":false,"upstream":[{"sha":"a7491b7efbd9136b120a12ed72af9c12121dd134","url":"https://git.kernel.org/stable/c/a7491b7efbd9136b120a12ed72af9c12121dd134"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a7491b7efbd9136b120a12ed72af9c12121dd134","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/a7491b7efbd9136b120a12ed72af9c12121dd134.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98425","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98425.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98424","title":"wifi: cfg80211: undo netns switch if renaming the wiphy fails","status":"unfixed","project":false,"upstream":[{"sha":"a41bd1938a9bfe226d444172a7e20e4bd5097960","url":"https://git.kernel.org/stable/c/a41bd1938a9bfe226d444172a7e20e4bd5097960"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"a41bd1938a9bfe226d444172a7e20e4bd5097960","lines":117,"reason":"","source":"https://github.com/torvalds/linux/commit/a41bd1938a9bfe226d444172a7e20e4bd5097960.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98420","title":"ksmbd: follow SMB2 session expiration semantics","status":"unfixed","project":false,"upstream":[{"sha":"d7fd1f98607f2cd358e583f9548bdf0173090a86","url":"https://git.kernel.org/stable/c/d7fd1f98607f2cd358e583f9548bdf0173090a86"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d7fd1f98607f2cd358e583f9548bdf0173090a86","lines":441,"reason":"","source":"https://github.com/torvalds/linux/commit/d7fd1f98607f2cd358e583f9548bdf0173090a86.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98420","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98420.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98408","title":"watchdog: rzv2h: Avoid division by zero","status":"not-applicable","project":false,"upstream":[{"sha":"6274281c41efa8dd1aa5234c59ad904ff89d7af4","url":"https://git.kernel.org/stable/c/6274281c41efa8dd1aa5234c59ad904ff89d7af4"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"6274281c41efa8dd1aa5234c59ad904ff89d7af4","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/6274281c41efa8dd1aa5234c59ad904ff89d7af4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98408","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98408.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98403","title":"s390/boot: Avoid IPL parameter append past command line","status":"unfixed","project":false,"upstream":[{"sha":"d76181dfabdaa720703167393704efacba343442","url":"https://git.kernel.org/stable/c/d76181dfabdaa720703167393704efacba343442"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d76181dfabdaa720703167393704efacba343442","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/d76181dfabdaa720703167393704efacba343442.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98403","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98403.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98401","title":"net: iptunnel: fix stale transport header during tunnel decapsulation","status":"unfixed","project":false,"upstream":[{"sha":"28a57fb2c5df4deb42a06e52fd36c14b37aa0034","url":"https://git.kernel.org/stable/c/28a57fb2c5df4deb42a06e52fd36c14b37aa0034"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"28a57fb2c5df4deb42a06e52fd36c14b37aa0034","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/28a57fb2c5df4deb42a06e52fd36c14b37aa0034.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98401","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98401.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98400","title":"s390/ipl: Fix NULL deref in kdump without re-IPL parm block","status":"backported","project":false,"upstream":[{"sha":"7f918871112e8e7c581e99eb8e545af4e59c8367","url":"https://git.kernel.org/stable/c/7f918871112e8e7c581e99eb8e545af4e59c8367"}],"evidence":[{"url":"https://git.kernel.org/stable/c/030e88812435fc5d6aa42eee41fa77b5ea620327","label":"030e88812435","date":"2026-10-03T12:30:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f918871112e8e7c581e99eb8e545af4e59c8367","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7f918871112e8e7c581e99eb8e545af4e59c8367.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98400.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98399","title":"s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block","status":"backported","project":false,"upstream":[{"sha":"37f61b71cbc0caefc01022a19ee56fc2510e2e6e","url":"https://git.kernel.org/stable/c/37f61b71cbc0caefc01022a19ee56fc2510e2e6e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/41647864e62b28388ecccc23a82f0e0a091f4ef2","label":"41647864e62b","date":"2026-10-03T12:30:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"37f61b71cbc0caefc01022a19ee56fc2510e2e6e","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/37f61b71cbc0caefc01022a19ee56fc2510e2e6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98399","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98399.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98394","title":"af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.","status":"unfixed","project":false,"upstream":[{"sha":"6e5ee08eb5858d175da6768d75d163817b6a9d4a","url":"https://git.kernel.org/stable/c/6e5ee08eb5858d175da6768d75d163817b6a9d4a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6e5ee08eb5858d175da6768d75d163817b6a9d4a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/6e5ee08eb5858d175da6768d75d163817b6a9d4a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98394","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98394.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98393","title":"net: ipv4: Fix UDP length overflow with PMTU discover and big MTU","status":"unfixed","project":false,"upstream":[{"sha":"b83641e0ab8b20eefcc4cdc5a059f897375291a2","url":"https://git.kernel.org/stable/c/b83641e0ab8b20eefcc4cdc5a059f897375291a2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b83641e0ab8b20eefcc4cdc5a059f897375291a2","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b83641e0ab8b20eefcc4cdc5a059f897375291a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98393","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98393.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98387","title":"s390/crypto: Fix skcipher_walk return code handling in aes_s390","status":"unfixed","project":false,"upstream":[{"sha":"15fa028589c3a2545f0bff355eff06d5844196bf","url":"https://git.kernel.org/stable/c/15fa028589c3a2545f0bff355eff06d5844196bf"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"15fa028589c3a2545f0bff355eff06d5844196bf","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/15fa028589c3a2545f0bff355eff06d5844196bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98387","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98387.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98376","title":"bpf: Use array_map_meta_equal for percpu array inner map replacement","status":"not-applicable","project":false,"upstream":[{"sha":"593980175389a05793f6060aa20e626330960395","url":"https://git.kernel.org/stable/c/593980175389a05793f6060aa20e626330960395"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"593980175389a05793f6060aa20e626330960395","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/593980175389a05793f6060aa20e626330960395.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98376","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98376.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98365","title":"RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access","status":"backported","project":false,"upstream":[{"sha":"d10e2a08799e858d3e71ea4169bcd018f216d444","url":"https://git.kernel.org/stable/c/d10e2a08799e858d3e71ea4169bcd018f216d444"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b7d2118660545a00b21e83010ded1a231c6fb8c5","label":"b7d211866054","date":"2026-10-03T12:30:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d10e2a08799e858d3e71ea4169bcd018f216d444","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d10e2a08799e858d3e71ea4169bcd018f216d444.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98365","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98365.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98364","title":"xfrm: hold net_device reference under RCU in bundle creation","status":"unfixed","project":false,"upstream":[{"sha":"9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","url":"https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98364","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98364.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98355","title":"RDMA/rtrs: guard against null kobj name","status":"unfixed","project":false,"upstream":[{"sha":"99c24a8968ebef0573825b5cb89d5985d51635b9","url":"https://git.kernel.org/stable/c/99c24a8968ebef0573825b5cb89d5985d51635b9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"99c24a8968ebef0573825b5cb89d5985d51635b9","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/99c24a8968ebef0573825b5cb89d5985d51635b9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98353","title":"RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables","status":"unfixed","project":false,"upstream":[{"sha":"00baeade709fb66da647e8327e8398bb532e30f7","url":"https://git.kernel.org/stable/c/00baeade709fb66da647e8327e8398bb532e30f7"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00baeade709fb66da647e8327e8398bb532e30f7","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/00baeade709fb66da647e8327e8398bb532e30f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98353","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98353.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98341","title":"wifi: cfg80211: don't free driver-owned scan requests","status":"unfixed","project":false,"upstream":[{"sha":"dab68a74e90b8e07f08ed9deaa5884857a3cfe89","url":"https://git.kernel.org/stable/c/dab68a74e90b8e07f08ed9deaa5884857a3cfe89"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"dab68a74e90b8e07f08ed9deaa5884857a3cfe89","lines":100,"reason":"","source":"https://github.com/torvalds/linux/commit/dab68a74e90b8e07f08ed9deaa5884857a3cfe89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98341","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98341.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98338","title":"wifi: cfg80211: ibss: ref BSS entry for joined event","status":"unfixed","project":false,"upstream":[{"sha":"708f9d43d6a2eb9c6b83fe62af628de9dffd9314","url":"https://git.kernel.org/stable/c/708f9d43d6a2eb9c6b83fe62af628de9dffd9314"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"708f9d43d6a2eb9c6b83fe62af628de9dffd9314","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/708f9d43d6a2eb9c6b83fe62af628de9dffd9314.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98338","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98338.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98337","title":"wifi: mac80211: don't start a ROC while scanning","status":"unfixed","project":false,"upstream":[{"sha":"733f0fde95392ed5f61a4e36aee661ea8d0e8581","url":"https://git.kernel.org/stable/c/733f0fde95392ed5f61a4e36aee661ea8d0e8581"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"733f0fde95392ed5f61a4e36aee661ea8d0e8581","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/733f0fde95392ed5f61a4e36aee661ea8d0e8581.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98335","title":"wifi: mac80211: abort chanswitch when leaving a mesh","status":"unfixed","project":false,"upstream":[{"sha":"ac7472a24bd433b81c06582835dd1d5547c10da9","url":"https://git.kernel.org/stable/c/ac7472a24bd433b81c06582835dd1d5547c10da9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac7472a24bd433b81c06582835dd1d5547c10da9","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/ac7472a24bd433b81c06582835dd1d5547c10da9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98335","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98335.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98334","title":"wifi: mac80211: reset state when starting AP fails","status":"unfixed","project":false,"upstream":[{"sha":"3f28551d0241254a75626d868041c6340285088b","url":"https://git.kernel.org/stable/c/3f28551d0241254a75626d868041c6340285088b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f28551d0241254a75626d868041c6340285088b","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/3f28551d0241254a75626d868041c6340285088b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98333","title":"wifi: mac80211: reset the LED state when ifup fails","status":"unfixed","project":false,"upstream":[{"sha":"78183e8331958fda11cd2b6850bb424a9747c4b2","url":"https://git.kernel.org/stable/c/78183e8331958fda11cd2b6850bb424a9747c4b2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"78183e8331958fda11cd2b6850bb424a9747c4b2","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/78183e8331958fda11cd2b6850bb424a9747c4b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98332","title":"wifi: mac80211: only operate on TDLS peers in the TDLS code","status":"unfixed","project":false,"upstream":[{"sha":"6f0a100df8539ce90f37c14e1945f396ca2410bc","url":"https://git.kernel.org/stable/c/6f0a100df8539ce90f37c14e1945f396ca2410bc"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f0a100df8539ce90f37c14e1945f396ca2410bc","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/6f0a100df8539ce90f37c14e1945f396ca2410bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98332","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98332.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98330","title":"wifi: cfg80211: get the wiphy out of a dying network namespace","status":"unfixed","project":false,"upstream":[{"sha":"4635b1a1c1d693178a537446a6e09963f0fdae52","url":"https://git.kernel.org/stable/c/4635b1a1c1d693178a537446a6e09963f0fdae52"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4635b1a1c1d693178a537446a6e09963f0fdae52","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/4635b1a1c1d693178a537446a6e09963f0fdae52.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98330","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98330.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98329","title":"wifi: mac80211: don't allow injecting frames wider than the chanctx","status":"unfixed","project":false,"upstream":[{"sha":"e14bf37bb2b3853012ff160131d1c6233f7a9cc9","url":"https://git.kernel.org/stable/c/e14bf37bb2b3853012ff160131d1c6233f7a9cc9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e14bf37bb2b3853012ff160131d1c6233f7a9cc9","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/e14bf37bb2b3853012ff160131d1c6233f7a9cc9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98329","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98329.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98327","title":"wifi: mac80211: mesh: reset the CSA state when leaving","status":"unfixed","project":false,"upstream":[{"sha":"860134b3af77970e006feab7e5decb8c84771c7f","url":"https://git.kernel.org/stable/c/860134b3af77970e006feab7e5decb8c84771c7f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"860134b3af77970e006feab7e5decb8c84771c7f","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/860134b3af77970e006feab7e5decb8c84771c7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98327","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98327.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98321","title":"netfilter: nf_nat: unregister and release hooks on error","status":"unfixed","project":false,"upstream":[{"sha":"cbdd39ce42530a193c56beb206a3356cb6d01016","url":"https://git.kernel.org/stable/c/cbdd39ce42530a193c56beb206a3356cb6d01016"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cbdd39ce42530a193c56beb206a3356cb6d01016","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/cbdd39ce42530a193c56beb206a3356cb6d01016.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98321","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98321.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98318","title":"smb: client: validate absolute native symlink targets before NT fixups","status":"not-applicable","project":false,"upstream":[{"sha":"23c240d9509e15f72e4112fc95f0160ab32ec430","url":"https://git.kernel.org/stable/c/23c240d9509e15f72e4112fc95f0160ab32ec430"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"23c240d9509e15f72e4112fc95f0160ab32ec430","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/23c240d9509e15f72e4112fc95f0160ab32ec430.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98318","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98318.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98317","title":"neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.","status":"unfixed","project":false,"upstream":[{"sha":"6d79b223ec44ada58ad37db42f539b60985a7722","url":"https://git.kernel.org/stable/c/6d79b223ec44ada58ad37db42f539b60985a7722"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6d79b223ec44ada58ad37db42f539b60985a7722","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/6d79b223ec44ada58ad37db42f539b60985a7722.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98313","title":"drm/msm/dp: skip PUSH_IDLE when the link was never enabled","status":"unfixed","project":false,"upstream":[{"sha":"e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","url":"https://git.kernel.org/stable/c/e249a6e2a130c08bb4d8b0a55cbe29754307e5c9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/e249a6e2a130c08bb4d8b0a55cbe29754307e5c9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98309","title":"drm/vc4: Use managed KMS polling to fix UAF on unbind","status":"backported","project":false,"upstream":[{"sha":"073a30d75f309812ed61af134f24ffef4107b13a","url":"https://git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b6beee927e7f4e3142032ff91b2d0417cdddc0f6","label":"b6beee927e7f","date":"2026-10-03T12:30:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"073a30d75f309812ed61af134f24ffef4107b13a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/073a30d75f309812ed61af134f24ffef4107b13a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98309","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98309.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98307","title":"wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()","status":"unfixed","project":false,"upstream":[{"sha":"820b8cff81c796ba20573e04722ab62500713f97","url":"https://git.kernel.org/stable/c/820b8cff81c796ba20573e04722ab62500713f97"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"820b8cff81c796ba20573e04722ab62500713f97","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/820b8cff81c796ba20573e04722ab62500713f97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98307","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98307.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98304","title":"net: bcmgenet: restore the hardware filters on open","status":"unfixed","project":false,"upstream":[{"sha":"23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","url":"https://git.kernel.org/stable/c/23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98304","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98304.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98297","title":"Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained","status":"backported","project":true,"upstream":[{"sha":"6610c6fe4b8936c232048e6049bf77c70a6f759c","url":"https://git.kernel.org/stable/c/6610c6fe4b8936c232048e6049bf77c70a6f759c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8010212197d4a3ee714f78ed77048d0b712ff925","label":"8010212197d4","date":"2026-10-21T10:28:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"unknown","patches":[{"sha":"6610c6fe4b8936c232048e6049bf77c70a6f759c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98297.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98296","title":"Bluetooth: btintel_pcie: validate TX skb length in send_sync","status":"not-applicable","project":false,"upstream":[{"sha":"4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","url":"https://git.kernel.org/stable/c/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98296","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98296.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98295","title":"Bluetooth: coredump: Quiesce dump work on unregister","status":"unfixed","project":false,"upstream":[{"sha":"d236517c264e41dc09833c708ef23bccb7a91219","url":"https://git.kernel.org/stable/c/d236517c264e41dc09833c708ef23bccb7a91219"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d236517c264e41dc09833c708ef23bccb7a91219","lines":128,"reason":"","source":"https://github.com/torvalds/linux/commit/d236517c264e41dc09833c708ef23bccb7a91219.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98295","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98295.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98294","title":"Bluetooth: hci_qca: Do not write to the serial port after it is closed","status":"unfixed","project":false,"upstream":[{"sha":"4e93c65f87825e1e012bce56615320aeb123815d","url":"https://git.kernel.org/stable/c/4e93c65f87825e1e012bce56615320aeb123815d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4e93c65f87825e1e012bce56615320aeb123815d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/4e93c65f87825e1e012bce56615320aeb123815d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98294","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98294.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98292","title":"Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access","status":"unfixed","project":false,"upstream":[{"sha":"8879e3e0a84a86954c855caceead4867e74a9a27","url":"https://git.kernel.org/stable/c/8879e3e0a84a86954c855caceead4867e74a9a27"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8879e3e0a84a86954c855caceead4867e74a9a27","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/8879e3e0a84a86954c855caceead4867e74a9a27.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98292","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98292.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98289","title":"af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().","status":"unfixed","project":false,"upstream":[{"sha":"4a4263dfeabad72f95e8ab6e15146861fa4144dd","url":"https://git.kernel.org/stable/c/4a4263dfeabad72f95e8ab6e15146861fa4144dd"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4a4263dfeabad72f95e8ab6e15146861fa4144dd","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/4a4263dfeabad72f95e8ab6e15146861fa4144dd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98288","title":"net: stmmac: fix TSO header length truncation","status":"unfixed","project":false,"upstream":[{"sha":"15989abd74f16f44bf953d056b95f1d2fda9b0cd","url":"https://git.kernel.org/stable/c/15989abd74f16f44bf953d056b95f1d2fda9b0cd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"15989abd74f16f44bf953d056b95f1d2fda9b0cd","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/15989abd74f16f44bf953d056b95f1d2fda9b0cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98286","title":"drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown","status":"unfixed","project":false,"upstream":[{"sha":"c391a40f71886b28c082b47270f0e856fa3e1150","url":"https://git.kernel.org/stable/c/c391a40f71886b28c082b47270f0e856fa3e1150"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c391a40f71886b28c082b47270f0e856fa3e1150","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/c391a40f71886b28c082b47270f0e856fa3e1150.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98286","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98286.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98285","title":"net: bridge: vlan: fix bugs caused by switchdev deletion errors","status":"unfixed","project":false,"upstream":[{"sha":"2842ce397dd09882530b42f7fdb0c855767eb24e","url":"https://git.kernel.org/stable/c/2842ce397dd09882530b42f7fdb0c855767eb24e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2842ce397dd09882530b42f7fdb0c855767eb24e","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/2842ce397dd09882530b42f7fdb0c855767eb24e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98285","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98285.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98284","title":"netlink: do not free nlk->groups while lockless readers can use it","status":"unfixed","project":false,"upstream":[{"sha":"ceac0de741bfb47ca255eee075257b3bb31f0651","url":"https://git.kernel.org/stable/c/ceac0de741bfb47ca255eee075257b3bb31f0651"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ceac0de741bfb47ca255eee075257b3bb31f0651","lines":101,"reason":"","source":"https://github.com/torvalds/linux/commit/ceac0de741bfb47ca255eee075257b3bb31f0651.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98284","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98284.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98279","title":"btrfs: handle lack of space when cleaning up verity items","status":"unfixed","project":false,"upstream":[{"sha":"76bf149cd0298544631e756670b89c399c7acbca","url":"https://git.kernel.org/stable/c/76bf149cd0298544631e756670b89c399c7acbca"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"76bf149cd0298544631e756670b89c399c7acbca","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/76bf149cd0298544631e756670b89c399c7acbca.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98279","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98279.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98277","title":"eth: fbnic: ring the doorbell if a burst ends in a drop","status":"not-applicable","project":false,"upstream":[{"sha":"490599ab23134962a6d18a024e84541d77bdb999","url":"https://git.kernel.org/stable/c/490599ab23134962a6d18a024e84541d77bdb999"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"490599ab23134962a6d18a024e84541d77bdb999","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/490599ab23134962a6d18a024e84541d77bdb999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98277","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98277.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98273","title":"x86/kprobes: Fix crash when probing CS CALL instructions","status":"unfixed","project":false,"upstream":[{"sha":"a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","url":"https://git.kernel.org/stable/c/a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98273","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98273.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98271","title":"net: skbuff: do not leave stale header offsets after pskb_carve()","status":"unfixed","project":false,"upstream":[{"sha":"a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","url":"https://git.kernel.org/stable/c/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98271","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98271.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98269","title":"btrfs: abort transaction on failure to update inode for hole punching and reflinking","status":"backported","project":false,"upstream":[{"sha":"97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","url":"https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d","label":"2605eb9ba3bb","date":"2026-10-03T12:30:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98269","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98269.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98266","title":"ALSA: core: Fix potential UAF after asynchronous card release","status":"unfixed","project":false,"upstream":[{"sha":"fd95e68df6fe66344161a1329cbe5e5805e7b704","url":"https://git.kernel.org/stable/c/fd95e68df6fe66344161a1329cbe5e5805e7b704"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd95e68df6fe66344161a1329cbe5e5805e7b704","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/fd95e68df6fe66344161a1329cbe5e5805e7b704.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98266","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98266.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98254","title":"swiotlb: use the adjusted address for the highmem page lookup","status":"unfixed","project":false,"upstream":[{"sha":"b7d7914a9ae3097e63d113007e4fb44d33d515b1","url":"https://git.kernel.org/stable/c/b7d7914a9ae3097e63d113007e4fb44d33d515b1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b7d7914a9ae3097e63d113007e4fb44d33d515b1","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/b7d7914a9ae3097e63d113007e4fb44d33d515b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98254","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98254.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98248","title":"arm64: percpu: Fix LSE operations on {8,16}-bit types","status":"unfixed","project":false,"upstream":[{"sha":"8cf2093f5372952a9ebc805c418d45df7112cd14","url":"https://git.kernel.org/stable/c/8cf2093f5372952a9ebc805c418d45df7112cd14"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8cf2093f5372952a9ebc805c418d45df7112cd14","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/8cf2093f5372952a9ebc805c418d45df7112cd14.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98248","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98248.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98229","title":"xfrm: save input state data before secpath resets","status":"unfixed","project":false,"upstream":[{"sha":"3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","url":"https://git.kernel.org/stable/c/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98229","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98229.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98228","title":"mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ","status":"not-applicable","project":false,"upstream":[{"sha":"bbc448c541ed90d52f9ec22f17394304e3bf170e","url":"https://git.kernel.org/stable/c/bbc448c541ed90d52f9ec22f17394304e3bf170e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"bbc448c541ed90d52f9ec22f17394304e3bf170e","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/bbc448c541ed90d52f9ec22f17394304e3bf170e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98228","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98228.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98222","title":"KEYS: encrypted: fix integer overflow of datablob_len","status":"unfixed","project":false,"upstream":[{"sha":"8697c431e297eb0d0ab13dda6bc172b48a34f05c","url":"https://git.kernel.org/stable/c/8697c431e297eb0d0ab13dda6bc172b48a34f05c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8697c431e297eb0d0ab13dda6bc172b48a34f05c","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/8697c431e297eb0d0ab13dda6bc172b48a34f05c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98222","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98222.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98212","title":"mmc: hsq: Fix use-after-free in retry work","status":"backported","project":false,"upstream":[{"sha":"5d132990475f02cfa1debe03d50b479432864ebd","url":"https://git.kernel.org/stable/c/5d132990475f02cfa1debe03d50b479432864ebd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c50d6515bffb148c2c12be6d587ec201dfab4c34","label":"c50d6515bffb","date":"2026-10-03T12:30:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5d132990475f02cfa1debe03d50b479432864ebd","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/5d132990475f02cfa1debe03d50b479432864ebd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98212","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98212.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98211","title":"mmc: mmci: Fix use-after-free in busy-timeout work","status":"unfixed","project":false,"upstream":[{"sha":"2b19cf3e50cddaff07b657dae1a8f30f06032852","url":"https://git.kernel.org/stable/c/2b19cf3e50cddaff07b657dae1a8f30f06032852"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b19cf3e50cddaff07b657dae1a8f30f06032852","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/2b19cf3e50cddaff07b657dae1a8f30f06032852.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98182","title":"wifi: mac80211: refuse to make a monitor active when it has no queue","status":"unfixed","project":false,"upstream":[{"sha":"2b04d6556964ae9f89819b86a0a7801e39c3aae5","url":"https://git.kernel.org/stable/c/2b04d6556964ae9f89819b86a0a7801e39c3aae5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b04d6556964ae9f89819b86a0a7801e39c3aae5","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/2b04d6556964ae9f89819b86a0a7801e39c3aae5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98182","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98182.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98180","title":"drm/msm: RCU-free the scheduler-containing ring and VM objects","status":"unfixed","project":false,"upstream":[{"sha":"01c8d1f385f788f1bbbbb7687c4386d614281218","url":"https://git.kernel.org/stable/c/01c8d1f385f788f1bbbbb7687c4386d614281218"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"01c8d1f385f788f1bbbbb7687c4386d614281218","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/01c8d1f385f788f1bbbbb7687c4386d614281218.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98180","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98180.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98179","title":"drm/amdgpu: fix rmmio iounmap skipped on device removal","status":"unfixed","project":false,"upstream":[{"sha":"5155002b03b24ba3ef91c5c313b8cf0171b24904","url":"https://git.kernel.org/stable/c/5155002b03b24ba3ef91c5c313b8cf0171b24904"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5155002b03b24ba3ef91c5c313b8cf0171b24904","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/5155002b03b24ba3ef91c5c313b8cf0171b24904.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98179","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98179.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98177","title":"drm/amdkfd: Avoid integer underflow in EOP ring size calculation.","status":"unfixed","project":false,"upstream":[{"sha":"8ee521b8b189799e361d4233c5180ba56656d4d4","url":"https://git.kernel.org/stable/c/8ee521b8b189799e361d4233c5180ba56656d4d4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ee521b8b189799e361d4233c5180ba56656d4d4","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/8ee521b8b189799e361d4233c5180ba56656d4d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98177","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98177.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98176","title":"drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc","status":"unfixed","project":false,"upstream":[{"sha":"c883d0a132d430ef7ebb23fd94323be94d0fbdb8","url":"https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c883d0a132d430ef7ebb23fd94323be94d0fbdb8","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/c883d0a132d430ef7ebb23fd94323be94d0fbdb8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98176","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98176.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98175","title":"smb: client: cancel reconnect work in clean_demultiplex_info()","status":"backported","project":false,"upstream":[{"sha":"c65eae6f61d1778ff7a82e4aae4080e26f486af1","url":"https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/180380272f116dbd2b0354c5c7872e112e519149","label":"180380272f11","date":"2026-10-03T12:31:00+02:00","lore":["https://lore.kernel.org/r/6aa4a12d.f81106d8.2ab401.0023.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c65eae6f61d1778ff7a82e4aae4080e26f486af1","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/c65eae6f61d1778ff7a82e4aae4080e26f486af1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98175","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98175.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98174","title":"smb: client: fix rlist race and missing initialization","status":"backported","project":false,"upstream":[{"sha":"5f270f091256da1338c3631083e15d7f83cc05e1","url":"https://git.kernel.org/stable/c/5f270f091256da1338c3631083e15d7f83cc05e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b5f924ffbfa976e4b97f17e8132c595b97482c2d","label":"b5f924ffbfa9","date":"2026-10-03T12:31:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"5f270f091256da1338c3631083e15d7f83cc05e1","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/5f270f091256da1338c3631083e15d7f83cc05e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98164","title":"KVM: x86/mmu: Check write tracking in all address spaces","status":"backported","project":true,"upstream":[{"sha":"0f38453cdb2e17566ccb7c0f3dabd5bd21caca26","url":"https://git.kernel.org/stable/c/0f38453cdb2e17566ccb7c0f3dabd5bd21caca26"}],"evidence":[{"url":"https://git.kernel.org/stable/c/429b6f43b4d8c98988fdca99e02dc156134e3d77","label":"429b6f43b4d8","date":"2026-09-02T14:29:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0f38453cdb2e17566ccb7c0f3dabd5bd21caca26","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98164","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98164.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98162","title":"smb/server: fix tree connection leak in smb2_tree_connect()","status":"backported","project":false,"upstream":[{"sha":"39f2032096715daae5f6fd0f587ca7a474b019df","url":"https://git.kernel.org/stable/c/39f2032096715daae5f6fd0f587ca7a474b019df"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fa0c45986fc60b3edfb35879f2fb0eacc0e49e98","label":"fa0c45986fc6","date":"2026-10-21T10:28:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"39f2032096715daae5f6fd0f587ca7a474b019df","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/39f2032096715daae5f6fd0f587ca7a474b019df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98162","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98162.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98161","title":"nvdimm: pmem: keep PREFLUSH before data writes","status":"backported","project":false,"upstream":[{"sha":"c644a2f8fef5618fcf453c591177700fd07dd024","url":"https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024"}],"evidence":[{"url":"https://git.kernel.org/stable/c/22d1f4dcdc9c6d0295c6db0c8933126098b14e05","label":"22d1f4dcdc9c","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c644a2f8fef5618fcf453c591177700fd07dd024","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/c644a2f8fef5618fcf453c591177700fd07dd024.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98156","title":"drm/virtio: use the DMA API for resource backing on Xen","status":"backported","project":false,"upstream":[{"sha":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","url":"https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78"}],"evidence":[{"url":"https://git.kernel.org/stable/c/32e999ccf5f6453b3b4df8264ff1b03c6720292f","label":"32e999ccf5f6","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98156.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98153","title":"nvme: fix racy access to FDP placement id array","status":"not-applicable","project":false,"upstream":[{"sha":"56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","url":"https://git.kernel.org/stable/c/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98153","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98153.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98148","title":"drm/gud: validate GUD_ROTATION_0 is present in supported rotations","status":"backported","project":false,"upstream":[{"sha":"cb732d027aa18e1fcf9d2797f47d20b179ebc59c","url":"https://git.kernel.org/stable/c/cb732d027aa18e1fcf9d2797f47d20b179ebc59c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ce7da178f1af4e9cbac4d0440c4002785546bfb5","label":"ce7da178f1af","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cb732d027aa18e1fcf9d2797f47d20b179ebc59c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/cb732d027aa18e1fcf9d2797f47d20b179ebc59c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98148","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98148.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98144","title":"accel/amdxdna: put the chained BO when its mapping fails","status":"not-applicable","project":false,"upstream":[{"sha":"7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","url":"https://git.kernel.org/stable/c/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98144","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98144.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98142","title":"drm/cirrus-qemu: Validate BAR0 size during probe","status":"backported","project":false,"upstream":[{"sha":"92312d333bf700798f92f30406c721bce87506f3","url":"https://git.kernel.org/stable/c/92312d333bf700798f92f30406c721bce87506f3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2a0e7bcff3fa63e7309d2b39e18af59eb8ef2b6e","label":"2a0e7bcff3fa","date":"2026-10-03T12:30:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"92312d333bf700798f92f30406c721bce87506f3","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/92312d333bf700798f92f30406c721bce87506f3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98142","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98142.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98131","title":"net: stmmac: fix dma mapping leak in stmmac_tso_xmit()","status":"unfixed","project":false,"upstream":[{"sha":"a5d946466a95621fa2769720d59ea336003aa1a5","url":"https://git.kernel.org/stable/c/a5d946466a95621fa2769720d59ea336003aa1a5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"a5d946466a95621fa2769720d59ea336003aa1a5","lines":120,"reason":"","source":"https://github.com/torvalds/linux/commit/a5d946466a95621fa2769720d59ea336003aa1a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98131","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98131.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98127","title":"smb/client: validate new EOF for insert range","status":"backported","project":false,"upstream":[{"sha":"1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","url":"https://git.kernel.org/stable/c/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b7f2e33d9f5db7b8e6e5e0a5a93d0c5e31870356","label":"b7f2e33d9f5d","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98127","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98127.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98126","title":"smb/client: validate new EOF for zero range","status":"backported","project":false,"upstream":[{"sha":"88972e35750792e717af287dc71f42a03b5cbce4","url":"https://git.kernel.org/stable/c/88972e35750792e717af287dc71f42a03b5cbce4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5fbd8848f2e25c8163896ec52863df2305a3bb63","label":"5fbd8848f2e2","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"88972e35750792e717af287dc71f42a03b5cbce4","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/88972e35750792e717af287dc71f42a03b5cbce4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98126","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98126.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98125","title":"smb/client: fix stale page cache in insert/collapse range","status":"backported","project":false,"upstream":[{"sha":"01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","url":"https://git.kernel.org/stable/c/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032"}],"evidence":[{"url":"https://git.kernel.org/stable/c/52dd721b3de57e41261e08485b2bc62b22b80ebe","label":"52dd721b3de5","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98124","title":"smb/client: invalidate fscache for fallocate range operations","status":"backported","project":false,"upstream":[{"sha":"448ba0ae65ca61064183564d2983c9aa59bd6ba7","url":"https://git.kernel.org/stable/c/448ba0ae65ca61064183564d2983c9aa59bd6ba7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cc7202a51b8777a757bda9dcfbf339f828c6a130","label":"cc7202a51b87","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"448ba0ae65ca61064183564d2983c9aa59bd6ba7","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/448ba0ae65ca61064183564d2983c9aa59bd6ba7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98124","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98124.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98119","title":"netfs: break unbuffered write when netfs_alloc_subrequest() fails","status":"not-applicable","project":false,"upstream":[{"sha":"8fb45a934661419c04a44d4cfea1e0df7dcf2805","url":"https://git.kernel.org/stable/c/8fb45a934661419c04a44d4cfea1e0df7dcf2805"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8fb45a934661419c04a44d4cfea1e0df7dcf2805","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/8fb45a934661419c04a44d4cfea1e0df7dcf2805.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98119","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98119.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98118","title":"netfs: Fix readahead synchronisation issues by loading all folios upfront","status":"not-applicable","project":false,"upstream":[{"sha":"fed0b33e6c584986ba70018ec9f9787a98216e64","url":"https://git.kernel.org/stable/c/fed0b33e6c584986ba70018ec9f9787a98216e64"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"fed0b33e6c584986ba70018ec9f9787a98216e64","lines":362,"reason":"","source":"https://github.com/torvalds/linux/commit/fed0b33e6c584986ba70018ec9f9787a98216e64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98115","title":"ksmbd: safely drain sessions during logoff","status":"unfixed","project":false,"upstream":[{"sha":"d12168084c8c1b6d883c8eca5853929ac5136a9e","url":"https://git.kernel.org/stable/c/d12168084c8c1b6d883c8eca5853929ac5136a9e"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d12168084c8c1b6d883c8eca5853929ac5136a9e","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/d12168084c8c1b6d883c8eca5853929ac5136a9e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98114","title":"ksmbd: propagate DACL parsing errors","status":"backported","project":false,"upstream":[{"sha":"c61dc7b1b4a3234b4aa3965502908a292238805c","url":"https://git.kernel.org/stable/c/c61dc7b1b4a3234b4aa3965502908a292238805c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/99ae165acf633b13df34105815110fec332a2cdc","label":"99ae165acf63","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c61dc7b1b4a3234b4aa3965502908a292238805c","lines":147,"reason":"","source":"https://github.com/torvalds/linux/commit/c61dc7b1b4a3234b4aa3965502908a292238805c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98114","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98114.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98111","title":"Bluetooth: btintel: validate version TLV value lengths","status":"backported","project":false,"upstream":[{"sha":"a086c0892969bf8a0151b0f12bd14a68827c88b2","url":"https://git.kernel.org/stable/c/a086c0892969bf8a0151b0f12bd14a68827c88b2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e9cf7f175c00d36b060828f4eac8d2e246ee079b","label":"e9cf7f175c00","date":"2026-10-03T12:30:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a086c0892969bf8a0151b0f12bd14a68827c88b2","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/a086c0892969bf8a0151b0f12bd14a68827c88b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98111","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98111.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98107","title":"Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect","status":"backported","project":false,"upstream":[{"sha":"56c2b5831d39dc84aad2573dc3e197af1a872a05","url":"https://git.kernel.org/stable/c/56c2b5831d39dc84aad2573dc3e197af1a872a05"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fabc5e04f123225daf980d03f2c5a05e7f0f0a7f","label":"fabc5e04f123","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"56c2b5831d39dc84aad2573dc3e197af1a872a05","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/56c2b5831d39dc84aad2573dc3e197af1a872a05.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98107","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98107.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98106","title":"drm/pagemap: Prevent double migration of device pages","status":"not-applicable","project":false,"upstream":[{"sha":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","url":"https://git.kernel.org/stable/c/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","lines":204,"reason":"","source":"https://github.com/torvalds/linux/commit/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98106","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98106.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98103","title":"igmp: convert struct ip_sf_list to RCU","status":"backported","project":false,"upstream":[{"sha":"2987ee196c88dbde0463dc87d5fb209c684e34a2","url":"https://git.kernel.org/stable/c/2987ee196c88dbde0463dc87d5fb209c684e34a2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/01131daffc4b64f1652e23dc3e6e2f601eda781d","label":"01131daffc4b","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2987ee196c88dbde0463dc87d5fb209c684e34a2","lines":490,"reason":"","source":"https://github.com/torvalds/linux/commit/2987ee196c88dbde0463dc87d5fb209c684e34a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98102","title":"ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()","status":"backported","project":false,"upstream":[{"sha":"93b49239840b91313adbd77b8b52993eff2d08c1","url":"https://git.kernel.org/stable/c/93b49239840b91313adbd77b8b52993eff2d08c1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c3343cd7ec8706c221e52b782f386b9af14a928a","label":"c3343cd7ec87","date":"2026-10-03T12:31:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"93b49239840b91313adbd77b8b52993eff2d08c1","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/93b49239840b91313adbd77b8b52993eff2d08c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98101","title":"ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()","status":"backported","project":false,"upstream":[{"sha":"c073d1b070f171d206b19c98d71739a97f15b3f1","url":"https://git.kernel.org/stable/c/c073d1b070f171d206b19c98d71739a97f15b3f1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ac51321d3b2391860a935820ebcf4d8b9bb16a8a","label":"ac51321d3b23","date":"2026-10-03T12:31:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c073d1b070f171d206b19c98d71739a97f15b3f1","lines":147,"reason":"","source":"https://github.com/torvalds/linux/commit/c073d1b070f171d206b19c98d71739a97f15b3f1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98099","title":"ipv6: mcast: use rcu_assign_pointer() for __rcu list updates","status":"backported","project":false,"upstream":[{"sha":"0c8f56c583c3250408367880c98e4d6fbc929315","url":"https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0e3e3cec28c4d1bf29948da40b4e9e5d44f7852b","label":"0e3e3cec28c4","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0c8f56c583c3250408367880c98e4d6fbc929315","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/0c8f56c583c3250408367880c98e4d6fbc929315.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98099","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98099.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98097","title":"tipc: Dont send random pad bytes in RESET/ACTIVATE messages","status":"backported","project":false,"upstream":[{"sha":"81c600c26302a27852ed8b19c5f2f647ea3555c9","url":"https://git.kernel.org/stable/c/81c600c26302a27852ed8b19c5f2f647ea3555c9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3dbb628cfc592a4148d8136dcda1f706cdcad4f3","label":"3dbb628cfc59","date":"2026-10-21T10:28:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"81c600c26302a27852ed8b19c5f2f647ea3555c9","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/81c600c26302a27852ed8b19c5f2f647ea3555c9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98087","title":"sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate","status":"unfixed","project":false,"upstream":[{"sha":"dae5c0292080dd7b9c7d784268dcf443f1f3d15e","url":"https://git.kernel.org/stable/c/dae5c0292080dd7b9c7d784268dcf443f1f3d15e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"dae5c0292080dd7b9c7d784268dcf443f1f3d15e","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/dae5c0292080dd7b9c7d784268dcf443f1f3d15e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98087","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98087.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98085","title":"bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge","status":"backported","project":false,"upstream":[{"sha":"387b1baefbb776e3f48dc2261e77a49213f470f7","url":"https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/19cca7c36055906b3cff3e297618ee8a50cde25d","label":"19cca7c36055","date":"2026-10-21T10:28:37+02:00","lore":["https://lore.kernel.org/bpf/20260901-bug-016-backtrack-ld-abs-v1-1-59368f1be435@gmail.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":{"id":"CVE-2026-98085","series":"6.6.y","upstream":["387b1baefbb776e3f48dc2261e77a49213f470f7"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"The newer scalar backtracker does not traverse the implicit parent-frame subprogram-exit edge for ld_abs/ld_ind; 6.1 is unaffected because its backtracker conservatively returns ENOTSUPP for these opcodes.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n3855"},{"label":"Upstream fix 387b1baefbb7","url":"https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7"}]},"size":{"status":"within-limit","patches":[{"sha":"387b1baefbb776e3f48dc2261e77a49213f470f7","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/387b1baefbb776e3f48dc2261e77a49213f470f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98084","title":"bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks","status":"backported","project":false,"upstream":[{"sha":"e3e4f66cc4b72333d0886ae2673c360248987889","url":"https://git.kernel.org/stable/c/e3e4f66cc4b72333d0886ae2673c360248987889"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1ac58dab0a83d2c64e3b807a3a0b399f17a74110","label":"1ac58dab0a83","date":"2026-10-21T10:28:36+02:00","lore":["https://lore.kernel.org/r/20260831-bug-015-backtrack-cb-args-precise-v1-1-68a8e2a821e0@gmail.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":{"id":"CVE-2026-98084","series":"6.6.y","upstream":["e3e4f66cc4b72333d0886ae2673c360248987889"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"Callback backtracking on BPF_EXIT clears outer-frame R1-R5 when calls_callback is set, losing caller precision.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n3855"},{"label":"Upstream fix e3e4f66cc4b7","url":"https://git.kernel.org/stable/c/e3e4f66cc4b72333d0886ae2673c360248987889"}]},"size":{"status":"within-limit","patches":[{"sha":"e3e4f66cc4b72333d0886ae2673c360248987889","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/e3e4f66cc4b72333d0886ae2673c360248987889.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98084","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98084.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98081","title":"btrfs: zoned: finish active block group cleanup if call_zone_finish() fails","status":"backported","project":false,"upstream":[{"sha":"a18a6b93a2843b9d103d3456bbd4b3f90282a379","url":"https://git.kernel.org/stable/c/a18a6b93a2843b9d103d3456bbd4b3f90282a379"}],"evidence":[{"url":"https://git.kernel.org/stable/c/433d52b196a689b18dcfadc7cf6c784f0e5cc7c9","label":"433d52b196a6","date":"2026-10-21T10:28:36+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a18a6b93a2843b9d103d3456bbd4b3f90282a379","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/a18a6b93a2843b9d103d3456bbd4b3f90282a379.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98081","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98081.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98079","title":"btrfs: zstd: fix lost wakeup when waiting for a workspace","status":"backported","project":false,"upstream":[{"sha":"2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","url":"https://git.kernel.org/stable/c/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/14d982762945d9945c60bbd48b77df194dd8e28d","label":"14d982762945","date":"2026-10-21T10:28:36+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98073","title":"net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().","status":"backported","project":false,"upstream":[{"sha":"debac3a20dec524a59625cf10fa2f18571127824","url":"https://git.kernel.org/stable/c/debac3a20dec524a59625cf10fa2f18571127824"}],"evidence":[{"url":"https://git.kernel.org/stable/c/54772bf503dd0e81e8b8db537fee6946de81e717","label":"54772bf503dd","date":"2026-10-21T10:28:36+02:00","lore":["https://lore.kernel.org/all/6a96219e.04428c52.29b18.0001.GAE@google.com/T/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"debac3a20dec524a59625cf10fa2f18571127824","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/debac3a20dec524a59625cf10fa2f18571127824.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98067","title":"erofs: disable LZ4 rolling decompression for now","status":"backported","project":false,"upstream":[{"sha":"82e664cf1219c459c33aae931b222cf951af9cb7","url":"https://git.kernel.org/stable/c/82e664cf1219c459c33aae931b222cf951af9cb7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dcc5e6c9e4d06fe73fc61e730ee3e51dd115a4d8","label":"dcc5e6c9e4d0","date":"2026-10-21T10:28:36+02:00","lore":["https://lore.kernel.org/r/BEZP281MB2102E57CD31862B8D958B33DD2AC2@BEZP281MB2102.DEUP281.PROD.OUTLOOK.COM"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"82e664cf1219c459c33aae931b222cf951af9cb7","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/82e664cf1219c459c33aae931b222cf951af9cb7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98067","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98067.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98058","title":"bpf: Mark syscall helpers as sleepable","status":"backported","project":false,"upstream":[{"sha":"d05524794240b52fdc3b6c1220dd05505715824d","url":"https://git.kernel.org/stable/c/d05524794240b52fdc3b6c1220dd05505715824d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9496d857205e60241034b798d7745ff8830ba599","label":"9496d857205e","date":"2026-10-21T10:28:36+02:00","lore":["https://lore.kernel.org/r/20260903144433.1716731-10-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d05524794240b52fdc3b6c1220dd05505715824d","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/d05524794240b52fdc3b6c1220dd05505715824d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98058","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98058.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98056","title":"nvme: remove stale namespaces by NSID range during scan","status":"backported","project":false,"upstream":[{"sha":"4ed7f3d7d435bf5b63da2814dc9270f5ba896011","url":"https://git.kernel.org/stable/c/4ed7f3d7d435bf5b63da2814dc9270f5ba896011"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e6a94b2c4c80a38002346ce915a9b9a3d478a3e6","label":"e6a94b2c4c80","date":"2026-10-21T10:28:36+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4ed7f3d7d435bf5b63da2814dc9270f5ba896011","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/4ed7f3d7d435bf5b63da2814dc9270f5ba896011.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98056","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98056.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98049","title":"bpf: zero extend the result of an arena 32-bit cmpxchg","status":"not-applicable","project":false,"upstream":[{"sha":"4814ed6406f3493bd554ad046da5f7fc04833571","url":"https://git.kernel.org/stable/c/4814ed6406f3493bd554ad046da5f7fc04833571"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"4814ed6406f3493bd554ad046da5f7fc04833571","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/4814ed6406f3493bd554ad046da5f7fc04833571.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98049","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98049.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98044","title":"bpf: Reject legacy packet loads from callbacks","status":"unfixed","project":false,"upstream":[{"sha":"e7d28823c662128caae63f14e16bd394916c139b","url":"https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e7d28823c662128caae63f14e16bd394916c139b","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/e7d28823c662128caae63f14e16bd394916c139b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98043","title":"bpf: Don't infer non-NULL from a pointer with an unbounded offset","status":"backported","project":false,"upstream":[{"sha":"67b529f521a6676cdfc78b91b0217d7eaa84216b","url":"https://git.kernel.org/stable/c/67b529f521a6676cdfc78b91b0217d7eaa84216b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8b414dbe97fcefd116e5a620c3bd9993014aa4ce","label":"8b414dbe97fc","date":"2026-10-21T10:28:36+02:00","lore":["https://lore.kernel.org/bpf/20260904083325.2083493-1-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"67b529f521a6676cdfc78b91b0217d7eaa84216b","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/67b529f521a6676cdfc78b91b0217d7eaa84216b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98041","title":"bpf: Don't predict JMP32 pointer vs zero comparisons","status":"backported","project":false,"upstream":[{"sha":"e51179a4e09846f8fd0f26a05068520de2b301bf","url":"https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6e1544986536734166176c3add504add23bcbd15","label":"6e1544986536","date":"2026-10-21T10:28:36+02:00","lore":["https://lore.kernel.org/bpf/20260904083325.2083493-5-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e51179a4e09846f8fd0f26a05068520de2b301bf","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/e51179a4e09846f8fd0f26a05068520de2b301bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98041","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98041.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98034","title":"bpf: Mark NULL kptr stores precise","status":"backported","project":false,"upstream":[{"sha":"ecdc5043794c9184aa8e6c814603899479c46b35","url":"https://git.kernel.org/stable/c/ecdc5043794c9184aa8e6c814603899479c46b35"}],"evidence":[{"url":"https://git.kernel.org/stable/c/86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4","label":"86a3171c90bf","date":"2026-10-21T10:28:35+02:00","lore":["https://lore.kernel.org/r/20260904104203.345917-6-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ecdc5043794c9184aa8e6c814603899479c46b35","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/ecdc5043794c9184aa8e6c814603899479c46b35.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98034","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98034.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98033","title":"bpf: Preserve inner map identity in callback frames","status":"backported","project":false,"upstream":[{"sha":"b90c5d770dad910fb89e6c1b15052a8a1e8db752","url":"https://git.kernel.org/stable/c/b90c5d770dad910fb89e6c1b15052a8a1e8db752"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cf85e4f94d7feef8b3c4c90dbe2468595a48393b","label":"cf85e4f94d7f","date":"2026-10-21T10:28:35+02:00","lore":["https://lore.kernel.org/r/20260904104203.345917-8-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b90c5d770dad910fb89e6c1b15052a8a1e8db752","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/b90c5d770dad910fb89e6c1b15052a8a1e8db752.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98033","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98033.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98026","title":"net: bridge: mcast: properly convert mglist to rcu","status":"backported","project":false,"upstream":[{"sha":"4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","url":"https://git.kernel.org/stable/c/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/37cb9a81600da8250f24e25edc07253b62353cbe","label":"37cb9a81600d","date":"2026-10-03T12:30:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98021","title":"net: reject oversized tx_queue_len at netlink parse time","status":"backported","project":false,"upstream":[{"sha":"1aa9e143bf51405665a793d4cc925e1c4f0c5922","url":"https://git.kernel.org/stable/c/1aa9e143bf51405665a793d4cc925e1c4f0c5922"}],"evidence":[{"url":"https://git.kernel.org/stable/c/26ee5f99ffe7ab98e635071290eff14192e9e34a","label":"26ee5f99ffe7","date":"2026-10-21T10:28:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1aa9e143bf51405665a793d4cc925e1c4f0c5922","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/1aa9e143bf51405665a793d4cc925e1c4f0c5922.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98021","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98021.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98019","title":"bpf: mark a NULL call argument precise","status":"backported","project":false,"upstream":[{"sha":"1a3a10b030c96ea88868ccc060a16827c01eaa5a","url":"https://git.kernel.org/stable/c/1a3a10b030c96ea88868ccc060a16827c01eaa5a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/febbb66e682d8328f7c5bcbdd5e4291abab2e858","label":"febbb66e682d","date":"2026-10-21T10:28:35+02:00","lore":["https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-1-0f5a360ff15d@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a3a10b030c96ea88868ccc060a16827c01eaa5a","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/1a3a10b030c96ea88868ccc060a16827c01eaa5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98019","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98019.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98003","title":"iommu/amd: Do not reallocate GA log buffers on resume","status":"backported","project":false,"upstream":[{"sha":"00a7dd64888d6dd72110b40e2824a088cf7b7386","url":"https://git.kernel.org/stable/c/00a7dd64888d6dd72110b40e2824a088cf7b7386"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8b95269d7a43b737c2c0e2fa77bf00cc8a3a4434","label":"8b95269d7a43","date":"2026-10-21T10:28:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00a7dd64888d6dd72110b40e2824a088cf7b7386","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/00a7dd64888d6dd72110b40e2824a088cf7b7386.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98003","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98003.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97997","title":"virtio_ring: fix stale descriptor flags after a failed packed add","status":"backported","project":false,"upstream":[{"sha":"75d276e5bb68778b2916f98a2bc30f142ebadc64","url":"https://git.kernel.org/stable/c/75d276e5bb68778b2916f98a2bc30f142ebadc64"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5ad081761a1f0b0d95ab08b61a6008309fba95f9","label":"5ad081761a1f","date":"2026-10-21T10:28:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75d276e5bb68778b2916f98a2bc30f142ebadc64","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/75d276e5bb68778b2916f98a2bc30f142ebadc64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97997","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97997.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97994","title":"vhost/vdpa: reject VRING_NUM larger than device max","status":"backported","project":false,"upstream":[{"sha":"ccb1dc7c527f8c925925cf92afc76ae590dac311","url":"https://git.kernel.org/stable/c/ccb1dc7c527f8c925925cf92afc76ae590dac311"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4875c65ca53797a0a402fe2bb54d1b12f28b3cda","label":"4875c65ca537","date":"2026-10-03T12:30:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ccb1dc7c527f8c925925cf92afc76ae590dac311","lines":81,"reason":"","source":"https://github.com/torvalds/linux/commit/ccb1dc7c527f8c925925cf92afc76ae590dac311.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97994","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97994.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97992","title":"vhost-vdpa: protect config_ctx from being freed under the config callback","status":"backported","project":false,"upstream":[{"sha":"62be4e3e5f5f947fbf765b914cebdc478f715d12","url":"https://git.kernel.org/stable/c/62be4e3e5f5f947fbf765b914cebdc478f715d12"}],"evidence":[{"url":"https://git.kernel.org/stable/c/914c7cc2e3d10dddd3c5529cbe56557c9e01702a","label":"914c7cc2e3d1","date":"2026-10-21T10:28:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"62be4e3e5f5f947fbf765b914cebdc478f715d12","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/62be4e3e5f5f947fbf765b914cebdc478f715d12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97992","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97992.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97990","title":"vdpa_sim_net: check TX pull result before RX copy","status":"backported","project":false,"upstream":[{"sha":"0d195797a80b77f2ec56718cd26d3ee65d0093e8","url":"https://git.kernel.org/stable/c/0d195797a80b77f2ec56718cd26d3ee65d0093e8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1b803d382cde6d85755b363f22010208a04ba40a","label":"1b803d382cde","date":"2026-10-03T12:30:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0d195797a80b77f2ec56718cd26d3ee65d0093e8","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/0d195797a80b77f2ec56718cd26d3ee65d0093e8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97989","title":"vduse: validate virtqueue alignment","status":"backported","project":false,"upstream":[{"sha":"fa2c25b4add57888acfa89e398389e267bff3dcf","url":"https://git.kernel.org/stable/c/fa2c25b4add57888acfa89e398389e267bff3dcf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/650bac9c73d3b4d83be683028283654c05346556","label":"650bac9c73d3","date":"2026-10-21T10:28:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fa2c25b4add57888acfa89e398389e267bff3dcf","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/fa2c25b4add57888acfa89e398389e267bff3dcf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97988","title":"vhost: invalidate vring access on IOTLB transitions","status":"backported","project":false,"upstream":[{"sha":"e4f4761879a230aa59e569102a6ab9851847d833","url":"https://git.kernel.org/stable/c/e4f4761879a230aa59e569102a6ab9851847d833"}],"evidence":[{"url":"https://git.kernel.org/stable/c/021bf73731f7aa94540a549cf850db5968019960","label":"021bf73731f7","date":"2026-10-21T10:28:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"e4f4761879a230aa59e569102a6ab9851847d833","lines":104,"reason":"","source":"https://github.com/torvalds/linux/commit/e4f4761879a230aa59e569102a6ab9851847d833.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97985","title":"af_unix: Update last skb marker in manage_oob().","status":"backported","project":false,"upstream":[{"sha":"94fd4debd2e3a69cf93e766c8b328a810c228119","url":"https://git.kernel.org/stable/c/94fd4debd2e3a69cf93e766c8b328a810c228119"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bd91dc313afe21e9d6b31ca6a47606a33ca5e35c","label":"bd91dc313afe","date":"2026-10-21T10:28:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"94fd4debd2e3a69cf93e766c8b328a810c228119","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/94fd4debd2e3a69cf93e766c8b328a810c228119.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97985","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97985.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97984","title":"net: ipv6: Fix UDP length overflow with PMTU discover and big MTU","status":"backported","project":false,"upstream":[{"sha":"0ae10b6be49b425827659b23bcce498f80eb7182","url":"https://git.kernel.org/stable/c/0ae10b6be49b425827659b23bcce498f80eb7182"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1dd562f3019019ffdf4b396570613053facda9ee","label":"1dd562f30190","date":"2026-10-03T12:30:33+02:00","lore":["https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0ae10b6be49b425827659b23bcce498f80eb7182","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0ae10b6be49b425827659b23bcce498f80eb7182.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97984","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97984.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97978","title":"eth: ice: don't dereference pointers from TP_printk()","status":"backported","project":false,"upstream":[{"sha":"b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","url":"https://git.kernel.org/stable/c/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/385aa7dbc6af11d90a5dd1261dbe75950eb7ca93","label":"385aa7dbc6af","date":"2026-10-21T10:28:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","lines":88,"reason":"","source":"https://github.com/torvalds/linux/commit/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97978","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97978.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97975","title":"Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()","status":"backported","project":false,"upstream":[{"sha":"9b851b09b392da68bd715601f10a5adb2d8d19b8","url":"https://git.kernel.org/stable/c/9b851b09b392da68bd715601f10a5adb2d8d19b8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/55b76500546e5f2e7fdd7ae7283530b620de6e61","label":"55b76500546e","date":"2026-10-21T10:28:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"9b851b09b392da68bd715601f10a5adb2d8d19b8","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/9b851b09b392da68bd715601f10a5adb2d8d19b8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97965","title":"vxlan: initialize _md in vxlan_xmit_one()","status":"backported","project":false,"upstream":[{"sha":"be83178bfc44588f6e3adb827ed874c683193466","url":"https://git.kernel.org/stable/c/be83178bfc44588f6e3adb827ed874c683193466"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fb78beb64e0e79557e4cd7cd17fea744bb6f01d9","label":"fb78beb64e0e","date":"2026-10-21T10:28:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"be83178bfc44588f6e3adb827ed874c683193466","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/be83178bfc44588f6e3adb827ed874c683193466.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97965","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97965.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97953","title":"net: stmmac: fix TX descriptor availability check for TSO traffic","status":"backported","project":false,"upstream":[{"sha":"5e38d732ec67a5b1f9a56e6c73add480c4b6030a","url":"https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/09c30547da2c45bb79f7d3adffc860af332c2d42","label":"09c30547da2c","date":"2026-10-21T10:28:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5e38d732ec67a5b1f9a56e6c73add480c4b6030a","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/5e38d732ec67a5b1f9a56e6c73add480c4b6030a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97953","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97953.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97950","title":"configfs: pin the symlink target's dirent instead of chasing ->ci_dentry","status":"backported","project":false,"upstream":[{"sha":"a7c1290eef60711c10289c056ad32ed1f2b47b12","url":"https://git.kernel.org/stable/c/a7c1290eef60711c10289c056ad32ed1f2b47b12"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a44744454eafbc158e8c8e3ef8d207076410b195","label":"a44744454eaf","date":"2026-10-21T10:28:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a7c1290eef60711c10289c056ad32ed1f2b47b12","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/a7c1290eef60711c10289c056ad32ed1f2b47b12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97950","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97950.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97949","title":"configfs: unhash the dentry before dropping the item in rmdir","status":"backported","project":false,"upstream":[{"sha":"f06c2d26d1999d37e93299db0ecead04ca7d0b9f","url":"https://git.kernel.org/stable/c/f06c2d26d1999d37e93299db0ecead04ca7d0b9f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b315d865660766d45ecdbf7433a4e3d36a554b3b","label":"b315d8656607","date":"2026-10-21T10:28:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f06c2d26d1999d37e93299db0ecead04ca7d0b9f","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/f06c2d26d1999d37e93299db0ecead04ca7d0b9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97938","title":"reboot: fix cad_pid use-after-free race","status":"backported","project":false,"upstream":[{"sha":"5a88f78df753993469dab4d1831f8fb4256a9468","url":"https://git.kernel.org/stable/c/5a88f78df753993469dab4d1831f8fb4256a9468"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0c1a966bc047af2801a70b8eb13f9df5d7ab925f","label":"0c1a966bc047","date":"2026-10-21T10:28:33+02:00","lore":["https://lore.kernel.org/all/20260717210143.4734-1-blbllhy@gmail.com/","https://lore.kernel.org/all/al4ICz9biJKtdZc4@redhat.com/","https://lore.kernel.org/all/alz5ZYLE4kaq_v2P@redhat.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5a88f78df753993469dab4d1831f8fb4256a9468","lines":92,"reason":"","source":"https://github.com/torvalds/linux/commit/5a88f78df753993469dab4d1831f8fb4256a9468.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97933","title":"tracing: Take trace_array reference when opening a tracer options file","status":"backported","project":false,"upstream":[{"sha":"ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","url":"https://git.kernel.org/stable/c/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80"}],"evidence":[{"url":"https://git.kernel.org/stable/c/61894ea0d2a1ae8ce903abf73bd56958c035f182","label":"61894ea0d2a1","date":"2026-10-21T10:28:33+02:00","lore":["https://lore.kernel.org/linux-trace-kernel/20260902121918.5a9e9d1b@gandalf.local.home/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97933","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97933.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97929","title":"ALSA: usbusx2y: validate URB actual_length in interrupt callback","status":"backported","project":false,"upstream":[{"sha":"8f5ef203abda9dd36b2af473c7b737d544f807bd","url":"https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c3576cb77b527f223cf2b9fc2b2e9af5e7adee25","label":"c3576cb77b52","date":"2026-10-21T10:28:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f5ef203abda9dd36b2af473c7b737d544f807bd","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/8f5ef203abda9dd36b2af473c7b737d544f807bd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97918","title":"tracing: Undo the registration when enabling the histogram trigger fails","status":"backported","project":false,"upstream":[{"sha":"92383cef66791a0c63a2f27755cadbdb2fbf270b","url":"https://git.kernel.org/stable/c/92383cef66791a0c63a2f27755cadbdb2fbf270b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/880712b6f48103ba3a04b154ff076d45fe86dcec","label":"880712b6f481","date":"2026-10-21T10:28:33+02:00","lore":["https://lore.kernel.org/linux-trace-kernel/20260907092944.3950E1F00A3D@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"92383cef66791a0c63a2f27755cadbdb2fbf270b","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/92383cef66791a0c63a2f27755cadbdb2fbf270b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97906","title":"bootconfig: Fix integer overflow in initrd size check","status":"backported","project":false,"upstream":[{"sha":"7812d6dab0698001e50e8c2f901e17da3eb6f429","url":"https://git.kernel.org/stable/c/7812d6dab0698001e50e8c2f901e17da3eb6f429"}],"evidence":[{"url":"https://git.kernel.org/stable/c/97be05f33f79342ea65d9b99c9ad07a93b8eef5a","label":"97be05f33f79","date":"2026-10-21T10:28:33+02:00","lore":["https://lore.kernel.org/all/178905333479.213925.1358412668943562406.stgit@devnote2/","https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7812d6dab0698001e50e8c2f901e17da3eb6f429","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7812d6dab0698001e50e8c2f901e17da3eb6f429.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97619","title":"io_uring/rw: end write accounting from ->ki_complete","status":"backported","project":false,"upstream":[{"sha":"796aa0547557e63338657ed1c487906f9fac4c73","url":"https://git.kernel.org/stable/c/796aa0547557e63338657ed1c487906f9fac4c73"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ed1cead97afb9c398bd7ab344a3c1ee34ab73af9","label":"ed1cead97afb","date":"2026-10-21T10:26:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"796aa0547557e63338657ed1c487906f9fac4c73","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/796aa0547557e63338657ed1c487906f9fac4c73.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97619","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97619.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97600","title":"ieee802154: cc2520: fix FIFOP work use-after-free","status":"backported","project":false,"upstream":[{"sha":"ff5891b266a7fc6a062710836be84f1cc19338b5","url":"https://git.kernel.org/stable/c/ff5891b266a7fc6a062710836be84f1cc19338b5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4a1ba62a486a4c43af91d01661a95e82dc4aaefa","label":"4a1ba62a486a","date":"2026-10-21T10:26:42+02:00","lore":["https://lore.kernel.org/20260812061714.175966-1-fanwu01@zju.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ff5891b266a7fc6a062710836be84f1cc19338b5","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/ff5891b266a7fc6a062710836be84f1cc19338b5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97600","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97600.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97566","title":"mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0","status":"backported","project":false,"upstream":[{"sha":"2ac7d6e620764f1fc79eb4edd3610a7a661981ca","url":"https://git.kernel.org/stable/c/2ac7d6e620764f1fc79eb4edd3610a7a661981ca"}],"evidence":[{"url":"https://git.kernel.org/stable/c/189d60057e5f3d6a62e3d71a3cc428c9150bc14f","label":"189d60057e5f","date":"2026-10-21T10:28:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-97566","series":"6.6.y","upstream":["2ac7d6e620764f1fc79eb4edd3610a7a661981ca"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"Removing address ID zero deletes subflows but leaves pending ADD_ADDR state and the signaled counter intact.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: net/mptcp/pm_netlink.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/mptcp/pm_netlink.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n1716"},{"label":"Upstream fix 2ac7d6e62076","url":"https://git.kernel.org/stable/c/2ac7d6e620764f1fc79eb4edd3610a7a661981ca"}]},"size":{"status":"unknown","patches":[{"sha":"2ac7d6e620764f1fc79eb4edd3610a7a661981ca","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97566","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97566.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97565","title":"smb: client: reject short READ responses in CIFSSMBRead()","status":"unfixed","project":false,"upstream":[{"sha":"e6142a8bfc230c7263eb8b0475249c958ce49367","url":"https://git.kernel.org/stable/c/e6142a8bfc230c7263eb8b0475249c958ce49367"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e6142a8bfc230c7263eb8b0475249c958ce49367","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/e6142a8bfc230c7263eb8b0475249c958ce49367.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97565","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97565.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97563","title":"smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()","status":"unfixed","project":false,"upstream":[{"sha":"5be5bdda5863eacc964b609ba927764f253431b3","url":"https://git.kernel.org/stable/c/5be5bdda5863eacc964b609ba927764f253431b3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5be5bdda5863eacc964b609ba927764f253431b3","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/5be5bdda5863eacc964b609ba927764f253431b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97563","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97563.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97562","title":"smb: client: pin DFS superblock in iterator callback","status":"backported","project":false,"upstream":[{"sha":"d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","url":"https://git.kernel.org/stable/c/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3c9acc9835c304013a4faeb969fe9333d66ca9f8","label":"3c9acc9835c3","date":"2026-10-03T12:30:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97562","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97562.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97538","title":"hwmon: (asus_rog_ryujin) Validate HID report lengths","status":"not-applicable","project":false,"upstream":[{"sha":"8042312e73c50de82634ce63eae7cf219464b481","url":"https://git.kernel.org/stable/c/8042312e73c50de82634ce63eae7cf219464b481"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8042312e73c50de82634ce63eae7cf219464b481","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/8042312e73c50de82634ce63eae7cf219464b481.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97526","title":"s390/pai: Support CPU hotplug for PMU PAI","status":"not-applicable","project":false,"upstream":[{"sha":"9ecc4d033879f7761f2df07e20cd2fbec00fd90b","url":"https://git.kernel.org/stable/c/9ecc4d033879f7761f2df07e20cd2fbec00fd90b"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"9ecc4d033879f7761f2df07e20cd2fbec00fd90b","lines":292,"reason":"","source":"https://github.com/torvalds/linux/commit/9ecc4d033879f7761f2df07e20cd2fbec00fd90b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97526","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97526.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97515","title":"i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845","status":"unfixed","project":false,"upstream":[{"sha":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","url":"https://git.kernel.org/stable/c/1effa3adfe53cb2bb28bf5640a676b791d5ab405"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/1effa3adfe53cb2bb28bf5640a676b791d5ab405.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97515","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97515.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97499","title":"coresight: perf: Retrieve path and source from event data","status":"unfixed","project":false,"upstream":[{"sha":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","url":"https://git.kernel.org/stable/c/f37bc31447c0ddafedb25e3c4a4f4e2284034247"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","lines":229,"reason":"","source":"https://github.com/torvalds/linux/commit/f37bc31447c0ddafedb25e3c4a4f4e2284034247.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97496","title":"drm/amdkfd: Fix OOB memory exposure in get_wave_state()","status":"backported","project":false,"upstream":[{"sha":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","url":"https://git.kernel.org/stable/c/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e2bef0f168be46692a6b900916ff5da3771480ed","label":"e2bef0f168be","date":"2026-10-03T12:29:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97496","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97496.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97424","title":"drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq","status":"backported","project":false,"upstream":[{"sha":"e3829992dd9fa0a82511af4f01733fc854cd15a5","url":"https://git.kernel.org/stable/c/e3829992dd9fa0a82511af4f01733fc854cd15a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c1f2f34d681a0b354e1218b83245d1f2d2139a8d","label":"c1f2f34d681a","date":"2026-10-21T10:28:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"e3829992dd9fa0a82511af4f01733fc854cd15a5","lines":131,"reason":"","source":"https://github.com/torvalds/linux/commit/e3829992dd9fa0a82511af4f01733fc854cd15a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93799","title":"wifi: iwlwifi: mvm: validate sta_id in BA window status notif","status":"backported","project":false,"upstream":[{"sha":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","url":"https://git.kernel.org/stable/c/6aa77efaea9efea92e3090c35ad348fd759a3cf3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f9938eb95e2ddab4a58d3946a320abcbd60b56a4","label":"f9938eb95e2d","date":"2026-10-03T12:30:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/6aa77efaea9efea92e3090c35ad348fd759a3cf3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93796","title":"wifi: iwlwifi: pcie: null RX pointers after free","status":"backported","project":false,"upstream":[{"sha":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","url":"https://git.kernel.org/stable/c/2c79d7a7b583050c9f58041465cb46fe3483ab5d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c422d5d53f135ea987f745773953a91f9fe30c3f","label":"c422d5d53f13","date":"2026-10-21T10:28:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-93796","series":"6.6.y","upstream":["2c79d7a7b583050c9f58041465cb46fe3483ab5d"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"iwl_pcie_rx_free frees RX allocations but leaves most pointers non-NULL, so repeated teardown can reuse freed pointers.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/wireless/intel/iwlwifi/pcie/rx.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi/pcie/rx.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n1199"},{"label":"Upstream fix 2c79d7a7b583","url":"https://git.kernel.org/stable/c/2c79d7a7b583050c9f58041465cb46fe3483ab5d"}]},"size":{"status":"unknown","patches":[{"sha":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93796","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93796.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93276","title":"phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator","status":"not-applicable","project":false,"upstream":[{"sha":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","url":"https://git.kernel.org/stable/c/49c9b71b45081e5e5eeb507a2d6edb80d332dc59"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/49c9b71b45081e5e5eeb507a2d6edb80d332dc59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93276","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93276.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93270","title":"bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn","status":"not-applicable","project":false,"upstream":[{"sha":"7a0855e73757ee9cf25ba635a1c735018ecba742","url":"https://git.kernel.org/stable/c/7a0855e73757ee9cf25ba635a1c735018ecba742"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"7a0855e73757ee9cf25ba635a1c735018ecba742","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/7a0855e73757ee9cf25ba635a1c735018ecba742.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93270","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93270.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93244","title":"drm/sysfb: simpledrm: Improve stride validation","status":"backported","project":false,"upstream":[{"sha":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","url":"https://git.kernel.org/stable/c/df6533f11688aa30be3bb883c7637f4ffdbb7cbd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/110dd054fd4af97fc3f47d7df9a016b07122cc04","label":"110dd054fd4a","date":"2026-10-21T10:26:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-93244","series":"6.6.y","upstream":["df6533f11688aa30be3bb883c7637f4ffdbb7cbd"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"simpledrm_device_create() narrows computed minimum pitch to int without rejecting values above INT_MAX; validated input stride does not bound this computed pitch.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/tiny/simpledrm.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/tiny/simpledrm.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n620"},{"label":"Upstream fix df6533f11688","url":"https://git.kernel.org/stable/c/df6533f11688aa30be3bb883c7637f4ffdbb7cbd"}]},"size":{"status":"unknown","patches":[{"sha":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93244","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93244.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93238","title":"s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap","status":"backported","project":false,"upstream":[{"sha":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","url":"https://git.kernel.org/stable/c/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2","label":"4ba8a08f5f26","date":"2026-09-14T13:28:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93238","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93238.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93237","title":"LoongArch: Add DIRECT_MAP_PHYSMEM_END definition","status":"unfixed","project":false,"upstream":[{"sha":"2677f97a67fdbc62a82ce1faa67791f54451d36f","url":"https://git.kernel.org/stable/c/2677f97a67fdbc62a82ce1faa67791f54451d36f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2677f97a67fdbc62a82ce1faa67791f54451d36f","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/2677f97a67fdbc62a82ce1faa67791f54451d36f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93235","title":"f2fs: fix to zero post-EOF data when extending file size","status":"backported","project":false,"upstream":[{"sha":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","url":"https://git.kernel.org/stable/c/5eced87b7d19dbc76ebdddaf322046f9ac582fcb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6882d458d2e403f6ba7b45542dd31a6b7531eb2e","label":"6882d458d2e4","date":"2026-09-14T13:28:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/5eced87b7d19dbc76ebdddaf322046f9ac582fcb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93235","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93235.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93221","title":"nfsd: convert nfsd_net boolean flags to unsigned long flags word","status":"backported","project":false,"upstream":[{"sha":"11a5fe42e1811f793e04ef885b639ea7668f439d","url":"https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/94b450977c60261903c945419d2df4a464de60c4","label":"94b450977c60","date":"2026-10-21T10:28:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"11a5fe42e1811f793e04ef885b639ea7668f439d","lines":276,"reason":"","source":"https://github.com/torvalds/linux/commit/11a5fe42e1811f793e04ef885b639ea7668f439d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93221","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93221.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93216","title":"mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()","status":"backported","project":false,"upstream":[{"sha":"90f095b816e25c6a9e4446d299bac5007fdcb3df","url":"https://git.kernel.org/stable/c/90f095b816e25c6a9e4446d299bac5007fdcb3df"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e7c1923c5f30a6953f0540e3171d882ec17b05d3","label":"e7c1923c5f30","date":"2026-10-21T10:28:26+02:00","lore":["https://lore.kernel.org/20260714015117.78351-10-ye.liu@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"90f095b816e25c6a9e4446d299bac5007fdcb3df","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/90f095b816e25c6a9e4446d299bac5007fdcb3df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93216","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93216.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93184","title":"ASoC: fsl_audmix: rework runtime PM handling in probe","status":"unfixed","project":false,"upstream":[{"sha":"3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71","url":"https://git.kernel.org/stable/c/3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71","lines":59,"reason":"","source":"https://github.com/torvalds/linux/commit/3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93184","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93184.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93181","title":"perf/x86/intel/uncore: Fix uncore_box ref/unref ordering","status":"not-applicable","project":false,"upstream":[{"sha":"174f0582e38abe03b88e15f04bfe58490f88cb19","url":"https://git.kernel.org/stable/c/174f0582e38abe03b88e15f04bfe58490f88cb19"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"174f0582e38abe03b88e15f04bfe58490f88cb19","lines":108,"reason":"","source":"https://github.com/torvalds/linux/commit/174f0582e38abe03b88e15f04bfe58490f88cb19.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93181","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93181.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93155","title":"crypto: keembay - Fix AEAD unregister count in error path","status":"backported","project":false,"upstream":[{"sha":"e264401ce4776a288524e5b87593d4d864147115","url":"https://git.kernel.org/stable/c/e264401ce4776a288524e5b87593d4d864147115"}],"evidence":[{"url":"https://git.kernel.org/stable/c/27ec91c29ee155cc507b2f56221fc6fab65dbb51","label":"27ec91c29ee1","date":"2026-09-14T13:29:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e264401ce4776a288524e5b87593d4d864147115","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93155","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93155.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93154","title":"RDMA/irdma: Add refcounting to user ring MRs","status":"unfixed","project":false,"upstream":[{"sha":"f67d8a08f60c9217df6d40da56422d2049f5e334","url":"https://git.kernel.org/stable/c/f67d8a08f60c9217df6d40da56422d2049f5e334"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"f67d8a08f60c9217df6d40da56422d2049f5e334","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/f67d8a08f60c9217df6d40da56422d2049f5e334.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93154","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93154.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93135","title":"bpf: Reject programs with inlined helpers if JIT is not available","status":"not-applicable","project":false,"upstream":[{"sha":"f1c27922576edccb99d0257827d09bd05c0304a6","url":"https://git.kernel.org/stable/c/f1c27922576edccb99d0257827d09bd05c0304a6"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"f1c27922576edccb99d0257827d09bd05c0304a6","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/f1c27922576edccb99d0257827d09bd05c0304a6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93135","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93135.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93123","title":"serial: qcom-geni: do not advance stale DMA completions","status":"not-applicable","project":false,"upstream":[{"sha":"7ea38c49e7178960926657863299face6dc0e1b0","url":"https://git.kernel.org/stable/c/7ea38c49e7178960926657863299face6dc0e1b0"}],"evidence":[],"submission_lore":[],"basis":"The older qcom-geni flush path already stops TX DMA, resets and clears completion state, unmaps the transfer, clears tx_dma_addr, and zeroes tx_remaining.","review":{"id":"CVE-2026-93123","series":"6.6.y","upstream":["7ea38c49e7178960926657863299face6dc0e1b0"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"no-op","applicability":"unaffected","reason":"The older qcom-geni flush path already stops TX DMA, resets and clears completion state, unmaps the transfer, clears tx_dma_addr, and zeroes tx_remaining.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"7ea38c49e7178960926657863299face6dc0e1b0","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/7ea38c49e7178960926657863299face6dc0e1b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93100","title":"fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()","status":"backported","project":false,"upstream":[{"sha":"f5bcf539484d2d604c2f2330e09487ea090b21c7","url":"https://git.kernel.org/stable/c/f5bcf539484d2d604c2f2330e09487ea090b21c7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/971b40e3ca1279ca4917889e0195d33b66d071a4","label":"971b40e3ca12","date":"2026-10-21T10:28:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-93100","series":"6.6.y","upstream":["f5bcf539484d2d604c2f2330e09487ea090b21c7"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"rdtgroup_kn_put decrements then reads flags outside rdtgroup_mutex","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: arch/x86/kernel/cpu/resctrl/rdtgroup.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/cpu/resctrl/rdtgroup.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n2316"},{"label":"Upstream fix f5bcf539484d","url":"https://git.kernel.org/stable/c/f5bcf539484d2d604c2f2330e09487ea090b21c7"}]},"size":{"status":"unknown","patches":[{"sha":"f5bcf539484d2d604c2f2330e09487ea090b21c7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93100","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93100.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93099","title":"fs/resctrl: Fix UAF from worker threads when domains are removed","status":"unfixed","project":false,"upstream":[{"sha":"2566b5cd6a275c124e8f154fef6e815f92ec8d5c","url":"https://git.kernel.org/stable/c/2566b5cd6a275c124e8f154fef6e815f92ec8d5c"}],"evidence":[],"submission_lore":[],"basis":"domain offline path uses non-synchronous delayed-work cancellation","review":{"id":"CVE-2026-93099","series":"6.6.y","upstream":["2566b5cd6a275c124e8f154fef6e815f92ec8d5c"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"domain offline path uses non-synchronous delayed-work cancellation","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: arch/x86/kernel/cpu/resctrl/monitor.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/cpu/resctrl/monitor.c?id=79643295eba17affbd16ca97f3ef04c90266b28c"},{"label":"Upstream fix 2566b5cd6a27","url":"https://git.kernel.org/stable/c/2566b5cd6a275c124e8f154fef6e815f92ec8d5c"}]},"size":{"status":"over-limit","patches":[{"sha":"2566b5cd6a275c124e8f154fef6e815f92ec8d5c","lines":199,"reason":"","source":"https://github.com/torvalds/linux/commit/2566b5cd6a275c124e8f154fef6e815f92ec8d5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93099","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93099.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93093","title":"firmware: arm_scmi: Publish channel state before callbacks","status":"backported","project":true,"upstream":[{"sha":"0314900dcdde044af0208fed212035dbfaa55843","url":"https://git.kernel.org/stable/c/0314900dcdde044af0208fed212035dbfaa55843"}],"evidence":[{"url":"https://git.kernel.org/stable/c/50e38091a657ad81385e2aea7e2575e17ac23d79","label":"50e38091a657","date":"2026-10-21T10:27:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0314900dcdde044af0208fed212035dbfaa55843","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93093","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93093.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93091","title":"firmware: arm_scmi: Quiesce notifications before teardown","status":"unfixed","project":false,"upstream":[{"sha":"8e49055d0d495c9c07575ad8e111d9eaf0efb13f","url":"https://git.kernel.org/stable/c/8e49055d0d495c9c07575ad8e111d9eaf0efb13f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8e49055d0d495c9c07575ad8e111d9eaf0efb13f","lines":86,"reason":"","source":"https://github.com/torvalds/linux/commit/8e49055d0d495c9c07575ad8e111d9eaf0efb13f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93091","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93091.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93083","title":"firmware: arm_scmi: Unwind TX receiver mailbox setup failure","status":"backported","project":true,"upstream":[{"sha":"6f7c06744d53dc8e047725d411d7f915d9ec35ae","url":"https://git.kernel.org/stable/c/6f7c06744d53dc8e047725d411d7f915d9ec35ae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d4cf99c7ea95accde58df34bc8636bbebb3066c2","label":"d4cf99c7ea95","date":"2026-10-21T10:27:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-93083","series":"6.6.y","upstream":["6f7c06744d53dc8e047725d411d7f915d9ec35ae"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"mailbox_chan_setup returns after receiver request failure without freeing primary channel","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/firmware/arm_scmi/mailbox.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/firmware/arm_scmi/mailbox.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n164"},{"label":"Upstream fix 6f7c06744d53","url":"https://git.kernel.org/stable/c/6f7c06744d53dc8e047725d411d7f915d9ec35ae"}]},"size":{"status":"within-limit","patches":[{"sha":"6f7c06744d53dc8e047725d411d7f915d9ec35ae","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/6f7c06744d53dc8e047725d411d7f915d9ec35ae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93083","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93083.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93072","title":"irqchip/renesas-irqc: Fix generic interrupt chip leak on remove","status":"backported","project":false,"upstream":[{"sha":"616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba","url":"https://git.kernel.org/stable/c/616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3d39757ef791f90028da9c8b7c1fbbb497237e58","label":"3d39757ef791","date":"2026-09-14T13:29:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93072","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93072.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93047","title":"drm/v3d: Associate BOs with every job that accesses them","status":"unfixed","project":false,"upstream":[{"sha":"fa98563ab00dbe62fcedfef6bdd34ded7a860d9f","url":"https://git.kernel.org/stable/c/fa98563ab00dbe62fcedfef6bdd34ded7a860d9f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"fa98563ab00dbe62fcedfef6bdd34ded7a860d9f","lines":175,"reason":"","source":"https://github.com/torvalds/linux/commit/fa98563ab00dbe62fcedfef6bdd34ded7a860d9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93047","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93047.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93044","title":"bpf: Disallow interpreter fallback for arena-related insns","status":"not-applicable","project":false,"upstream":[{"sha":"34746b5a84ec37c0ea2bf6808c65c5ed8790eb51","url":"https://git.kernel.org/stable/c/34746b5a84ec37c0ea2bf6808c65c5ed8790eb51"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"34746b5a84ec37c0ea2bf6808c65c5ed8790eb51","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/34746b5a84ec37c0ea2bf6808c65c5ed8790eb51.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92518","title":"riscv, bpf: Fix kernel stack corruption in tailcall with CFI","status":"not-applicable","project":false,"upstream":[{"sha":"52fb1756ea1d2759dfef2d86245be00b05dac3a2","url":"https://git.kernel.org/stable/c/52fb1756ea1d2759dfef2d86245be00b05dac3a2"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"52fb1756ea1d2759dfef2d86245be00b05dac3a2","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/52fb1756ea1d2759dfef2d86245be00b05dac3a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92518","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92518.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92500","title":"ext4: use fsdata to track inline data write state and fix race","status":"unfixed","project":false,"upstream":[{"sha":"7edbb323bab2b2a609016014caafdb651c898249","url":"https://git.kernel.org/stable/c/7edbb323bab2b2a609016014caafdb651c898249"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7edbb323bab2b2a609016014caafdb651c898249","lines":95,"reason":"","source":"https://github.com/torvalds/linux/commit/7edbb323bab2b2a609016014caafdb651c898249.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92500","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92500.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92499","title":"ext4: validate readdir offset before accessing dirent","status":"unfixed","project":false,"upstream":[{"sha":"bc4b7b0414c33b2c8898eb04386df0d21a13dad8","url":"https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"bc4b7b0414c33b2c8898eb04386df0d21a13dad8","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/bc4b7b0414c33b2c8898eb04386df0d21a13dad8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92493","title":"cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active","status":"unfixed","project":false,"upstream":[{"sha":"8d31bb1451643f328db0cea0e21e63ef54b4faf2","url":"https://git.kernel.org/stable/c/8d31bb1451643f328db0cea0e21e63ef54b4faf2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8d31bb1451643f328db0cea0e21e63ef54b4faf2","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/8d31bb1451643f328db0cea0e21e63ef54b4faf2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90401","title":"md: remove REQ_NOWAIT support from raid1/10/456","status":"unfixed","project":false,"upstream":[{"sha":"3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","url":"https://git.kernel.org/stable/c/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","lines":588,"reason":"","source":"https://github.com/torvalds/linux/commit/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90401","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90401.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90397","title":"firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published","status":"backported","project":false,"upstream":[{"sha":"966d23c7e68ea32679275a7e3d2383181002c868","url":"https://git.kernel.org/stable/c/966d23c7e68ea32679275a7e3d2383181002c868"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c9c1e3da0a206270e5df470ca1c82de52190d68c","label":"c9c1e3da0a20","date":"2026-10-21T10:28:22+02:00","lore":["https://lore.kernel.org/r/20260724094939.613844-2-mukesh.ojha@oss.qualcomm.com"]}],"submission_lore":[],"basis":"6.6 publishes __scm before requesting the IRQ and lacks the later pre-publication tzmem call path, so neither reported pre-publication dereference can occur.","review":{"id":"CVE-2026-90397","series":"6.6.y","upstream":["966d23c7e68ea32679275a7e3d2383181002c868"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"no-op","applicability":"unaffected","reason":"6.6 publishes __scm before requesting the IRQ and lacks the later pre-publication tzmem call path, so neither reported pre-publication dereference can occur.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"966d23c7e68ea32679275a7e3d2383181002c868","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/966d23c7e68ea32679275a7e3d2383181002c868.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90397","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90397.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90389","title":"md: scope memalloc_noio to allocation critical sections","status":"unfixed","project":false,"upstream":[{"sha":"bace2010dd7ac07bc980575afb135c406730a7fe","url":"https://git.kernel.org/stable/c/bace2010dd7ac07bc980575afb135c406730a7fe"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"bace2010dd7ac07bc980575afb135c406730a7fe","lines":306,"reason":"","source":"https://github.com/torvalds/linux/commit/bace2010dd7ac07bc980575afb135c406730a7fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90389","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90389.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90379","title":"wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash","status":"unfixed","project":false,"upstream":[{"sha":"915672c5ae32deeb72f4572856d123f314791136","url":"https://git.kernel.org/stable/c/915672c5ae32deeb72f4572856d123f314791136"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"915672c5ae32deeb72f4572856d123f314791136","lines":227,"reason":"","source":"https://github.com/torvalds/linux/commit/915672c5ae32deeb72f4572856d123f314791136.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90379","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90379.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90375","title":"wifi: mt76: fix non-AQL packet accounting for MLO stations","status":"backported","project":false,"upstream":[{"sha":"8ae659743ba936b22ecb4620815887728e2820d6","url":"https://git.kernel.org/stable/c/8ae659743ba936b22ecb4620815887728e2820d6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2c321f86846ead00552bc65f73f5b5f1f81d4023","label":"2c321f86846e","date":"2026-10-21T10:28:21+02:00","lore":[]}],"submission_lore":[],"basis":"The mt76 code in these targets predates the affected MLO station accounting path; 6.1 has no mac80211 MLO and neither target has the mt76 MLO path changed upstream. Applying fragments would be a no-op or would import later MLO infrastructure.","review":{"id":"CVE-2026-90375","series":"6.6.y","upstream":["8ae659743ba936b22ecb4620815887728e2820d6"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The mt76 code in these targets predates the affected MLO station accounting path; 6.1 has no mac80211 MLO and neither target has the mt76 MLO path changed upstream. Applying fragments would be a no-op or would import later MLO infrastructure.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"8ae659743ba936b22ecb4620815887728e2820d6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90375","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90375.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90373","title":"wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear","status":"unfixed","project":false,"upstream":[{"sha":"6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba","url":"https://git.kernel.org/stable/c/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90373","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90373.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90359","title":"bpf: Reject >8 byte return values on return-reading trampoline paths","status":"unfixed","project":false,"upstream":[{"sha":"c48796aa6c392cde93946e5d5a9a1f1b1cf72feb","url":"https://git.kernel.org/stable/c/c48796aa6c392cde93946e5d5a9a1f1b1cf72feb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c48796aa6c392cde93946e5d5a9a1f1b1cf72feb","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/c48796aa6c392cde93946e5d5a9a1f1b1cf72feb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90359","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90359.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90333","title":"dm-integrity: replace forgeable discard filler with a keyed sector marker","status":"unfixed","project":false,"upstream":[{"sha":"68c5c42567bc462139128968ebbfadd0aefff519","url":"https://git.kernel.org/stable/c/68c5c42567bc462139128968ebbfadd0aefff519"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"68c5c42567bc462139128968ebbfadd0aefff519","lines":357,"reason":"","source":"https://github.com/torvalds/linux/commit/68c5c42567bc462139128968ebbfadd0aefff519.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90321","title":"ocfs2: validate inline xattrs during inode block validation","status":"backported","project":false,"upstream":[{"sha":"8914a3330b72378136c2c02d6328a826f6abdad7","url":"https://git.kernel.org/stable/c/8914a3330b72378136c2c02d6328a826f6abdad7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7dec19f6bafe4e1503007141c9f5eb7eb10e5578","label":"7dec19f6bafe","date":"2026-10-21T10:28:20+02:00","lore":["https://lore.kernel.org/20260705025311.3429854-1-zzzccc427@gmail.com","https://lore.kernel.org/20260705025311.3429854-2-zzzccc427@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8914a3330b72378136c2c02d6328a826f6abdad7","lines":164,"reason":"","source":"https://github.com/torvalds/linux/commit/8914a3330b72378136c2c02d6328a826f6abdad7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90321","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90321.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90320","title":"ocfs2: validate external xattr entries when reading metadata","status":"backported","project":false,"upstream":[{"sha":"2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6","url":"https://git.kernel.org/stable/c/2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dc5778dbd0b6c411107a0e37e913a94b3c2f2728","label":"dc5778dbd0b6","date":"2026-10-21T10:28:31+02:00","lore":["https://lore.kernel.org/20260705025311.3429854-3-zzzccc427@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6","lines":121,"reason":"","source":"https://github.com/torvalds/linux/commit/2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90320","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90320.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90317","title":"bpf: Invalidate RCU pointers after final spin unlock","status":"unfixed","project":false,"upstream":[{"sha":"180c7000712db77063b3a26f4c97e7dd9038f449","url":"https://git.kernel.org/stable/c/180c7000712db77063b3a26f4c97e7dd9038f449"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"180c7000712db77063b3a26f4c97e7dd9038f449","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/180c7000712db77063b3a26f4c97e7dd9038f449.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90315","title":"PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers","status":"unfixed","project":false,"upstream":[{"sha":"747b9bbbbdfdee51aee2456388f9b94b5086de4d","url":"https://git.kernel.org/stable/c/747b9bbbbdfdee51aee2456388f9b94b5086de4d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"747b9bbbbdfdee51aee2456388f9b94b5086de4d","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/747b9bbbbdfdee51aee2456388f9b94b5086de4d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90306","title":"ARM: 9481/2: breakpoint: CFI breakpoints only on demand","status":"not-applicable","project":false,"upstream":[{"sha":"8ed9bff906cf8036531d1559f10e82733a52b41f","url":"https://git.kernel.org/stable/c/8ed9bff906cf8036531d1559f10e82733a52b41f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ed9bff906cf8036531d1559f10e82733a52b41f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8ed9bff906cf8036531d1559f10e82733a52b41f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90306","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90306.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90265","title":"btrfs: defrag: fix deadlock between defrag and delalloc space reservation","status":"backported","project":false,"upstream":[{"sha":"ba02eab28041f9a4bbe9fc90c7249644fef6de0f","url":"https://git.kernel.org/stable/c/ba02eab28041f9a4bbe9fc90c7249644fef6de0f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c97277aa6ce8ac725642aced0fe20cd8d31f6e09","label":"c97277aa6ce8","date":"2026-10-21T10:28:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ba02eab28041f9a4bbe9fc90c7249644fef6de0f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90265","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90265.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90261","title":"btrfs: zoned: flush active metadata block group at btree_writepages() start","status":"unfixed","project":false,"upstream":[{"sha":"ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b","url":"https://git.kernel.org/stable/c/ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b","lines":132,"reason":"","source":"https://github.com/torvalds/linux/commit/ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90261","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90261.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90256","title":"Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind","status":"backported","project":false,"upstream":[{"sha":"2b66c83ff1751d6bd3201b3017206262ab46dc05","url":"https://git.kernel.org/stable/c/2b66c83ff1751d6bd3201b3017206262ab46dc05"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0fa448369c87e20b2aeaeaca0187d698dd61f791","label":"0fa448369c87","date":"2026-10-21T10:28:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b66c83ff1751d6bd3201b3017206262ab46dc05","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/2b66c83ff1751d6bd3201b3017206262ab46dc05.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90256","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90256.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90237","title":"netfilter: nft_ct: move custom expectation support to helper","status":"unfixed","project":false,"upstream":[{"sha":"3679da4ad8be84cddaf40bc307fef1fe13e051ff","url":"https://git.kernel.org/stable/c/3679da4ad8be84cddaf40bc307fef1fe13e051ff"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3679da4ad8be84cddaf40bc307fef1fe13e051ff","lines":260,"reason":"","source":"https://github.com/torvalds/linux/commit/3679da4ad8be84cddaf40bc307fef1fe13e051ff.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90230","title":"nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()","status":"backported","project":false,"upstream":[{"sha":"5bb96cc218835769ab74ec7f3ea2bf81fbffe955","url":"https://git.kernel.org/stable/c/5bb96cc218835769ab74ec7f3ea2bf81fbffe955"}],"evidence":[{"url":"https://git.kernel.org/stable/c/89ff11b72f38976f3b5aea23a5228ee05e277209","label":"89ff11b72f38","date":"2026-09-14T13:29:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5bb96cc218835769ab74ec7f3ea2bf81fbffe955","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/5bb96cc218835769ab74ec7f3ea2bf81fbffe955.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90230","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90230.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90227","title":"nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()","status":"backported","project":false,"upstream":[{"sha":"b53d495c7f0db46b6748b5ade48371a10dd5d3bc","url":"https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c35cd98eed1a863e8dd51073953563cd8c907f68","label":"c35cd98eed1a","date":"2026-09-14T13:29:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b53d495c7f0db46b6748b5ade48371a10dd5d3bc","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/b53d495c7f0db46b6748b5ade48371a10dd5d3bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90227","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90227.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90220","title":"ALSA: seq: Don't leak the extension cell pointer in the bounce payload","status":"unfixed","project":false,"upstream":[{"sha":"59e1592d3c270ff4642d5d6dc55c545306eb0693","url":"https://git.kernel.org/stable/c/59e1592d3c270ff4642d5d6dc55c545306eb0693"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"59e1592d3c270ff4642d5d6dc55c545306eb0693","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/59e1592d3c270ff4642d5d6dc55c545306eb0693.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90220","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90220.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90217","title":"bpf: Compare iterator types during state pruning","status":"not-applicable","project":false,"upstream":[{"sha":"83608e303b95d07afba1c15da0b5d9e513c2f15a","url":"https://git.kernel.org/stable/c/83608e303b95d07afba1c15da0b5d9e513c2f15a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"83608e303b95d07afba1c15da0b5d9e513c2f15a","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/83608e303b95d07afba1c15da0b5d9e513c2f15a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90211","title":"bpf, s390: Clear fetch destination on faulting arena atomic","status":"not-applicable","project":false,"upstream":[{"sha":"cc3e12330599f097f0e1f792435686ddc276f26d","url":"https://git.kernel.org/stable/c/cc3e12330599f097f0e1f792435686ddc276f26d"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"cc3e12330599f097f0e1f792435686ddc276f26d","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/cc3e12330599f097f0e1f792435686ddc276f26d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90199","title":"fs/ntfs3: reject out-of-range evcn in mi_enum_attr()","status":"backported","project":false,"upstream":[{"sha":"20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3","url":"https://git.kernel.org/stable/c/20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0441e34ce098c19185a7b52c5b8b89a8a5b26888","label":"0441e34ce098","date":"2026-09-14T13:29:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90199","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90199.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90154","title":"ksmbd: scope session state changes to bound connections","status":"backported","project":false,"upstream":[{"sha":"c50e628122aed077695669e25b842e778511a43d","url":"https://git.kernel.org/stable/c/c50e628122aed077695669e25b842e778511a43d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3deefd5fb1368e2577144b0961b1a5df26b587d1","label":"3deefd5fb136","date":"2026-10-21T10:28:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c50e628122aed077695669e25b842e778511a43d","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/c50e628122aed077695669e25b842e778511a43d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90154","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90154.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90129","title":"virtio_balloon: quiesce balloon work before device shutdown","status":"unfixed","project":false,"upstream":[{"sha":"7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","url":"https://git.kernel.org/stable/c/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90119","title":"ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup","status":"backported","project":false,"upstream":[{"sha":"d736eba9c453fedce664fdf592c8b71ecff1932b","url":"https://git.kernel.org/stable/c/d736eba9c453fedce664fdf592c8b71ecff1932b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c5c7c7b6cfae73c46e4544a9ef08ff89231a670d","label":"c5c7c7b6cfae","date":"2026-09-14T13:29:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d736eba9c453fedce664fdf592c8b71ecff1932b","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/d736eba9c453fedce664fdf592c8b71ecff1932b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90119","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90119.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90098","title":"net: sparx5: fix sleep in atomic context in MAC table access","status":"unfixed","project":false,"upstream":[{"sha":"b62793a7baeea9cf20209c9fd2e333311aaf3b8d","url":"https://git.kernel.org/stable/c/b62793a7baeea9cf20209c9fd2e333311aaf3b8d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b62793a7baeea9cf20209c9fd2e333311aaf3b8d","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/b62793a7baeea9cf20209c9fd2e333311aaf3b8d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90098","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90098.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90060","title":"ALSA: control: Don't add invalid kcontrols to LED layer","status":"backported","project":true,"upstream":[{"sha":"74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11","url":"https://git.kernel.org/stable/c/74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3b8a540b36aa064822c701e4e0a1dea2cd4ec5b0","label":"3b8a540b36aa","date":"2026-10-21T10:27:22+02:00","lore":["https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90060","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90060.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90040","title":"KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped","status":"not-applicable","project":false,"upstream":[{"sha":"d1a3c216233413f57f5341a9b878b7e2dde7e785","url":"https://git.kernel.org/stable/c/d1a3c216233413f57f5341a9b878b7e2dde7e785"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"d1a3c216233413f57f5341a9b878b7e2dde7e785","lines":242,"reason":"","source":"https://github.com/torvalds/linux/commit/d1a3c216233413f57f5341a9b878b7e2dde7e785.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90040","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90040.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90036","title":"NFSD: Prevent client use-after-free during blocked-lock reaping","status":"backported","project":false,"upstream":[{"sha":"9026932ac8be4d0ae01db47f23619a98cc57b671","url":"https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0d53a47c913d0bce3b5ec35c28cbcca4d015f33d","label":"0d53a47c913d","date":"2026-10-21T10:28:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9026932ac8be4d0ae01db47f23619a98cc57b671","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/9026932ac8be4d0ae01db47f23619a98cc57b671.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90036","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90036.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90027","title":"usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop","status":"unfixed","project":false,"upstream":[{"sha":"263f7d61a4201cde16849b2d016251806e7418be","url":"https://git.kernel.org/stable/c/263f7d61a4201cde16849b2d016251806e7418be"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"263f7d61a4201cde16849b2d016251806e7418be","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/263f7d61a4201cde16849b2d016251806e7418be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90027","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90027.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89944","title":"ASoC: hdac_hda: Fix hlink refcount leak on component registration failure","status":"backported","project":true,"upstream":[{"sha":"6ad4892c4f5cb437a928a02f5b7d37d496aa9268","url":"https://git.kernel.org/stable/c/6ad4892c4f5cb437a928a02f5b7d37d496aa9268"}],"evidence":[{"url":"https://git.kernel.org/stable/c/60b5824ae259ad15f7878e4e763ec31ba4db55f2","label":"60b5824ae259","date":"2026-10-21T10:27:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6ad4892c4f5cb437a928a02f5b7d37d496aa9268","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89938","title":"iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF","status":"backported","project":false,"upstream":[{"sha":"be61c8c6252671ecf1fee0ad90f87669e0be1e20","url":"https://git.kernel.org/stable/c/be61c8c6252671ecf1fee0ad90f87669e0be1e20"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f64b437641b5a70c18bb0fd38da2b69d8926c871","label":"f64b437641b5","date":"2026-09-14T13:28:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"be61c8c6252671ecf1fee0ad90f87669e0be1e20","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/be61c8c6252671ecf1fee0ad90f87669e0be1e20.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89935","title":"iio: light: apds9306: fix PM reference leak in apds9306_read_data()","status":"not-applicable","project":false,"upstream":[{"sha":"d378fceaafd79e0dc59d3546bda251a3058062c0","url":"https://git.kernel.org/stable/c/d378fceaafd79e0dc59d3546bda251a3058062c0"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"d378fceaafd79e0dc59d3546bda251a3058062c0","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/d378fceaafd79e0dc59d3546bda251a3058062c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89935","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89935.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89929","title":"KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU","status":"backported","project":false,"upstream":[{"sha":"6d00e67326d831e6e610933a3800712f4ffe6ec1","url":"https://git.kernel.org/stable/c/6d00e67326d831e6e610933a3800712f4ffe6ec1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1759a565a25c814ced9281a708749c71fa69d6fe","label":"1759a565a25c","date":"2026-10-21T10:28:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6d00e67326d831e6e610933a3800712f4ffe6ec1","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/6d00e67326d831e6e610933a3800712f4ffe6ec1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89913","title":"KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables","status":"unfixed","project":false,"upstream":[{"sha":"f5b8f203bfc07a5a257dff859e66d2c500f9f509","url":"https://git.kernel.org/stable/c/f5b8f203bfc07a5a257dff859e66d2c500f9f509"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f5b8f203bfc07a5a257dff859e66d2c500f9f509","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/f5b8f203bfc07a5a257dff859e66d2c500f9f509.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89913","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89913.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89906","title":"LoongArch: BPF: Refactor jump offset calculation in tail call","status":"backported","project":false,"upstream":[{"sha":"37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","url":"https://git.kernel.org/stable/c/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/50fbc294e4e96246d60cd66f98acf043a362e3a0","label":"50fbc294e4e9","date":"2026-10-21T10:28:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89899","title":"media: cec: disable delayed work before freeing an interrupted transmit","status":"unfixed","project":false,"upstream":[{"sha":"0fbd5c2327020858c45b2d1c65775d64cdeca523","url":"https://git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fbd5c2327020858c45b2d1c65775d64cdeca523","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0fbd5c2327020858c45b2d1c65775d64cdeca523.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89866","title":"media: chips-media: wave5: Resume device before setting EOS flag","status":"not-applicable","project":false,"upstream":[{"sha":"a52e6f7923c17a672135b485ffd96fbd72f46267","url":"https://git.kernel.org/stable/c/a52e6f7923c17a672135b485ffd96fbd72f46267"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"a52e6f7923c17a672135b485ffd96fbd72f46267","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/a52e6f7923c17a672135b485ffd96fbd72f46267.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89866","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89866.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89862","title":"scsi: qla2xxx: Fix BSG job leak on validate flash image error path","status":"unfixed","project":false,"upstream":[{"sha":"0fb52cc632464b0cd07f970341330466d772efe1","url":"https://git.kernel.org/stable/c/0fb52cc632464b0cd07f970341330466d772efe1"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fb52cc632464b0cd07f970341330466d772efe1","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/0fb52cc632464b0cd07f970341330466d772efe1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89826","title":"drm/panthor: harden firmware build-info bounds checks","status":"not-applicable","project":false,"upstream":[{"sha":"8321b093fa6c297b80586460ce6914d9655df170","url":"https://git.kernel.org/stable/c/8321b093fa6c297b80586460ce6914d9655df170"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8321b093fa6c297b80586460ce6914d9655df170","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/8321b093fa6c297b80586460ce6914d9655df170.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89806","title":"drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation","status":"backported","project":false,"upstream":[{"sha":"c6f48e59ece0123f6a11527ad4d89b21c2d65b87","url":"https://git.kernel.org/stable/c/c6f48e59ece0123f6a11527ad4d89b21c2d65b87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0cec951667a624fafaca2695c46042f45851caec","label":"0cec951667a6","date":"2026-10-21T10:26:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-89806","series":"6.6.y","upstream":["c6f48e59ece0123f6a11527ad4d89b21c2d65b87"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"ofdrm_device_create() computes fb_size as linebytes multiplied by height without overflow detection before using the size.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/tiny/ofdrm.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/tiny/ofdrm.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n1079"},{"label":"Upstream fix c6f48e59ece0","url":"https://git.kernel.org/stable/c/c6f48e59ece0123f6a11527ad4d89b21c2d65b87"}]},"size":{"status":"within-limit","patches":[{"sha":"c6f48e59ece0123f6a11527ad4d89b21c2d65b87","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/c6f48e59ece0123f6a11527ad4d89b21c2d65b87.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89805","title":"drm/pagemap: Fix folio allocation fallback and use-after-put","status":"not-applicable","project":false,"upstream":[{"sha":"df72e55e754c8d449321ddddad19a8bd3cb8d032","url":"https://git.kernel.org/stable/c/df72e55e754c8d449321ddddad19a8bd3cb8d032"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"df72e55e754c8d449321ddddad19a8bd3cb8d032","lines":181,"reason":"","source":"https://github.com/torvalds/linux/commit/df72e55e754c8d449321ddddad19a8bd3cb8d032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89805","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89805.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89797","title":"power: supply: ab8500_fg: fix use-after-free on remove","status":"unfixed","project":false,"upstream":[{"sha":"75b1e88d34254f4fb7753345e21bfee47abddd7f","url":"https://git.kernel.org/stable/c/75b1e88d34254f4fb7753345e21bfee47abddd7f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"75b1e88d34254f4fb7753345e21bfee47abddd7f","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/75b1e88d34254f4fb7753345e21bfee47abddd7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89793","title":"ublk: clear VM_MAYWRITE on read-only ublk char device mmap","status":"backported","project":false,"upstream":[{"sha":"6e2b571b0a54755b06e092501913e1dfefe75d6c","url":"https://git.kernel.org/stable/c/6e2b571b0a54755b06e092501913e1dfefe75d6c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/be41733c24be58e2a1ef718c80fafdfb98a40d5e","label":"be41733c24be","date":"2026-09-14T13:28:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6e2b571b0a54755b06e092501913e1dfefe75d6c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/6e2b571b0a54755b06e092501913e1dfefe75d6c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89793","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89793.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89788","title":"ksmbd: fix tree connection use-after-free in smb2_tree_connect()","status":"backported","project":false,"upstream":[{"sha":"b5ec6c462aab1062cf5d1e667ba7c6442f737055","url":"https://git.kernel.org/stable/c/b5ec6c462aab1062cf5d1e667ba7c6442f737055"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ca3a3984bf445aaec69f6937f11e560d4b849365","label":"ca3a3984bf44","date":"2026-10-21T10:28:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5ec6c462aab1062cf5d1e667ba7c6442f737055","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/b5ec6c462aab1062cf5d1e667ba7c6442f737055.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89788","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89788.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89772","title":"btrfs: write-protect folios during data writeback","status":"not-applicable","project":false,"upstream":[{"sha":"5376c9db45368eb210b4d71104ac00a59dc8b6e0","url":"https://git.kernel.org/stable/c/5376c9db45368eb210b4d71104ac00a59dc8b6e0"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"5376c9db45368eb210b4d71104ac00a59dc8b6e0","lines":125,"reason":"","source":"https://github.com/torvalds/linux/commit/5376c9db45368eb210b4d71104ac00a59dc8b6e0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89772","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89772.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89768","title":"fs: fix user path of nested backing files","status":"not-applicable","project":false,"upstream":[{"sha":"f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d","url":"https://git.kernel.org/stable/c/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d"}],"evidence":[],"submission_lore":[],"basis":"No effect: 6.6 lacks fs/backing-file.c, backing_file_open(), and the Fixes-path LSM backing-file implementation. Do not import the later backing-file framework. The nested user-path regression cannot execute on this target.","review":{"id":"CVE-2026-89768","series":"6.6.y","upstream":["f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"No effect: 6.6 lacks fs/backing-file.c, backing_file_open(), and the Fixes-path LSM backing-file implementation. Do not import the later backing-file framework. The nested user-path regression cannot execute on this target.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89762","title":"apparmor: fix cred UAF caused by begin_current_label_crit_section()","status":"backported","project":true,"upstream":[{"sha":"3f4ae5fab613dca01d6a2a8210dd832e009fcf47","url":"https://git.kernel.org/stable/c/3f4ae5fab613dca01d6a2a8210dd832e009fcf47"}],"evidence":[{"url":"https://git.kernel.org/stable/c/089f10b47843a86fa03a8c20799c9353660e5288","label":"089f10b47843","date":"2026-10-21T10:27:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3f4ae5fab613dca01d6a2a8210dd832e009fcf47","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89755","title":"mm/migrate_device: clear stale mapping after freeing swapcache","status":"backported","project":false,"upstream":[{"sha":"34a00895d032a414830d41106a09329ae6c251b6","url":"https://git.kernel.org/stable/c/34a00895d032a414830d41106a09329ae6c251b6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/92db780dd644590c751246187e1229d5ac2e5544","label":"92db780dd644","date":"2026-10-21T10:28:13+02:00","lore":["https://lore.kernel.org/20260728062832.1107127-1-arvind.yadav@intel.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"34a00895d032a414830d41106a09329ae6c251b6","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/34a00895d032a414830d41106a09329ae6c251b6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89755","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89755.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89739","title":"usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition","status":"unfixed","project":false,"upstream":[{"sha":"9c855832790cd488d87de1885974f4c37cfe7358","url":"https://git.kernel.org/stable/c/9c855832790cd488d87de1885974f4c37cfe7358"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9c855832790cd488d87de1885974f4c37cfe7358","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/9c855832790cd488d87de1885974f4c37cfe7358.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89739","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89739.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89722","title":"PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()","status":"unfixed","project":false,"upstream":[{"sha":"dc76258d0132df1d831a5a29758bd448ca9c566e","url":"https://git.kernel.org/stable/c/dc76258d0132df1d831a5a29758bd448ca9c566e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"dc76258d0132df1d831a5a29758bd448ca9c566e","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/dc76258d0132df1d831a5a29758bd448ca9c566e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89722","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89722.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89708","title":"nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown","status":"unfixed","project":false,"upstream":[{"sha":"01c5d5f58a5db9b0ee5afba2e49d3157788687b2","url":"https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"01c5d5f58a5db9b0ee5afba2e49d3157788687b2","lines":324,"reason":"","source":"https://github.com/torvalds/linux/commit/01c5d5f58a5db9b0ee5afba2e49d3157788687b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89708","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89708.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89675","title":"nfsd: fix UAF in async copy cancel and shutdown","status":"unfixed","project":false,"upstream":[{"sha":"62c0f6eaf050bb9284c1f9cac6ed1770092e6b95","url":"https://git.kernel.org/stable/c/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"62c0f6eaf050bb9284c1f9cac6ed1770092e6b95","lines":230,"reason":"","source":"https://github.com/torvalds/linux/commit/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89675","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89675.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89644","title":"btrfs: fix extent map leak in NOCOW direct I/O write","status":"backported","project":false,"upstream":[{"sha":"3f950867c307c5413d628a153ac44915bd117ffd","url":"https://git.kernel.org/stable/c/3f950867c307c5413d628a153ac44915bd117ffd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cb732d302245b14943a5017015fffa8e6db7a6c0","label":"cb732d302245","date":"2026-10-21T10:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-89644","series":"6.6.y","upstream":["3f950867c307c5413d628a153ac44915bd117ffd"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"btrfs_get_blocks_direct_write leaks input extent map on NOCOW error","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/btrfs/inode.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/btrfs/inode.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n7394"},{"label":"Upstream fix 3f950867c307","url":"https://git.kernel.org/stable/c/3f950867c307c5413d628a153ac44915bd117ffd"}]},"size":{"status":"unknown","patches":[{"sha":"3f950867c307c5413d628a153ac44915bd117ffd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89644","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89644.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89639","title":"cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC","status":"not-applicable","project":false,"upstream":[{"sha":"364b183230586a62660a7280c1eb20138338eeb5","url":"https://git.kernel.org/stable/c/364b183230586a62660a7280c1eb20138338eeb5"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"364b183230586a62660a7280c1eb20138338eeb5","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/364b183230586a62660a7280c1eb20138338eeb5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89639","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89639.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89637","title":"smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2","status":"unfixed","project":false,"upstream":[{"sha":"730d0bb19507b9e19c2fe5343109ac618e2fbce5","url":"https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5"}],"evidence":[],"submission_lore":[],"basis":"cifs_check_trans2 returns false for malformed/rejected secondary replies even when multiRsp is set, allowing handle_mid to overwrite response state and leave dangling server buffer pointers.","review":{"id":"CVE-2026-89637","series":"6.6.y","upstream":["730d0bb19507b9e19c2fe5343109ac618e2fbce5"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"cifs_check_trans2 returns false for malformed/rejected secondary replies even when multiRsp is set, allowing handle_mid to overwrite response state and leave dangling server buffer pointers.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/smb/client/smb1ops.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/smb/client/smb1ops.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n386"},{"label":"Upstream fix 730d0bb19507","url":"https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5"}]},"size":{"status":"within-limit","patches":[{"sha":"730d0bb19507b9e19c2fe5343109ac618e2fbce5","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/730d0bb19507b9e19c2fe5343109ac618e2fbce5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89637","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89637.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89633","title":"smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()","status":"backported","project":false,"upstream":[{"sha":"6343c1da561962688f203362d80d6a3bfa39fa1b","url":"https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6eb70b78e48b0031bd1a05fe1b58959a48e87739","label":"6eb70b78e48b","date":"2026-10-21T10:26:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-89633","series":"6.6.y","upstream":["6343c1da561962688f203362d80d6a3bfa39fa1b"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"The SMB1 coalesce_t2 handler trusts server-provided DataOffset for source and target pointers and memcpy without validating either range against its buffer.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/smb/client/smb1ops.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/smb/client/smb1ops.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n287"},{"label":"Upstream fix 6343c1da5619","url":"https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b"}]},"size":{"status":"unknown","patches":[{"sha":"6343c1da561962688f203362d80d6a3bfa39fa1b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89633","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89633.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89632","title":"smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()","status":"backported","project":false,"upstream":[{"sha":"05f78e6cf34ea3a285053bd5999e08e8ac298bd5","url":"https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b70bc592afd19732e2e4563300ebe8f974280365","label":"b70bc592afd1","date":"2026-10-21T10:28:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"05f78e6cf34ea3a285053bd5999e08e8ac298bd5","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/05f78e6cf34ea3a285053bd5999e08e8ac298bd5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89632","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89632.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89630","title":"smb: client: restore the data_offset bound in is_valid_oplock_break()","status":"not-applicable","project":false,"upstream":[{"sha":"ba22f575de9deeae4ae0859ca4315a7698226237","url":"https://git.kernel.org/stable/c/ba22f575de9deeae4ae0859ca4315a7698226237"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ba22f575de9deeae4ae0859ca4315a7698226237","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/ba22f575de9deeae4ae0859ca4315a7698226237.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89630","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89630.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89611","title":"ntfs: validate non-resident attribute offsets","status":"unknown","project":false,"upstream":[{"sha":"a83e82b0ec3ae523028e24813f23f18b43e8fc1c","url":"https://git.kernel.org/stable/c/a83e82b0ec3ae523028e24813f23f18b43e8fc1c"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"a83e82b0ec3ae523028e24813f23f18b43e8fc1c","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/a83e82b0ec3ae523028e24813f23f18b43e8fc1c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89611","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89611.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89610","title":"ntfs: verify run length exceeding volume boundary","status":"unknown","project":false,"upstream":[{"sha":"fea9e4488f384c0ef1c0e3d96b565127c1b98447","url":"https://git.kernel.org/stable/c/fea9e4488f384c0ef1c0e3d96b565127c1b98447"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"fea9e4488f384c0ef1c0e3d96b565127c1b98447","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/fea9e4488f384c0ef1c0e3d96b565127c1b98447.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89610","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89610.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89584","title":"block: validate user space vectors during extraction","status":"not-applicable","project":false,"upstream":[{"sha":"14b007e178811db72fbb1ebb3535160db6ec1e6a","url":"https://git.kernel.org/stable/c/14b007e178811db72fbb1ebb3535160db6ec1e6a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"14b007e178811db72fbb1ebb3535160db6ec1e6a","lines":168,"reason":"","source":"https://github.com/torvalds/linux/commit/14b007e178811db72fbb1ebb3535160db6ec1e6a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89584","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89584.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89568","title":"kho: fix size calculation in kho_preserved_memory_reserve()","status":"not-applicable","project":false,"upstream":[{"sha":"3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded","url":"https://git.kernel.org/stable/c/3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89568","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89568.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89567","title":"jbd2: bound shrinker scans by examined checkpoint buffers","status":"backported","project":true,"upstream":[{"sha":"15cb16496446b94e67f7abcb049b8e2c75cd3d02","url":"https://git.kernel.org/stable/c/15cb16496446b94e67f7abcb049b8e2c75cd3d02"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6b5366ba63a58819396045ab146bd37ff9e503c6","label":"6b5366ba63a5","date":"2026-10-21T10:27:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"15cb16496446b94e67f7abcb049b8e2c75cd3d02","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/15cb16496446b94e67f7abcb049b8e2c75cd3d02.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89567","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89567.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89566","title":"jbd2: check need_resched() when skipping busy checkpoint buffers","status":"backported","project":true,"upstream":[{"sha":"f213e12ff5c9590b1034ae8da0e6d09665c772d0","url":"https://git.kernel.org/stable/c/f213e12ff5c9590b1034ae8da0e6d09665c772d0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dc7ece0b827fe3b748db685fb85cd2fc3710c3f9","label":"dc7ece0b827f","date":"2026-10-21T10:27:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f213e12ff5c9590b1034ae8da0e6d09665c772d0","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/f213e12ff5c9590b1034ae8da0e6d09665c772d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89566","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89566.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89545","title":"sunrpc: defer rq_argp and rq_resp free until after RCU grace period","status":"unfixed","project":false,"upstream":[{"sha":"c479bde671cbe2f9e152834a8b0eb7c3c295bbaf","url":"https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c479bde671cbe2f9e152834a8b0eb7c3c295bbaf","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89545","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89545.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89534","title":"svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails","status":"unfixed","project":false,"upstream":[{"sha":"01500306e1d50de7ca7a2cdcdfa28ac0523eb747","url":"https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"01500306e1d50de7ca7a2cdcdfa28ac0523eb747","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/01500306e1d50de7ca7a2cdcdfa28ac0523eb747.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89534","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89534.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89451","title":"iommu/sva: Set handle->dev before the SVA handle is visible","status":"backported","project":false,"upstream":[{"sha":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","url":"https://git.kernel.org/stable/c/530f8f9c3546cb3ebee1b135375aaee08a073ebb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c4c71368bc5c5b3840590d39b4cfa12d733cadf4","label":"c4c71368bc5c","date":"2026-10-21T10:28:31+02:00","lore":[]}],"submission_lore":[],"basis":"No effect: 6.6 allocates a fresh per-call handle that is not published or shared; only the domain is looked up before handle->dev is initialized. Do not move fields merely to resemble the post-refactor implementation. The reported race requires the later shared/refcounted handle introduced by the Fixes commit's newer form.","review":{"id":"CVE-2026-89451","series":"6.6.y","upstream":["530f8f9c3546cb3ebee1b135375aaee08a073ebb"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"No effect: 6.6 allocates a fresh per-call handle that is not published or shared; only the domain is looked up before handle->dev is initialized. Do not move fields merely to resemble the post-refactor implementation. The reported race requires the later shared/refcounted handle introduced by the Fixes commit's newer form.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/530f8f9c3546cb3ebee1b135375aaee08a073ebb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89451","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89451.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-81016","title":"platform/x86/amd/pmc: Propagate SMU errors and validate S2D address","status":"backported","project":false,"upstream":[{"sha":"0225c1d637687b03726f00ac65b6def843d2c464","url":"https://git.kernel.org/stable/c/0225c1d637687b03726f00ac65b6def843d2c464"}],"evidence":[{"url":"https://git.kernel.org/stable/c/85ef9d4c384c1d143c51580933674d94dba3b8d9","label":"85ef9d4c384c","date":"2026-10-21T10:28:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-81016","series":"6.6.y","upstream":["0225c1d637687b03726f00ac65b6def843d2c464"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"amd_pmc_s2d_init ignores LOW/HIGH address-command errors before mapping","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/platform/x86/amd/pmc/pmc.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/amd/pmc/pmc.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n995"},{"label":"Upstream fix 0225c1d63768","url":"https://git.kernel.org/stable/c/0225c1d637687b03726f00ac65b6def843d2c464"}]},"size":{"status":"unknown","patches":[{"sha":"0225c1d637687b03726f00ac65b6def843d2c464","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81016","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-81016.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-81010","title":"io_uring/waitid: honor task_work cancellation","status":"not-applicable","project":false,"upstream":[{"sha":"14572de82e5022899e5856008bc9cac97004a88c","url":"https://git.kernel.org/stable/c/14572de82e5022899e5856008bc9cac97004a88c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"14572de82e5022899e5856008bc9cac97004a88c","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/14572de82e5022899e5856008bc9cac97004a88c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-81010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80999","title":"net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO","status":"unfixed","project":false,"upstream":[{"sha":"fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc","url":"https://git.kernel.org/stable/c/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc"}],"evidence":[],"submission_lore":[],"basis":"Legacy Realtek SMI and MDIO reset-probe paths use non-sleeping gpiod_set_value on optional reset GPIOs; sleeping GPIO controllers can warn/fail. Both open-coded paths need cansleep conversion.","review":{"id":"CVE-2026-80999","series":"6.6.y","upstream":["fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"Legacy Realtek SMI and MDIO reset-probe paths use non-sleeping gpiod_set_value on optional reset GPIOs; sleeping GPIO controllers can warn/fail. Both open-coded paths need cansleep conversion.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/dsa/realtek/realtek-mdio.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/dsa/realtek/realtek-mdio.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n143"},{"label":"Checked source: drivers/net/dsa/realtek/realtek-smi.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/dsa/realtek/realtek-smi.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n411"},{"label":"Upstream fix fb58b6a696b3","url":"https://git.kernel.org/stable/c/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc"}]},"size":{"status":"within-limit","patches":[{"sha":"fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80990","title":"net: thunderbolt: Release the Rx HopID that was handed out on mismatch","status":"backported","project":false,"upstream":[{"sha":"2f1463554d0561a2fead81e3888604e5c1125e29","url":"https://git.kernel.org/stable/c/2f1463554d0561a2fead81e3888604e5c1125e29"}],"evidence":[{"url":"https://git.kernel.org/stable/c/47981eb66461ba4e74bbaea0f139adaaeb3991e9","label":"47981eb66461","date":"2026-09-14T13:28:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2f1463554d0561a2fead81e3888604e5c1125e29","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80989","title":"net: thunderbolt: Mark the connection down when bringing it up fails","status":"backported","project":false,"upstream":[{"sha":"3c8b26ebf525ba5960510f48c6e9936a79ebe76f","url":"https://git.kernel.org/stable/c/3c8b26ebf525ba5960510f48c6e9936a79ebe76f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e0d4a17afde5aa0045dc3e1d66c6bb80927bad8c","label":"e0d4a17afde5","date":"2026-09-14T13:28:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3c8b26ebf525ba5960510f48c6e9936a79ebe76f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80947","title":"wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop","status":"backported","project":false,"upstream":[{"sha":"6c080026ecc17eecb103f8927c64ea73a74bb818","url":"https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818"}],"evidence":[{"url":"https://git.kernel.org/stable/c/17d5ae58973122eea7625a87cd3d80a8beb23b47","label":"17d5ae589731","date":"2026-10-21T10:26:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-80947","series":"6.6.y","upstream":["6c080026ecc17eecb103f8927c64ea73a74bb818"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"rtl8xxxu RX work can be scheduled after the stop flag because scheduling occurs outside the lock, and stop does not cancel rx_urb_wq before teardown.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n5827"},{"label":"Checked source: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n5827"},{"label":"Upstream fix 6c080026ecc1","url":"https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818"}]},"size":{"status":"unknown","patches":[{"sha":"6c080026ecc17eecb103f8927c64ea73a74bb818","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80920","title":"io_uring: defer eventfd signaling when queued from a wakeup handler","status":"backported","project":false,"upstream":[{"sha":"cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e","url":"https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d0c240f25e654442a72af5ca021a02165ccce638","label":"d0c240f25e65","date":"2026-10-21T10:28:08+02:00","lore":["https://lore.kernel.org/all/20260813133843.2933127-1-4ncienth@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e","lines":163,"reason":"","source":"https://github.com/torvalds/linux/commit/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80899","title":"erofs: remove fscache backend entirely","status":"not-applicable","project":false,"upstream":[{"sha":"c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56","url":"https://git.kernel.org/stable/c/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56","lines":1137,"reason":"","source":"https://github.com/torvalds/linux/commit/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80872","title":"ALSA: hda/tas2781: Cancel async firmware request at unbind","status":"unfixed","project":false,"upstream":[{"sha":"5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9","url":"https://git.kernel.org/stable/c/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9"}],"evidence":[],"submission_lore":[],"basis":"async tasdev_fw_ready callback is not canceled before unbind teardown","review":{"id":"CVE-2026-80872","series":"6.6.y","upstream":["5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"async tasdev_fw_ready callback is not canceled before unbind teardown","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: sound/pci/hda/tas2781_hda_i2c.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/sound/pci/hda/tas2781_hda_i2c.c?id=79643295eba17affbd16ca97f3ef04c90266b28c"},{"label":"Upstream fix 5367e2ad14f0","url":"https://git.kernel.org/stable/c/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9"}]},"size":{"status":"within-limit","patches":[{"sha":"5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80862","title":"nvme-tcp: fix usage of page_frag_cache","status":"unfixed","project":false,"upstream":[{"sha":"36ac05f7cfd59d90c597071304b14e98090d5dd1","url":"https://git.kernel.org/stable/c/36ac05f7cfd59d90c597071304b14e98090d5dd1"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"36ac05f7cfd59d90c597071304b14e98090d5dd1","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/36ac05f7cfd59d90c597071304b14e98090d5dd1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80820","title":"xfs: don't livelock in scrub on a circular unlinked list","status":"unfixed","project":false,"upstream":[{"sha":"527eaaefddb6ec5c83a06c9a1559960dd6361753","url":"https://git.kernel.org/stable/c/527eaaefddb6ec5c83a06c9a1559960dd6361753"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"527eaaefddb6ec5c83a06c9a1559960dd6361753","lines":149,"reason":"","source":"https://github.com/torvalds/linux/commit/527eaaefddb6ec5c83a06c9a1559960dd6361753.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80820","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80820.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80785","title":"fbdev: serialize mode sysfs access with lock_fb_info()","status":"unfixed","project":false,"upstream":[{"sha":"061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2","url":"https://git.kernel.org/stable/c/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80785","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80785.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80771","title":"HID: nintendo: register input device after capabilities are set","status":"not-applicable","project":false,"upstream":[{"sha":"d723bc1fe2e72b9252234e94c11af644ec477bf7","url":"https://git.kernel.org/stable/c/d723bc1fe2e72b9252234e94c11af644ec477bf7"}],"evidence":[],"submission_lore":[],"basis":"Both target joycon paths set button/axis capabilities, FF_RUMBLE, and create the memless FF object before input_register_device(), so the reported dev->ff/udev race is absent.","review":{"id":"CVE-2026-80771","series":"6.6.y","upstream":["d723bc1fe2e72b9252234e94c11af644ec477bf7"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"no-op","applicability":"unaffected","reason":"Both target joycon paths set button/axis capabilities, FF_RUMBLE, and create the memless FF object before input_register_device(), so the reported dev->ff/udev race is absent.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"d723bc1fe2e72b9252234e94c11af644ec477bf7","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/d723bc1fe2e72b9252234e94c11af644ec477bf7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80771","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80771.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80721","title":"Bluetooth: ISO: ensure no dangling hcon references in iso_conn","status":"not-applicable","project":false,"upstream":[{"sha":"aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb","url":"https://git.kernel.org/stable/c/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80721","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80721.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80705","title":"drm/amd/display: check if dml21_add_phantom_plane() is successful","status":"not-applicable","project":false,"upstream":[{"sha":"000acb4ce7fb9feba3072ce468ad681f6585cd5d","url":"https://git.kernel.org/stable/c/000acb4ce7fb9feba3072ce468ad681f6585cd5d"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"000acb4ce7fb9feba3072ce468ad681f6585cd5d","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/000acb4ce7fb9feba3072ce468ad681f6585cd5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80705","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80705.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80704","title":"drm/amd/display: use proper context for logging","status":"backported","project":false,"upstream":[{"sha":"114b42507b6a23d9d24e24e4ef165233332c64d4","url":"https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/07b52a41765722ec971e0cd9739b140bf4933998","label":"07b52a417657","date":"2026-10-21T10:28:07+02:00","lore":["https://lore.kernel.org/all/a9ee54e6-2413-4156-9bde-d528ae3c63a3@kernel.org/"]}],"submission_lore":[],"basis":"The older target file already uses an empty DC_LOGGER_INIT and DC_LOG_SYNC expands directly to DRM logging without dereferencing calc_pll_cs->ctx; the upstream logger-context rewrite would not fix an extant target bug.","review":{"id":"CVE-2026-80704","series":"6.6.y","upstream":["114b42507b6a23d9d24e24e4ef165233332c64d4"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"no-op","applicability":"unaffected","reason":"The older target file already uses an empty DC_LOGGER_INIT and DC_LOG_SYNC expands directly to DRM logging without dereferencing calc_pll_cs->ctx; the upstream logger-context rewrite would not fix an extant target bug.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"114b42507b6a23d9d24e24e4ef165233332c64d4","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/114b42507b6a23d9d24e24e4ef165233332c64d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80704","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80704.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80685","title":"mm/util: don't read __page_2 for order-1 folios in snapshot_page()","status":"not-applicable","project":false,"upstream":[{"sha":"7441d6348c70738e9ed307510db171c7a9b3f4bf","url":"https://git.kernel.org/stable/c/7441d6348c70738e9ed307510db171c7a9b3f4bf"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7441d6348c70738e9ed307510db171c7a9b3f4bf","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7441d6348c70738e9ed307510db171c7a9b3f4bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80685","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80685.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80676","title":"Drivers: hv: vmbus: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"331d8900121a1d74ecd45cd2db742ddcb5a0a565","url":"https://git.kernel.org/stable/c/331d8900121a1d74ecd45cd2db742ddcb5a0a565"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a1656234a4a2dc6e975546867887c5f63e4a90f0","label":"a1656234a4a2","date":"2026-10-21T10:28:07+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"331d8900121a1d74ecd45cd2db742ddcb5a0a565","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/331d8900121a1d74ecd45cd2db742ddcb5a0a565.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80676","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80676.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80670","title":"perf tools: Use perf_env__get_cpu_topology() in machine__resolve()","status":"unfixed","project":false,"upstream":[{"sha":"5484b43a0ec8231c36fba6ead654cb72dbba8b8f","url":"https://git.kernel.org/stable/c/5484b43a0ec8231c36fba6ead654cb72dbba8b8f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5484b43a0ec8231c36fba6ead654cb72dbba8b8f","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/5484b43a0ec8231c36fba6ead654cb72dbba8b8f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80670","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80670.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80668","title":"netfilter: nf_conntrack_expect: use conntrack GC to reap expectations","status":"backported","project":false,"upstream":[{"sha":"b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2","url":"https://git.kernel.org/stable/c/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3d7b808ec35291ee75dcdb2b6fe5f587bfe9b1df","label":"3d7b808ec352","date":"2026-10-21T10:28:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"over-limit","patches":[{"sha":"b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2","lines":512,"reason":"","source":"https://github.com/torvalds/linux/commit/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80668","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80668.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80657","title":"accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer","status":"not-applicable","project":false,"upstream":[{"sha":"506255d46bdb93a281cf39e72abbca124f5c7a1b","url":"https://git.kernel.org/stable/c/506255d46bdb93a281cf39e72abbca124f5c7a1b"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"506255d46bdb93a281cf39e72abbca124f5c7a1b","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/506255d46bdb93a281cf39e72abbca124f5c7a1b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80657","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80657.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80650","title":"media: atomisp: gc2235: fix UAF and memory leak","status":"backported","project":false,"upstream":[{"sha":"628f763aee0047ff44974388d6f70f75a763026b","url":"https://git.kernel.org/stable/c/628f763aee0047ff44974388d6f70f75a763026b"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","url":"https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"628f763aee0047ff44974388d6f70f75a763026b","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/628f763aee0047ff44974388d6f70f75a763026b.patch"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","lines":168072,"reason":"","source":"https://github.com/torvalds/linux/commit/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80650","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80650.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80636","title":"netfilter: conntrack: revert ct extension genid infrastructure","status":"backported","project":false,"upstream":[{"sha":"35e21a4dccc5c255ba59ccfbfeb4629ed21da972","url":"https://git.kernel.org/stable/c/35e21a4dccc5c255ba59ccfbfeb4629ed21da972"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6bba4846f196d081bf553391d12b5a73dcc48685","label":"6bba4846f196","date":"2026-07-24T16:03:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"35e21a4dccc5c255ba59ccfbfeb4629ed21da972","lines":183,"reason":"","source":"https://github.com/torvalds/linux/commit/35e21a4dccc5c255ba59ccfbfeb4629ed21da972.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80636","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80636.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80634","title":"netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag","status":"backported","project":false,"upstream":[{"sha":"e052f920773b73be49eb4d8702a9f85de7464363","url":"https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1b52aeb40c9f04bf50eeb4ea09142139d163e239","label":"1b52aeb40c9f","date":"2026-10-21T10:28:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-80634","series":"6.6.y","upstream":["e052f920773b73be49eb4d8702a9f85de7464363"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"In renamed nft_flow_offload.c, nft_dev_path_info decrements u8 num_encaps inside WARN_ON_ONCE; zero wraps to 255 and the later route loop reads encap beyond its two-entry array.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: net/netfilter/nft_flow_offload.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/netfilter/nft_flow_offload.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n94"},{"label":"Upstream fix e052f920773b","url":"https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363"}]},"size":{"status":"unknown","patches":[{"sha":"e052f920773b73be49eb4d8702a9f85de7464363","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80611","title":"ACPI: processor_idle: Mark LPI enter functions as __cpuidle","status":"backported","project":true,"upstream":[{"sha":"956ca5d72c76504824c8eb601879da9476973e15","url":"https://git.kernel.org/stable/c/956ca5d72c76504824c8eb601879da9476973e15"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c17fe25dcb55ab94f6aa2930b7504ea666d5fcc2","label":"c17fe25dcb55","date":"2026-10-21T10:27:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"956ca5d72c76504824c8eb601879da9476973e15","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80611","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80611.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80580","title":"fbdev: bound mode sysfs output to the sysfs buffer","status":"unfixed","project":false,"upstream":[{"sha":"d15d51fb26e830af58f3f21964f1c09c239077ea","url":"https://git.kernel.org/stable/c/d15d51fb26e830af58f3f21964f1c09c239077ea"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d15d51fb26e830af58f3f21964f1c09c239077ea","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/d15d51fb26e830af58f3f21964f1c09c239077ea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80580","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80580.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80579","title":"fbdev: clear fb_info->mode before deleting a videomode","status":"unfixed","project":false,"upstream":[{"sha":"95e647d2a5304a8fd11f1ba3c8502de700650131","url":"https://git.kernel.org/stable/c/95e647d2a5304a8fd11f1ba3c8502de700650131"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"95e647d2a5304a8fd11f1ba3c8502de700650131","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/95e647d2a5304a8fd11f1ba3c8502de700650131.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80579","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80579.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80556","title":"mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition","status":"unfixed","project":false,"upstream":[{"sha":"c125ee35a49a0518521b52b27631eef061b8719a","url":"https://git.kernel.org/stable/c/c125ee35a49a0518521b52b27631eef061b8719a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c125ee35a49a0518521b52b27631eef061b8719a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/c125ee35a49a0518521b52b27631eef061b8719a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80556","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80556.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80546","title":"s390/zcrypt: Improve CCA CPRB length and overflow checks","status":"not-applicable","project":false,"upstream":[{"sha":"35ac6754ba6da45fd193f5ce3f665f7490b830d5","url":"https://git.kernel.org/stable/c/35ac6754ba6da45fd193f5ce3f665f7490b830d5"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"35ac6754ba6da45fd193f5ce3f665f7490b830d5","lines":110,"reason":"","source":"https://github.com/torvalds/linux/commit/35ac6754ba6da45fd193f5ce3f665f7490b830d5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80546","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80546.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80545","title":"s390/zcrypt: Improve EP11 CPRB length and overflow checks","status":"not-applicable","project":false,"upstream":[{"sha":"17ac0bc866fc624cd05f022dcd8b730c0af11bb1","url":"https://git.kernel.org/stable/c/17ac0bc866fc624cd05f022dcd8b730c0af11bb1"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"17ac0bc866fc624cd05f022dcd8b730c0af11bb1","lines":197,"reason":"","source":"https://github.com/torvalds/linux/commit/17ac0bc866fc624cd05f022dcd8b730c0af11bb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80545","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80545.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80544","title":"s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing","status":"not-applicable","project":false,"upstream":[{"sha":"0864a163783bff109b548266921829ea794edc93","url":"https://git.kernel.org/stable/c/0864a163783bff109b548266921829ea794edc93"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"0864a163783bff109b548266921829ea794edc93","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/0864a163783bff109b548266921829ea794edc93.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80544","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80544.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80543","title":"s390/zcrypt: Pad trailing CCA or EP11 message with zeros","status":"not-applicable","project":false,"upstream":[{"sha":"eb363254472493e3458156fc11fd56dca92f4333","url":"https://git.kernel.org/stable/c/eb363254472493e3458156fc11fd56dca92f4333"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb363254472493e3458156fc11fd56dca92f4333","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/eb363254472493e3458156fc11fd56dca92f4333.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80543","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80543.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80521","title":"af_unix: Unlink scc_entry in unix_del_edge().","status":"backported","project":true,"upstream":[{"sha":"594d905195024b228c962627ae5ae7c17bd582a4","url":"https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33","label":"6fda5c51b8e4","date":"2026-10-03T12:30:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"594d905195024b228c962627ae5ae7c17bd582a4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80521","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80521.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74752","title":"sctp: validate cookie AUTH state before use","status":"backported","project":false,"upstream":[{"sha":"3dbb44d88b1e94dd31fe43588af7437b34b44d56","url":"https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4a4410de8dc6903d859c9e1731fc6dcee28bd072","label":"4a4410de8dc6","date":"2026-10-21T10:28:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"3dbb44d88b1e94dd31fe43588af7437b34b44d56","lines":105,"reason":"","source":"https://github.com/torvalds/linux/commit/3dbb44d88b1e94dd31fe43588af7437b34b44d56.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74735","title":"l2tp: fix tunnel and session refcount leak on seq_file release","status":"backported","project":false,"upstream":[{"sha":"9006c116dd111d457bf5d074990210f70a4ad2c8","url":"https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bd897e414451fb34dfdf08b31899180e5ab7149b","label":"bd897e414451","date":"2026-10-21T10:28:05+02:00","lore":["https://lore.kernel.org/netdev/6a760f32.01d0871a.3a0d52.004f.GAE@google.com/T/#u"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9006c116dd111d457bf5d074990210f70a4ad2c8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74735","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74735.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74725","title":"enic: fix tx_hang_reset use-after-free on device removal","status":"unfixed","project":false,"upstream":[{"sha":"ec680ea4ba1bca92a767fb7e7869758bfdd886e3","url":"https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ec680ea4ba1bca92a767fb7e7869758bfdd886e3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/ec680ea4ba1bca92a767fb7e7869758bfdd886e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74725","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74725.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74677","title":"net: usb: ipheth: fix carrier_work UAF on disconnect","status":"unfixed","project":false,"upstream":[{"sha":"fde39b8a521780391fb4e5bda2c0aa4928947f12","url":"https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fde39b8a521780391fb4e5bda2c0aa4928947f12","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/fde39b8a521780391fb4e5bda2c0aa4928947f12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74677","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74677.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74653","title":"serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx","status":"backported","project":false,"upstream":[{"sha":"1423415471274abda87024967d7fe2206ceee0ea","url":"https://git.kernel.org/stable/c/1423415471274abda87024967d7fe2206ceee0ea"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cc325ce1c40a111824827532ac132afb3d1c342b","label":"cc325ce1c40a","date":"2026-10-21T10:28:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1423415471274abda87024967d7fe2206ceee0ea","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/1423415471274abda87024967d7fe2206ceee0ea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74653","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74653.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74638","title":"drm/v3d: Serialize the scheduler timeout handlers","status":"unfixed","project":false,"upstream":[{"sha":"4da94744707b27a3ae1197bdd7127da4505dc5b1","url":"https://git.kernel.org/stable/c/4da94744707b27a3ae1197bdd7127da4505dc5b1"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4da94744707b27a3ae1197bdd7127da4505dc5b1","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/4da94744707b27a3ae1197bdd7127da4505dc5b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74638","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74638.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74592","title":"ima: Instantiate file_truncate and path_truncate hooks","status":"unfixed","project":false,"upstream":[{"sha":"b80bed5c871a80151351342c065579405ce77145","url":"https://git.kernel.org/stable/c/b80bed5c871a80151351342c065579405ce77145"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b80bed5c871a80151351342c065579405ce77145","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/b80bed5c871a80151351342c065579405ce77145.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74592","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74592.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74560","title":"xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx","status":"backported","project":false,"upstream":[{"sha":"a3c8382ebce4780c6b3ace2c09bc342313ac0186","url":"https://git.kernel.org/stable/c/a3c8382ebce4780c6b3ace2c09bc342313ac0186"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c24b3379c0ff00101b9ede54d36f7138d8a02c43","label":"c24b3379c0ff","date":"2026-10-21T10:28:04+02:00","lore":["https://lore.kernel.org/all/20260425041726.85FB3C2BCB2@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a3c8382ebce4780c6b3ace2c09bc342313ac0186","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/a3c8382ebce4780c6b3ace2c09bc342313ac0186.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74560","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74560.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74559","title":"xsk: drain continuation descs after overflow in xsk_build_skb()","status":"unfixed","project":false,"upstream":[{"sha":"bd44a6dcd4248883de90f5dad53ae80066e27096","url":"https://git.kernel.org/stable/c/bd44a6dcd4248883de90f5dad53ae80066e27096"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"bd44a6dcd4248883de90f5dad53ae80066e27096","lines":97,"reason":"","source":"https://github.com/torvalds/linux/commit/bd44a6dcd4248883de90f5dad53ae80066e27096.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74559","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74559.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74558","title":"xsk: reclaim invalid Tx descriptors in ZC batch path","status":"unfixed","project":false,"upstream":[{"sha":"72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","url":"https://git.kernel.org/stable/c/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","lines":404,"reason":"","source":"https://github.com/torvalds/linux/commit/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74558","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74558.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74536","title":"Bluetooth: ISO: fix leaking sk after socket release","status":"unfixed","project":false,"upstream":[{"sha":"ce57442a379212fe3fda59c9437ee8217eceb5b1","url":"https://git.kernel.org/stable/c/ce57442a379212fe3fda59c9437ee8217eceb5b1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ce57442a379212fe3fda59c9437ee8217eceb5b1","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/ce57442a379212fe3fda59c9437ee8217eceb5b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74536","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74536.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74533","title":"Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero","status":"backported","project":false,"upstream":[{"sha":"af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","url":"https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/98666d8feb514fef75fd8553f082bf7dba309d77","label":"98666d8feb51","date":"2026-10-21T10:28:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","lines":170,"reason":"","source":"https://github.com/torvalds/linux/commit/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74533","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74533.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74531","title":"Bluetooth: hci_conn: hold conn reference in abort_conn_sync()","status":"backported","project":false,"upstream":[{"sha":"5761d003daa987ac81463f570713ce9c9dd204e5","url":"https://git.kernel.org/stable/c/5761d003daa987ac81463f570713ce9c9dd204e5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/64d1645f26aa49b5a86ba2fccd0bb6749ea725a6","label":"64d1645f26aa","date":"2026-08-09T20:21:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"5761d003daa987ac81463f570713ce9c9dd204e5","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/5761d003daa987ac81463f570713ce9c9dd204e5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74531","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74531.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74521","title":"ksmbd: use memcmp() to compare ClientGUIDs","status":"backported","project":true,"upstream":[{"sha":"e8bb506e6ef749ac0336f3e579d8d02396b7d832","url":"https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5a0367bf5ce420be7b19936def2e90adcf32a683","label":"5a0367bf5ce4","date":"2026-10-03T12:30:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e8bb506e6ef749ac0336f3e579d8d02396b7d832","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74521","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74521.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74513","title":"dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister","status":"not-applicable","project":false,"upstream":[{"sha":"a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","url":"https://git.kernel.org/stable/c/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74513","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74513.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74506","title":"afs: Fix UAF when sending a message","status":"unfixed","project":false,"upstream":[{"sha":"4af1ec68d54b3871155914d584fb10669c41a861","url":"https://git.kernel.org/stable/c/4af1ec68d54b3871155914d584fb10669c41a861"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4af1ec68d54b3871155914d584fb10669c41a861","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/4af1ec68d54b3871155914d584fb10669c41a861.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74506","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74506.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74449","title":"drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport","status":"not-applicable","project":false,"upstream":[{"sha":"f327e389c07cfc3a2f6ff54f6214e1a52d457edc","url":"https://git.kernel.org/stable/c/f327e389c07cfc3a2f6ff54f6214e1a52d457edc"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"f327e389c07cfc3a2f6ff54f6214e1a52d457edc","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/f327e389c07cfc3a2f6ff54f6214e1a52d457edc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74419","title":"accel/amdxdna: Adjust size for copy_to_user()","status":"not-applicable","project":false,"upstream":[{"sha":"6e87001fe19f251e2ae14373bc76554358a13df2","url":"https://git.kernel.org/stable/c/6e87001fe19f251e2ae14373bc76554358a13df2"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"6e87001fe19f251e2ae14373bc76554358a13df2","lines":264,"reason":"","source":"https://github.com/torvalds/linux/commit/6e87001fe19f251e2ae14373bc76554358a13df2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74419","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74419.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74407","title":"wifi: ath11k: cancel SSR work items during PCI shutdown","status":"backported","project":false,"upstream":[{"sha":"8c79aac429b583301f387374ff37c59be671df87","url":"https://git.kernel.org/stable/c/8c79aac429b583301f387374ff37c59be671df87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f82d42577ee4a191b0ad0f0a3b49fc1935dff845","label":"f82d42577ee4","date":"2026-10-21T10:28:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8c79aac429b583301f387374ff37c59be671df87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74407","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74407.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74374","title":"md/raid1,raid10: fix error-path detection with md_cloned_bio()","status":"backported","project":false,"upstream":[{"sha":"811545e0926d02a6a0b1a1258bb5544777c164d4","url":"https://git.kernel.org/stable/c/811545e0926d02a6a0b1a1258bb5544777c164d4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/80eaeae0e4b1ed2418fd2b9088238651fb51df69","label":"80eaeae0e4b1","date":"2026-10-21T10:28:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"811545e0926d02a6a0b1a1258bb5544777c164d4","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/811545e0926d02a6a0b1a1258bb5544777c164d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74374","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74374.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74368","title":"wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()","status":"backported","project":false,"upstream":[{"sha":"98d4f92ab6a1af2ea2ab590d7e2801b203110981","url":"https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d960cd5dbcc6a01f49cc304b724f6b18a63a172d","label":"d960cd5dbcc6","date":"2026-10-21T10:28:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":{"id":"CVE-2026-74368","series":"6.6.y","upstream":["98d4f92ab6a1af2ea2ab590d7e2801b203110981"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"On TKIP MIC failure, ath12k_dp_rx_h_verify_tkip_mic returns -EINVAL when NWIFI header-length validation fails without freeing msdu. ath12k_dp_rx_h_defrag has already unlinked first_frag from rx_tid->rx_frags, then sets first_frag to NULL on this error. The caller error path frees NULL and purges only the remaining queue, so the unlinked first fragment leaks.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/wireless/ath/ath12k/dp_rx.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/ath/ath12k/dp_rx.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n2850"},{"label":"Checked source: drivers/net/wireless/ath/ath12k/dp_rx.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/ath/ath12k/dp_rx.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n2850"},{"label":"Checked source: drivers/net/wireless/ath/ath12k/dp_rx.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/ath/ath12k/dp_rx.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n2850"},{"label":"Upstream fix 98d4f92ab6a1","url":"https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981"}]},"size":{"status":"within-limit","patches":[{"sha":"98d4f92ab6a1af2ea2ab590d7e2801b203110981","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/98d4f92ab6a1af2ea2ab590d7e2801b203110981.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74368","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74368.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74354","title":"bpf: Take mmap_lock in zap_pages()","status":"not-applicable","project":false,"upstream":[{"sha":"80b89d0226a05e8b67969de99c31b51fcd54f76a","url":"https://git.kernel.org/stable/c/80b89d0226a05e8b67969de99c31b51fcd54f76a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"80b89d0226a05e8b67969de99c31b51fcd54f76a","lines":93,"reason":"","source":"https://github.com/torvalds/linux/commit/80b89d0226a05e8b67969de99c31b51fcd54f76a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74354","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74354.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74342","title":"kernfs: link kn to its parent before the LSM init hook","status":"unfixed","project":false,"upstream":[{"sha":"6cccc49b027c7551ffc1d2532f2ef1922661f3da","url":"https://git.kernel.org/stable/c/6cccc49b027c7551ffc1d2532f2ef1922661f3da"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6cccc49b027c7551ffc1d2532f2ef1922661f3da","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/6cccc49b027c7551ffc1d2532f2ef1922661f3da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74342","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74342.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74337","title":"bpf: Fix NMI/tracepoint re-entry deadlock on lru locks","status":"unfixed","project":false,"upstream":[{"sha":"89edbdfc5d0308cef57b71359331de5c4ddbf763","url":"https://git.kernel.org/stable/c/89edbdfc5d0308cef57b71359331de5c4ddbf763"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"89edbdfc5d0308cef57b71359331de5c4ddbf763","lines":402,"reason":"","source":"https://github.com/torvalds/linux/commit/89edbdfc5d0308cef57b71359331de5c4ddbf763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74336","title":"wifi: mac80211: bound S1G TIM PVB walk to the TIM element","status":"not-applicable","project":false,"upstream":[{"sha":"b224d18b1e5d1cddfc67f63f41d80023b2ec8889","url":"https://git.kernel.org/stable/c/b224d18b1e5d1cddfc67f63f41d80023b2ec8889"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"b224d18b1e5d1cddfc67f63f41d80023b2ec8889","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b224d18b1e5d1cddfc67f63f41d80023b2ec8889.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74336","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74336.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74324","title":"wifi: mt76: mt7925: validate skb length in testmode query","status":"not-applicable","project":false,"upstream":[{"sha":"c7369a00860a0704461d440e7c3bf9b49bfdbaee","url":"https://git.kernel.org/stable/c/c7369a00860a0704461d440e7c3bf9b49bfdbaee"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7369a00860a0704461d440e7c3bf9b49bfdbaee","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/c7369a00860a0704461d440e7c3bf9b49bfdbaee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74324","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74324.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74314","title":"bpf: Cancel special fields on map value recycle","status":"unfixed","project":false,"upstream":[{"sha":"a3a81d247651218e47153f2d2afd7aee236726fd","url":"https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"a3a81d247651218e47153f2d2afd7aee236726fd","lines":471,"reason":"","source":"https://github.com/torvalds/linux/commit/a3a81d247651218e47153f2d2afd7aee236726fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74314","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74314.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74294","title":"ASoC: meson: aiu: Validate written enum values","status":"backported","project":true,"upstream":[{"sha":"d65adf85477247be04ac86886f8edfaa047b5d4a","url":"https://git.kernel.org/stable/c/d65adf85477247be04ac86886f8edfaa047b5d4a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/90703664dbc5a4bf3d84f649404318f3cafdbe69","label":"90703664dbc5","date":"2026-10-03T12:30:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d65adf85477247be04ac86886f8edfaa047b5d4a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74294","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74294.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74291","title":"ASoC: topology: Check PCM and DAI name strings before use","status":"backported","project":true,"upstream":[{"sha":"b7e44d1986d6671342c19b82192189ca5db5dab7","url":"https://git.kernel.org/stable/c/b7e44d1986d6671342c19b82192189ca5db5dab7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c405b07246bf179e9457de57501c3470175b165e","label":"c405b07246bf","date":"2026-10-03T12:30:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"b7e44d1986d6671342c19b82192189ca5db5dab7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74291","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74291.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74289","title":"ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().","status":"backported","project":true,"upstream":[{"sha":"06b693d2eb6651a63ad85bad8673de3b7d4edd6d","url":"https://git.kernel.org/stable/c/06b693d2eb6651a63ad85bad8673de3b7d4edd6d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7907a395701b339c2d68f37456d395e953c74795","label":"7907a395701b","date":"2026-10-03T12:30:20+02:00","lore":["https://lore.kernel.org/netdev/6a290011.39669fcc.33b062.00b1.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"06b693d2eb6651a63ad85bad8673de3b7d4edd6d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74272","title":"cxl/region: Resolve region deletion races","status":"backported","project":false,"upstream":[{"sha":"4dd86ca99ffcc413cbf79063fd9956ef54e0ca91","url":"https://git.kernel.org/stable/c/4dd86ca99ffcc413cbf79063fd9956ef54e0ca91"}],"evidence":[{"url":"https://git.kernel.org/stable/c/441250eea84608c6c2dbd7f00c61df32836ac97d","label":"441250eea846","date":"2026-10-21T10:28:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"4dd86ca99ffcc413cbf79063fd9956ef54e0ca91","lines":176,"reason":"","source":"https://github.com/torvalds/linux/commit/4dd86ca99ffcc413cbf79063fd9956ef54e0ca91.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74272","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74272.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74269","title":"bnxt: fix head underflow on XDP head-grow","status":"backported","project":false,"upstream":[{"sha":"e26657fe3b85c068b01f42bb0c602f242d643ba9","url":"https://git.kernel.org/stable/c/e26657fe3b85c068b01f42bb0c602f242d643ba9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3e8f3959a7fd28461b8cd9708c21286b4250b77a","label":"3e8f3959a7fd","date":"2026-10-21T10:28:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e26657fe3b85c068b01f42bb0c602f242d643ba9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74269","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74269.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74258","title":"bpf: Guard __get_user acesss with access_ok for uprobe_multi data","status":"backported","project":true,"upstream":[{"sha":"4d87a251d45b4a95eb4c0abcfab809c9f231258a","url":"https://git.kernel.org/stable/c/4d87a251d45b4a95eb4c0abcfab809c9f231258a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ff6c5ee77dcc98381290d16af53f6262625870a6","label":"ff6c5ee77dcc","date":"2026-10-03T12:30:20+02:00","lore":["https://lore.kernel.org/bpf/20260610145235.CB1441F00893@smtp.kernel.org/","https://lore.kernel.org/r/20260611114230.950379-2-jolsa@kernel.org"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"4d87a251d45b4a95eb4c0abcfab809c9f231258a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74258","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74258.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72501","title":"RDMA/bnxt_re: Initialize dpi variable to zero","status":"backported","project":false,"upstream":[{"sha":"978b27d6ce538bb832ccd69e45802824e4301c4b","url":"https://git.kernel.org/stable/c/978b27d6ce538bb832ccd69e45802824e4301c4b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/88baaa8ca3731b9d1184a0772ac44d5738d294e8","label":"88baaa8ca373","date":"2026-10-21T10:28:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-72501","series":"6.6.y","upstream":["978b27d6ce538bb832ccd69e45802824e4301c4b"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"In renamed ib_verbs.c BNXT_RE_METHOD_ALLOC_PAGE, dpi is initialized only for WC_PAGE, then copied to userspace for DBR_BAR_PAGE and DBR_PAGE.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/infiniband/hw/bnxt_re/ib_verbs.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/bnxt_re/ib_verbs.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n4310"},{"label":"Upstream fix 978b27d6ce53","url":"https://git.kernel.org/stable/c/978b27d6ce538bb832ccd69e45802824e4301c4b"}]},"size":{"status":"within-limit","patches":[{"sha":"978b27d6ce538bb832ccd69e45802824e4301c4b","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/978b27d6ce538bb832ccd69e45802824e4301c4b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72501","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72501.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72496","title":"RDMA/bnxt_re: Proper rollback if the ioremap fails","status":"backported","project":true,"upstream":[{"sha":"87267803a8c824616eb147c5dad7030a5db6f878","url":"https://git.kernel.org/stable/c/87267803a8c824616eb147c5dad7030a5db6f878"}],"evidence":[{"url":"https://git.kernel.org/stable/c/00444baa8f74d220764ee5903f60759c120cabd5","label":"00444baa8f74","date":"2026-10-03T12:30:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"87267803a8c824616eb147c5dad7030a5db6f878","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72496","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72496.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72494","title":"RDMA/irdma: Replace waitqueue and flag with completion","status":"backported","project":false,"upstream":[{"sha":"d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd","url":"https://git.kernel.org/stable/c/d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7d89bff21c12e543d12ad70cb0103cf815891b24","label":"7d89bff21c12","date":"2026-10-21T10:28:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72494","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72494.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72493","title":"net: serialize netif_running() check in enqueue_to_backlog()","status":"unfixed","project":false,"upstream":[{"sha":"46762cefe7f4e5bffc1eb467810a7bbb02e461d7","url":"https://git.kernel.org/stable/c/46762cefe7f4e5bffc1eb467810a7bbb02e461d7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"46762cefe7f4e5bffc1eb467810a7bbb02e461d7","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/46762cefe7f4e5bffc1eb467810a7bbb02e461d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72485","title":"coresight: platform: defer connection counter increment until alloc succeeds","status":"backported","project":true,"upstream":[{"sha":"1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae","url":"https://git.kernel.org/stable/c/1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dd3c9e1c9858c797ba78f4ca6c0fc663eeac6d72","label":"dd3c9e1c9858","date":"2026-10-03T12:30:20+02:00","lore":["https://lore.kernel.org/r/20260511-fix-ref-count-issue-v1-1-99d647810d3c@oss.qualcomm.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72485","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72485.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72472","title":"nfs: use nfsi->rwsem to protect traversal of the file lock list","status":"unfixed","project":false,"upstream":[{"sha":"4837fb36219e6c08b666bc31a86841bad8526358","url":"https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4837fb36219e6c08b666bc31a86841bad8526358","lines":87,"reason":"","source":"https://github.com/torvalds/linux/commit/4837fb36219e6c08b666bc31a86841bad8526358.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72472","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72472.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72469","title":"xprtrdma: Fix ep kref imbalance on ADDR_CHANGE","status":"backported","project":false,"upstream":[{"sha":"af9b65b29af341932625c4283dc7a23cdb62688a","url":"https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a562485c359d0b20a99d466b042af9c2f7ff3326","label":"a562485c359d","date":"2026-10-21T10:28:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"af9b65b29af341932625c4283dc7a23cdb62688a","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/af9b65b29af341932625c4283dc7a23cdb62688a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72469","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72469.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72463","title":"xfrm: Fix dev use-after-free in xfrm async resumption","status":"unfixed","project":false,"upstream":[{"sha":"8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff","url":"https://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff","lines":115,"reason":"","source":"https://github.com/torvalds/linux/commit/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72463","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72463.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72454","title":"i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()","status":"unfixed","project":false,"upstream":[{"sha":"650716f23eac488c6696babdc7805f6a6b7427ad","url":"https://git.kernel.org/stable/c/650716f23eac488c6696babdc7805f6a6b7427ad"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"650716f23eac488c6696babdc7805f6a6b7427ad","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/650716f23eac488c6696babdc7805f6a6b7427ad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72454","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72454.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72438","title":"md/raid10: fix writes_pending and barrier reference leaks on discard failures","status":"backported","project":false,"upstream":[{"sha":"393d687131d8aa8c7e4de2cb494438e145d20fc2","url":"https://git.kernel.org/stable/c/393d687131d8aa8c7e4de2cb494438e145d20fc2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/80ac31cce55432034a9eb98262c92ace7866e494","label":"80ac31cce554","date":"2026-10-21T10:28:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"393d687131d8aa8c7e4de2cb494438e145d20fc2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72438","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72438.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72434","title":"netfilter: ipset: make sure gc is properly stopped","status":"unfixed","project":false,"upstream":[{"sha":"4a597a87e2e2f608edb6be2c510dc826b4fdfb53","url":"https://git.kernel.org/stable/c/4a597a87e2e2f608edb6be2c510dc826b4fdfb53"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4a597a87e2e2f608edb6be2c510dc826b4fdfb53","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/4a597a87e2e2f608edb6be2c510dc826b4fdfb53.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72434","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72434.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72413","title":"sctp: fix err_chunk memory leaks in INIT handling","status":"backported","project":true,"upstream":[{"sha":"9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2","url":"https://git.kernel.org/stable/c/9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/43ddbcdc0ed74a8fba4aff5e623ace8135411b93","label":"43ddbcdc0ed7","date":"2026-10-03T12:30:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72413","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72413.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72402","title":"bpf: Mask pseudo pointer values in verifier logs","status":"backported","project":true,"upstream":[{"sha":"72a85e9464a5332fb2cd7efd26d9295275ceda2d","url":"https://git.kernel.org/stable/c/72a85e9464a5332fb2cd7efd26d9295275ceda2d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6181239115e19cda4b483a2604193a9379cbd28f","label":"6181239115e1","date":"2026-10-03T12:30:20+02:00","lore":["https://lore.kernel.org/r/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-1-a190ebb8f3e2@mails.tsinghua.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"72a85e9464a5332fb2cd7efd26d9295275ceda2d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72402","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72402.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72397","title":"hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()","status":"backported","project":false,"upstream":[{"sha":"828cd614e2af053ca5e1d6da767bbd8a1b5cabfb","url":"https://git.kernel.org/stable/c/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cd0e037130806d7714c356eccefac6e1b92dbc34","label":"cd0e03713080","date":"2026-10-21T10:28:00+02:00","lore":["https://lore.kernel.org/r/20260620-pmbus-data2reg-vid-v1-1-5518030432c4@nexthop.ai"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"828cd614e2af053ca5e1d6da767bbd8a1b5cabfb","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72397","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72397.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72377","title":"afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints","status":"not-applicable","project":false,"upstream":[{"sha":"81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459","url":"https://git.kernel.org/stable/c/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72377","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72377.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72376","title":"afs: Fix misplaced inc of net->cells_outstanding","status":"unfixed","project":false,"upstream":[{"sha":"c9c3b615a462a4023bd148f02c564e175ed10502","url":"https://git.kernel.org/stable/c/c9c3b615a462a4023bd148f02c564e175ed10502"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c9c3b615a462a4023bd148f02c564e175ed10502","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c9c3b615a462a4023bd148f02c564e175ed10502.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72376","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72376.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72373","title":"afs: Fix missing NULL pointer check in afs_break_some_callbacks()","status":"unfixed","project":false,"upstream":[{"sha":"794a01110390c1b76f59ece773fb0fbfd89c6f5c","url":"https://git.kernel.org/stable/c/794a01110390c1b76f59ece773fb0fbfd89c6f5c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"794a01110390c1b76f59ece773fb0fbfd89c6f5c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/794a01110390c1b76f59ece773fb0fbfd89c6f5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72373","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72373.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72369","title":"minix: avoid overflow in bitmap block count calculation","status":"backported","project":false,"upstream":[{"sha":"fb3e566cafc38fe3ba35e6843a2d529a3748870c","url":"https://git.kernel.org/stable/c/fb3e566cafc38fe3ba35e6843a2d529a3748870c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a11ebaab50d27d6c4c78506f84ff36452e0b901d","label":"a11ebaab50d2","date":"2026-07-24T16:03:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb3e566cafc38fe3ba35e6843a2d529a3748870c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/fb3e566cafc38fe3ba35e6843a2d529a3748870c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72369","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72369.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72367","title":"iomap: guard io_size EOF trim against concurrent truncate underflow","status":"not-applicable","project":false,"upstream":[{"sha":"55ec50d046c03b3724741957f7b007856e36dbe7","url":"https://git.kernel.org/stable/c/55ec50d046c03b3724741957f7b007856e36dbe7"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"55ec50d046c03b3724741957f7b007856e36dbe7","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/55ec50d046c03b3724741957f7b007856e36dbe7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72367","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72367.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72365","title":"netfs: Fix writethrough to use collection offload","status":"not-applicable","project":false,"upstream":[{"sha":"ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4","url":"https://git.kernel.org/stable/c/ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72365","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72365.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72355","title":"netfs: Fix barriering when walking subrequest list","status":"not-applicable","project":false,"upstream":[{"sha":"5c6ce05e406520290c1d89da97fb3cd70c09137d","url":"https://git.kernel.org/stable/c/5c6ce05e406520290c1d89da97fb3cd70c09137d"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"5c6ce05e406520290c1d89da97fb3cd70c09137d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/5c6ce05e406520290c1d89da97fb3cd70c09137d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72345","title":"net/mlx5: LAG, Fix off-by-one in single-FDB error rollback","status":"not-applicable","project":false,"upstream":[{"sha":"0f0e4ae6975c773f7854fc48932a267f6c79088f","url":"https://git.kernel.org/stable/c/0f0e4ae6975c773f7854fc48932a267f6c79088f"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0f0e4ae6975c773f7854fc48932a267f6c79088f","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0f0e4ae6975c773f7854fc48932a267f6c79088f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72345","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72345.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72334","title":"Bluetooth: ISO: fix malformed ISO_END/CONT handling","status":"backported","project":true,"upstream":[{"sha":"e054c1a6ae7310d2815778fddb87da616e11c255","url":"https://git.kernel.org/stable/c/e054c1a6ae7310d2815778fddb87da616e11c255"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7250b6b5ba9b737cff2c2c1d0760360c7b6bca00","label":"7250b6b5ba9b","date":"2026-10-03T12:30:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e054c1a6ae7310d2815778fddb87da616e11c255","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72324","title":"gpio: mvebu: free generic chips on unbind","status":"backported","project":false,"upstream":[{"sha":"b11c513ad943f35cf5e8007d3a56279c79b7ed4b","url":"https://git.kernel.org/stable/c/b11c513ad943f35cf5e8007d3a56279c79b7ed4b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/db2b40dc12cd6ae4704f52d62c0147ef31527f60","label":"db2b40dc12cd","date":"2026-10-21T10:27:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b11c513ad943f35cf5e8007d3a56279c79b7ed4b","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b11c513ad943f35cf5e8007d3a56279c79b7ed4b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72324","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72324.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72315","title":"smb: client: fix busy dentry warning on unmount after DIO","status":"unfixed","project":false,"upstream":[{"sha":"75f5c412fa867efa0bf9b646bffe0d912109e84a","url":"https://git.kernel.org/stable/c/75f5c412fa867efa0bf9b646bffe0d912109e84a"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75f5c412fa867efa0bf9b646bffe0d912109e84a","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/75f5c412fa867efa0bf9b646bffe0d912109e84a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72203","title":"ntfs: skip extent mft records in writeback to prevent deadlock","status":"backported","project":false,"upstream":[{"sha":"76bc14c7097ff678b2b5dbfd4fa33b46897d87ce","url":"https://git.kernel.org/stable/c/76bc14c7097ff678b2b5dbfd4fa33b46897d87ce"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"76bc14c7097ff678b2b5dbfd4fa33b46897d87ce","lines":154,"reason":"","source":"https://github.com/torvalds/linux/commit/76bc14c7097ff678b2b5dbfd4fa33b46897d87ce.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72203","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72203.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72200","title":"ntfs: detect mapping-pairs LCN accumulator overflow","status":"backported","project":false,"upstream":[{"sha":"ec4f061f2219e0f0c6465d56d0380bf749235a53","url":"https://git.kernel.org/stable/c/ec4f061f2219e0f0c6465d56d0380bf749235a53"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ec4f061f2219e0f0c6465d56d0380bf749235a53","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/ec4f061f2219e0f0c6465d56d0380bf749235a53.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72200","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72200.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72198","title":"ntfs: reject non-resident records for resident-only attributes","status":"backported","project":false,"upstream":[{"sha":"097cdfd0a55df5af82c9753833f39a8bfadbcfcb","url":"https://git.kernel.org/stable/c/097cdfd0a55df5af82c9753833f39a8bfadbcfcb"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"097cdfd0a55df5af82c9753833f39a8bfadbcfcb","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/097cdfd0a55df5af82c9753833f39a8bfadbcfcb.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72198","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72198.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72073","title":"mmc: vub300: fix use-after-free on probe failure","status":"backported","project":false,"upstream":[{"sha":"a3b5f242997a3be7404112fd48784881560aea57","url":"https://git.kernel.org/stable/c/a3b5f242997a3be7404112fd48784881560aea57"}],"evidence":[{"url":"https://git.kernel.org/stable/c/face65f80c6946c631ca3490b4ebd2c016a4fd2c","label":"face65f80c69","date":"2026-10-21T10:27:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a3b5f242997a3be7404112fd48784881560aea57","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/a3b5f242997a3be7404112fd48784881560aea57.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72042","title":"ipmi: Fix user refcount underflow in event delivery","status":"unfixed","project":false,"upstream":[{"sha":"6aa9e61c46465d231e9beddf56af7effd71be682","url":"https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6aa9e61c46465d231e9beddf56af7effd71be682","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/6aa9e61c46465d231e9beddf56af7effd71be682.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72042","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72042.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72028","title":"riscv: probes: save original sp in rethook trampoline","status":"backported","project":false,"upstream":[{"sha":"bc7b086a45521a986a49045907f017e3e46c763e","url":"https://git.kernel.org/stable/c/bc7b086a45521a986a49045907f017e3e46c763e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5da5cf48a432e30ded8d58087854e5383a36eff1","label":"5da5cf48a432","date":"2026-07-24T16:03:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"bc7b086a45521a986a49045907f017e3e46c763e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72009","title":"pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI","status":"unfixed","project":false,"upstream":[{"sha":"99611233f8cda833169fa6487d5dacdf189e5cb0","url":"https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"99611233f8cda833169fa6487d5dacdf189e5cb0","lines":126,"reason":"","source":"https://github.com/torvalds/linux/commit/99611233f8cda833169fa6487d5dacdf189e5cb0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72009","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72009.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72007","title":"pmdomain: imx: Fix i.MX8MP VC8000E power up sequence","status":"backported","project":false,"upstream":[{"sha":"25e252bcf1593b420b12a7231d9dd64b885a2ae2","url":"https://git.kernel.org/stable/c/25e252bcf1593b420b12a7231d9dd64b885a2ae2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/87af3ebc112fb3f06753794390daf0f665f151b4","label":"87af3ebc112f","date":"2026-07-24T16:03:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"25e252bcf1593b420b12a7231d9dd64b885a2ae2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72007","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72007.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68480","title":"x86/bugs: Make Safe-RET robust against interrupt injection","status":"unfixed","project":false,"upstream":[{"sha":"7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9","url":"https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9"},{"sha":"52db77a13be224e09eb4ba6b4252ae8ab9085c2c","url":"https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c"},{"sha":"dfefa3c51370f84acb643cddf98bb42c885d0483","url":"https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483"}],"evidence":[],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"over-limit","patches":[{"sha":"7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9","lines":187,"reason":"","source":"https://github.com/torvalds/linux/commit/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9.patch"},{"sha":"52db77a13be224e09eb4ba6b4252ae8ab9085c2c","lines":190,"reason":"","source":"https://github.com/torvalds/linux/commit/52db77a13be224e09eb4ba6b4252ae8ab9085c2c.patch"},{"sha":"dfefa3c51370f84acb643cddf98bb42c885d0483","lines":190,"reason":"","source":"https://github.com/torvalds/linux/commit/dfefa3c51370f84acb643cddf98bb42c885d0483.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68480","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68480.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68471","title":"wifi: ieee80211: validate MLE common info length","status":"backported","project":false,"upstream":[{"sha":"293baeae9b2434a3e432629d7720b5603db2d77e","url":"https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/181b46e76a218e9345ed7c4cf59dfa69278e4a06","label":"181b46e76a21","date":"2026-10-21T10:27:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-68471","series":"6.6.y","upstream":["293baeae9b2434a3e432629d7720b5603db2d77e"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"The merged ieee80211_mle_size_ok check verifies common-info minimum length but not that it fits inside the supplied element length.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: include/linux/ieee80211.h","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/linux/ieee80211.h?id=79643295eba17affbd16ca97f3ef04c90266b28c#n4823"},{"label":"Upstream fix 293baeae9b24","url":"https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"}]},"size":{"status":"unknown","patches":[{"sha":"293baeae9b2434a3e432629d7720b5603db2d77e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68471","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68471.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68470","title":"wifi: mac80211: validate extension-frame layout before RX","status":"unfixed","project":false,"upstream":[{"sha":"57d503ce32eccfa7650065ca4c560f7e29a2e676","url":"https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"57d503ce32eccfa7650065ca4c560f7e29a2e676","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/57d503ce32eccfa7650065ca4c560f7e29a2e676.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68470","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68470.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68447","title":"drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size","status":"unfixed","project":false,"upstream":[{"sha":"426ffae6ecc7ec77d32bf8be065c21a1b881b084","url":"https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"426ffae6ecc7ec77d32bf8be065c21a1b881b084","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/426ffae6ecc7ec77d32bf8be065c21a1b881b084.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68447","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68447.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68421","title":"sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()","status":"not-applicable","project":false,"upstream":[{"sha":"b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da","url":"https://git.kernel.org/stable/c/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68421","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68421.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68412","title":"wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()","status":"unfixed","project":false,"upstream":[{"sha":"c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6","url":"https://git.kernel.org/stable/c/c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68412","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68412.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68391","title":"Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds","status":"backported","project":false,"upstream":[{"sha":"da55f570191d5d72f10c607a7043b947eb05ea46","url":"https://git.kernel.org/stable/c/da55f570191d5d72f10c607a7043b947eb05ea46"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b56f2ecafc08f372bf0529f9c4f3f429cb1702dc","label":"b56f2ecafc08","date":"2026-08-03T11:15:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"da55f570191d5d72f10c607a7043b947eb05ea46","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68391","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68391.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68382","title":"drm/xe/guc: Hold device ref until queue teardown completes","status":"not-applicable","project":false,"upstream":[{"sha":"9b7e60184f4b22e893d4ae95234d5f26261a430c","url":"https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"9b7e60184f4b22e893d4ae95234d5f26261a430c","lines":263,"reason":"","source":"https://github.com/torvalds/linux/commit/9b7e60184f4b22e893d4ae95234d5f26261a430c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68382","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68382.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68337","title":"bpf: Reject redirect helpers without a bpf_net_context","status":"unfixed","project":false,"upstream":[{"sha":"3f4920d165b29052255527d8ae7619e7ec132ece","url":"https://git.kernel.org/stable/c/3f4920d165b29052255527d8ae7619e7ec132ece"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f4920d165b29052255527d8ae7619e7ec132ece","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/3f4920d165b29052255527d8ae7619e7ec132ece.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68303","title":"drm/vc4: hvs/v3d: Fix null dereference in unbind","status":"backported","project":true,"upstream":[{"sha":"7dc3680b7ffe01add3e9299fde8471d2dd53a8ae","url":"https://git.kernel.org/stable/c/7dc3680b7ffe01add3e9299fde8471d2dd53a8ae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3be8dcc1a5854cf24cc332e0d6fc865c47ff49a1","label":"3be8dcc1a585","date":"2026-10-21T10:27:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7dc3680b7ffe01add3e9299fde8471d2dd53a8ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68303","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68303.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68290","title":"rds: tcp: unregister sysctl before tearing down listen socket","status":"unfixed","project":false,"upstream":[{"sha":"167e54c703ccd4fa028feb568b0d1002020cff86","url":"https://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"167e54c703ccd4fa028feb568b0d1002020cff86","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/167e54c703ccd4fa028feb568b0d1002020cff86.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68290","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68290.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68289","title":"tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()","status":"backported","project":true,"upstream":[{"sha":"47f42ff521b4eeb46e82f9a46a4783a99f7570d7","url":"https://git.kernel.org/stable/c/47f42ff521b4eeb46e82f9a46a4783a99f7570d7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/93580911f02d1f4a506ec0a6fc4354140c53ffe8","label":"93580911f02d","date":"2026-10-03T12:30:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"47f42ff521b4eeb46e82f9a46a4783a99f7570d7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68288","title":"net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD","status":"backported","project":true,"upstream":[{"sha":"5e9c8baee0329fbefe7c67aea945e2a07f15e98b","url":"https://git.kernel.org/stable/c/5e9c8baee0329fbefe7c67aea945e2a07f15e98b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3c0bc7dcc5f9257d25c59eeb7ccb4df33dcfc446","label":"3c0bc7dcc5f9","date":"2026-10-03T12:30:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5e9c8baee0329fbefe7c67aea945e2a07f15e98b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68287","title":"drop_monitor: fix size calculations for 64-bit attributes","status":"backported","project":true,"upstream":[{"sha":"7089f7ab99c89f443c92d8fcc585e63f2727f0b3","url":"https://git.kernel.org/stable/c/7089f7ab99c89f443c92d8fcc585e63f2727f0b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0da8f531336b28a59b23e5a67d40eaed15906201","label":"0da8f531336b","date":"2026-10-03T12:30:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7089f7ab99c89f443c92d8fcc585e63f2727f0b3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68287","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68287.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68286","title":"drop_monitor: perform u64_stats updates under IRQ-disabled section","status":"backported","project":true,"upstream":[{"sha":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","url":"https://git.kernel.org/stable/c/fd098a23bf8fda7eae48db9b06e7c34fc4d228fa"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3454c729ee8aa682ec871f1b174b047f731933ae","label":"3454c729ee8a","date":"2026-10-03T12:30:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68286","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68286.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68245","title":"drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()","status":"unfixed","project":false,"upstream":[{"sha":"04cc4aa3617b0ed67e859f91f09de5d896a46f3a","url":"https://git.kernel.org/stable/c/04cc4aa3617b0ed67e859f91f09de5d896a46f3a"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"04cc4aa3617b0ed67e859f91f09de5d896a46f3a","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/04cc4aa3617b0ed67e859f91f09de5d896a46f3a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68245","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68245.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68205","title":"media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()","status":"backported","project":false,"upstream":[{"sha":"06cb687a5132fcffe624c0070576ab852ac6b568","url":"https://git.kernel.org/stable/c/06cb687a5132fcffe624c0070576ab852ac6b568"}],"evidence":[{"url":"https://git.kernel.org/stable/c/47ef04cd13d38010b580056a9d8840aaab944841","label":"47ef04cd13d3","date":"2026-08-09T20:22:03+02:00","lore":["https://lore.kernel.org/linux-media/20240315073125.275501-2-sakari.ailus@linux.intel.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"06cb687a5132fcffe624c0070576ab852ac6b568","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/06cb687a5132fcffe624c0070576ab852ac6b568.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68205","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68205.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68161","title":"sctp: close UDP tunnel sockets during netns teardown","status":"backported","project":false,"upstream":[{"sha":"ffb2bd7ade36ec4da32c46a6eddbf4515316d08c","url":"https://git.kernel.org/stable/c/ffb2bd7ade36ec4da32c46a6eddbf4515316d08c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c6eb2d615210b80339548ab07c0230edaab9a6c7","label":"c6eb2d615210","date":"2026-08-09T20:22:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ffb2bd7ade36ec4da32c46a6eddbf4515316d08c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68152","title":"amt: fix use-after-free in AMT delayed works","status":"unfixed","project":false,"upstream":[{"sha":"ea20c44935d6142daecfa9b39d635033a7553e1b","url":"https://git.kernel.org/stable/c/ea20c44935d6142daecfa9b39d635033a7553e1b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ea20c44935d6142daecfa9b39d635033a7553e1b","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/ea20c44935d6142daecfa9b39d635033a7553e1b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68152","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68152.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68112","title":"drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()","status":"backported","project":false,"upstream":[{"sha":"00f4050f7c367d7bdce347ca279ce467c434cf15","url":"https://git.kernel.org/stable/c/00f4050f7c367d7bdce347ca279ce467c434cf15"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c59b57c2e0c8cced4350ff7792361ba2a79ee85c","label":"c59b57c2e0c8","date":"2026-08-03T11:15:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00f4050f7c367d7bdce347ca279ce467c434cf15","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/00f4050f7c367d7bdce347ca279ce467c434cf15.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68112","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68112.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68103","title":"drm/amdgpu: reject mapping a reserved doorbell to a new queue","status":"not-applicable","project":false,"upstream":[{"sha":"a609b6278bf3cde17eeee6620091465521e4b02c","url":"https://git.kernel.org/stable/c/a609b6278bf3cde17eeee6620091465521e4b02c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"a609b6278bf3cde17eeee6620091465521e4b02c","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a609b6278bf3cde17eeee6620091465521e4b02c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68097","title":"ksmbd: validate ACE size against SID sub-authorities","status":"backported","project":false,"upstream":[{"sha":"5152c6d49e3fd4e9f2e857c57527aead752f1f87","url":"https://git.kernel.org/stable/c/5152c6d49e3fd4e9f2e857c57527aead752f1f87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b7cb5bf0855470799f12da825de91e48951b3876","label":"b7cb5bf08554","date":"2026-08-03T11:15:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5152c6d49e3fd4e9f2e857c57527aead752f1f87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68086","title":"mm/khugepaged: write all dirty file folios when collapsing","status":"unfixed","project":false,"upstream":[{"sha":"2dfe9f5c91d0963058f8a5e46e1c2a908382cc46","url":"https://git.kernel.org/stable/c/2dfe9f5c91d0963058f8a5e46e1c2a908382cc46"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2dfe9f5c91d0963058f8a5e46e1c2a908382cc46","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/2dfe9f5c91d0963058f8a5e46e1c2a908382cc46.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68086","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68086.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68085","title":"Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled","status":"unfixed","project":false,"upstream":[{"sha":"1b0d946d6f08bd39211385bc703a440911b41e46","url":"https://git.kernel.org/stable/c/1b0d946d6f08bd39211385bc703a440911b41e46"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1b0d946d6f08bd39211385bc703a440911b41e46","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/1b0d946d6f08bd39211385bc703a440911b41e46.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64525","title":"xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit","status":"unfixed","project":false,"upstream":[{"sha":"3e52417318473782012b236d0325bf7d2266a597","url":"https://git.kernel.org/stable/c/3e52417318473782012b236d0325bf7d2266a597"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3e52417318473782012b236d0325bf7d2266a597","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/3e52417318473782012b236d0325bf7d2266a597.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64525","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64525.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64520","title":"firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies","status":"not-applicable","project":false,"upstream":[{"sha":"3974ea1938406f9bfa7c1f48d4e43533f447bb08","url":"https://git.kernel.org/stable/c/3974ea1938406f9bfa7c1f48d4e43533f447bb08"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"3974ea1938406f9bfa7c1f48d4e43533f447bb08","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/3974ea1938406f9bfa7c1f48d4e43533f447bb08.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64520","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64520.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64513","title":"KVM: x86: Unconditionally recompute CR8 intercept on PPR update","status":"unfixed","project":false,"upstream":[{"sha":"bb365a506b1e6fb050c0fceaad354fe395385ef0","url":"https://git.kernel.org/stable/c/bb365a506b1e6fb050c0fceaad354fe395385ef0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"bb365a506b1e6fb050c0fceaad354fe395385ef0","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/bb365a506b1e6fb050c0fceaad354fe395385ef0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64513","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64513.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64481","title":"ALSA: hda/cs35l41: Fix firmware load work teardown","status":"backported","project":false,"upstream":[{"sha":"b65020d5398f499c09498c9786dba6d67ae57664","url":"https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3e339c88b8c3044919fd1936a8b23124285d0de6","label":"3e339c88b8c3","date":"2026-10-21T10:27:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-64481","series":"6.6.y","upstream":["b65020d5398f499c09498c9786dba6d67ae57664"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"unbind/remove do not unconditionally drain fw_load_work and remove controls","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: sound/pci/hda/cs35l41_hda.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/sound/pci/hda/cs35l41_hda.c?id=79643295eba17affbd16ca97f3ef04c90266b28c"},{"label":"Upstream fix b65020d5398f","url":"https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664"}]},"size":{"status":"unknown","patches":[{"sha":"b65020d5398f499c09498c9786dba6d67ae57664","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64481","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64481.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64424","title":"netpoll: fix a use-after-free on shutdown path","status":"unfixed","project":false,"upstream":[{"sha":"45f1458a85017a023f138b22ac5c76abd477db42","url":"https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"45f1458a85017a023f138b22ac5c76abd477db42","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/45f1458a85017a023f138b22ac5c76abd477db42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64305","title":"crypto: qat - protect service table iterations with service_lock","status":"backported","project":false,"upstream":[{"sha":"5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e","url":"https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/11d48f777cf8fad00db044f4c15cdf821427746b","label":"11d48f777cf8","date":"2026-10-21T10:27:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64305","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64305.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64255","title":"wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers","status":"not-applicable","project":false,"upstream":[{"sha":"f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","url":"https://git.kernel.org/stable/c/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2"}],"evidence":[],"submission_lore":[],"basis":"The iwlwifi MLD aggregation/BA-session handlers changed upstream are absent from these targets.","review":{"id":"CVE-2026-64255","series":"6.6.y","upstream":["f056fc2b927448d37eca6b6cacc3d1b0f67b20d2"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The iwlwifi MLD aggregation/BA-session handlers changed upstream are absent from these targets.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/net/wireless/intel/iwlwifi/mld/agg.c absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi?id=79643295eba17affbd16ca97f3ef04c90266b28c"},{"label":"Upstream fix f056fc2b9274","url":"https://git.kernel.org/stable/c/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2"}]},"size":{"status":"within-limit","patches":[{"sha":"f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64255","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64255.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64241","title":"gpio: rockchip: teardown bugs and resource leaks","status":"backported","project":true,"upstream":[{"sha":"9500077678230e36d22bf16d2b9539c13e59a801","url":"https://git.kernel.org/stable/c/9500077678230e36d22bf16d2b9539c13e59a801"}],"evidence":[{"url":"https://git.kernel.org/stable/c/77b6ff33c8f5642f7e7c1ca691857218683264fd","label":"77b6ff33c8f5","date":"2026-10-21T10:27:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9500077678230e36d22bf16d2b9539c13e59a801","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/9500077678230e36d22bf16d2b9539c13e59a801.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64241","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64241.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64212","title":"wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it","status":"not-applicable","project":false,"upstream":[{"sha":"d733ed481fd20a8e7bfe5119c4e77761ba3f87ee","url":"https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee"}],"evidence":[],"submission_lore":[],"basis":"The iwlwifi MLD remove-link implementation changed upstream is absent from this target; no corresponding remove-link path exists.","review":{"id":"CVE-2026-64212","series":"6.6.y","upstream":["d733ed481fd20a8e7bfe5119c4e77761ba3f87ee"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The iwlwifi MLD remove-link implementation changed upstream is absent from this target; no corresponding remove-link path exists.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/net/wireless/intel/iwlwifi/mld/link.c absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi?id=79643295eba17affbd16ca97f3ef04c90266b28c"},{"label":"Upstream fix d733ed481fd2","url":"https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee"}]},"size":{"status":"within-limit","patches":[{"sha":"d733ed481fd20a8e7bfe5119c4e77761ba3f87ee","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64212","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64212.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64190","title":"net: team: fix NULL pointer dereference in team_xmit during mode change","status":"backported","project":false,"upstream":[{"sha":"25fe708bbc59289d3d1ea4b126fbc1b460a072a5","url":"https://git.kernel.org/stable/c/25fe708bbc59289d3d1ea4b126fbc1b460a072a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9486377e5e971988a3add171c398eb654a866fab","label":"9486377e5e97","date":"2026-10-21T10:27:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"25fe708bbc59289d3d1ea4b126fbc1b460a072a5","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64190","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64190.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64163","title":"test_kprobes: clear kprobes between test runs","status":"backported","project":false,"upstream":[{"sha":"ef5581bb30efb939cc2bf093475c6cc85258e5cd","url":"https://git.kernel.org/stable/c/ef5581bb30efb939cc2bf093475c6cc85258e5cd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/08d355936fcf70c81c94f9fe7310450b65c53399","label":"08d355936fcf","date":"2026-06-01T17:43:11+02:00","lore":["https://lore.kernel.org/all/20260507134615.1010905-1-martin@kaiser.cx/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ef5581bb30efb939cc2bf093475c6cc85258e5cd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64163","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64163.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64160","title":"netfs: Fix potential for tearing in ->remote_i_size and ->zero_point","status":"unfixed","project":false,"upstream":[{"sha":"2c8f4742bb76117d735f92a3932d85239b16c494","url":"https://git.kernel.org/stable/c/2c8f4742bb76117d735f92a3932d85239b16c494"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2c8f4742bb76117d735f92a3932d85239b16c494","lines":953,"reason":"","source":"https://github.com/torvalds/linux/commit/2c8f4742bb76117d735f92a3932d85239b16c494.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64160","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64160.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64112","title":"rbd: eliminate a race in lock_dwork draining on unmap","status":"unfixed","project":false,"upstream":[{"sha":"9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90","url":"https://git.kernel.org/stable/c/9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64112","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64112.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64109","title":"af_unix: Fix UAF read of tail->len in unix_stream_data_wait()","status":"backported","project":false,"upstream":[{"sha":"be309f8eae8b474a4a617eaae01324da996fc719","url":"https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719"}],"evidence":[{"url":"https://git.kernel.org/stable/c/26342087fac93b3932e6af61dc91ec029cb8a623","label":"26342087fac9","date":"2026-06-19T13:39:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"be309f8eae8b474a4a617eaae01324da996fc719","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/be309f8eae8b474a4a617eaae01324da996fc719.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64109","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64109.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64082","title":"riscv: Fix register corruption from uninitialized cregs on error","status":"backported","project":false,"upstream":[{"sha":"6ebcbb53fc9bc30843054ed99fd60b8e542628f4","url":"https://git.kernel.org/stable/c/6ebcbb53fc9bc30843054ed99fd60b8e542628f4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/66dedb6028c3df6c6a3372dd935b823917e150d5","label":"66dedb6028c3","date":"2026-09-02T14:29:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6ebcbb53fc9bc30843054ed99fd60b8e542628f4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64082","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64082.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64079","title":"netfilter: x_tables: allocate hook ops while under mutex","status":"backported","project":false,"upstream":[{"sha":"b62eb8dcf2c47d4d676a434efbd57c4f776f7829","url":"https://git.kernel.org/stable/c/b62eb8dcf2c47d4d676a434efbd57c4f776f7829"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5ea15e78232253e657d352e625fb4913e2f57e63","label":"5ea15e782322","date":"2026-10-21T10:27:54+02:00","lore":["https://lore.kernel.org/netfilter-devel/20260429175613.1459342-1-tristmd@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"b62eb8dcf2c47d4d676a434efbd57c4f776f7829","lines":271,"reason":"","source":"https://github.com/torvalds/linux/commit/b62eb8dcf2c47d4d676a434efbd57c4f776f7829.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64078","title":"netfilter: x_tables: add and use xtables_unregister_table_exit","status":"unfixed","project":false,"upstream":[{"sha":"b4597d5fd7d2f8cebfffd40dffb5e003cc78964c","url":"https://git.kernel.org/stable/c/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"b4597d5fd7d2f8cebfffd40dffb5e003cc78964c","lines":246,"reason":"","source":"https://github.com/torvalds/linux/commit/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64078","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64078.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64070","title":"powerpc/hv-gpci: fix preempt count leak in sysfs show paths","status":"backported","project":true,"upstream":[{"sha":"dbc30a57bd8e026995e9fa8e8c31cffd18542c01","url":"https://git.kernel.org/stable/c/dbc30a57bd8e026995e9fa8e8c31cffd18542c01"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b300312562fd6e4729697adb9f777f00ca0429f3","label":"b300312562fd","date":"2026-09-02T14:29:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"dbc30a57bd8e026995e9fa8e8c31cffd18542c01","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64070","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64070.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64068","title":"netfs: Fix missing locking around retry adding new subreqs","status":"not-applicable","project":false,"upstream":[{"sha":"cce18c263e9623872327ba3c956012f73c1179cc","url":"https://git.kernel.org/stable/c/cce18c263e9623872327ba3c956012f73c1179cc"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"cce18c263e9623872327ba3c956012f73c1179cc","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64068","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64068.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64067","title":"netfs: Fix missing barriers when accessing stream->subrequests locklessly","status":"not-applicable","project":false,"upstream":[{"sha":"b5782e2d462c028096f922abca46318cec890670","url":"https://git.kernel.org/stable/c/b5782e2d462c028096f922abca46318cec890670"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5782e2d462c028096f922abca46318cec890670","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/b5782e2d462c028096f922abca46318cec890670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64067","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64067.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64066","title":"netfs: Fix netfs_read_to_pagecache() to pause on subreq failure","status":"not-applicable","project":false,"upstream":[{"sha":"8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4","url":"https://git.kernel.org/stable/c/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64066","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64066.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64060","title":"netfs: Fix leak of request in netfs_write_begin() error handling","status":"unfixed","project":false,"upstream":[{"sha":"5046a34f0643441f05b0253ea64e1a3af87efe14","url":"https://git.kernel.org/stable/c/5046a34f0643441f05b0253ea64e1a3af87efe14"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5046a34f0643441f05b0253ea64e1a3af87efe14","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/5046a34f0643441f05b0253ea64e1a3af87efe14.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64060","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64060.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64026","title":"rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg","status":"backported","project":false,"upstream":[{"sha":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","url":"https://git.kernel.org/stable/c/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a05bf6d9e621fa71e89ccebe3047ba45218d7b38","label":"a05bf6d9e621","date":"2026-06-19T13:39:39+02:00","lore":["https://lore.kernel.org/r/afKV2zGR6rrelPC7@v4bel/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","lines":534,"reason":"","source":"https://github.com/torvalds/linux/commit/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64017","title":"blk-mq: pop cached request if it is usable","status":"queued","project":true,"upstream":[{"sha":"dc278e9bf2b9513a763353e6b9cc21e0f532954e","url":"https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.6/blk-mq-pop-cached-request-if-it-is-usable.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"unknown","patches":[{"sha":"dc278e9bf2b9513a763353e6b9cc21e0f532954e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64001","title":"ALSA: pcm: oss: Fix setup list UAF on proc write error","status":"backported","project":true,"upstream":[{"sha":"4cc54bdd54b337e77115be5b55577d1c58608eae","url":"https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d9df965284abde27ba6bfbdfc8407697cf6802f1","label":"d9df965284ab","date":"2026-10-21T10:27:20+02:00","lore":["https://lore.kernel.org/all/6a1062b7.170a0220.35b2b7.0003.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4cc54bdd54b337e77115be5b55577d1c58608eae","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/4cc54bdd54b337e77115be5b55577d1c58608eae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64001","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64001.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63999","title":"ethtool: rss: fix indir_table and hkey leak on get_rxfh failure","status":"backported","project":false,"upstream":[{"sha":"266297692f97008ca48bc311775c087c59bd7fe3","url":"https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/14dbf22c397b799b3a80f63fc90c2fc0585bbeb3","label":"14dbf22c397b","date":"2026-10-21T10:27:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"266297692f97008ca48bc311775c087c59bd7fe3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/266297692f97008ca48bc311775c087c59bd7fe3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63983","title":"net/sched: fix packet loop on netem when duplicate is on","status":"unfixed","project":false,"upstream":[{"sha":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","url":"https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/9552b11e3edabc97cfcd9f29103d5afbce7ae183.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63983","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63983.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63977","title":"dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work","status":"not-applicable","project":false,"upstream":[{"sha":"d733f519f6443540f8359461a34e3b0042099bbe","url":"https://git.kernel.org/stable/c/d733f519f6443540f8359461a34e3b0042099bbe"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"d733f519f6443540f8359461a34e3b0042099bbe","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/d733f519f6443540f8359461a34e3b0042099bbe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63977","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63977.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63959","title":"usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT","status":"backported","project":false,"upstream":[{"sha":"aa2f716327be1818e1cb156da8a2844804aaec2f","url":"https://git.kernel.org/stable/c/aa2f716327be1818e1cb156da8a2844804aaec2f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0af00f1459f5dd757f0d392f8caa38039561ac62","label":"0af00f1459f5","date":"2026-06-19T13:39:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"aa2f716327be1818e1cb156da8a2844804aaec2f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63959","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63959.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63941","title":"KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor","status":"not-applicable","project":false,"upstream":[{"sha":"83726330748981372bde86ed5411d7b306612991","url":"https://git.kernel.org/stable/c/83726330748981372bde86ed5411d7b306612991"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"83726330748981372bde86ed5411d7b306612991","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/83726330748981372bde86ed5411d7b306612991.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63941","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63941.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63871","title":"Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls","status":"unfixed","project":false,"upstream":[{"sha":"9ca7053d6215d89c33f28893bfd1625a32919d3f","url":"https://git.kernel.org/stable/c/9ca7053d6215d89c33f28893bfd1625a32919d3f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"9ca7053d6215d89c33f28893bfd1625a32919d3f","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/9ca7053d6215d89c33f28893bfd1625a32919d3f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63871","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63871.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63858","title":"netfilter: nf_tables: add hook transactions for device deletions","status":"unfixed","project":false,"upstream":[{"sha":"10f79dbd7719d1da9f5884d13060322d8729f091","url":"https://git.kernel.org/stable/c/10f79dbd7719d1da9f5884d13060322d8729f091"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"10f79dbd7719d1da9f5884d13060322d8729f091","lines":525,"reason":"","source":"https://github.com/torvalds/linux/commit/10f79dbd7719d1da9f5884d13060322d8729f091.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63858","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63858.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63839","title":"platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()","status":"not-applicable","project":false,"upstream":[{"sha":"0c3887a134f191723b53e2a47e501b534c8723ee","url":"https://git.kernel.org/stable/c/0c3887a134f191723b53e2a47e501b534c8723ee"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"0c3887a134f191723b53e2a47e501b534c8723ee","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63839","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63839.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63819","title":"f2fs: fix to do sanity check on f2fs_get_node_folio_ra()","status":"unfixed","project":false,"upstream":[{"sha":"8712353ed80f87271d732297567dcdbe4b84e8c7","url":"https://git.kernel.org/stable/c/8712353ed80f87271d732297567dcdbe4b84e8c7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8712353ed80f87271d732297567dcdbe4b84e8c7","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8712353ed80f87271d732297567dcdbe4b84e8c7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63819","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63819.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63816","title":"f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode","status":"backported","project":false,"upstream":[{"sha":"e0288584baa5dc41df4a829a023c4c1b33fe53d7","url":"https://git.kernel.org/stable/c/e0288584baa5dc41df4a829a023c4c1b33fe53d7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7d3ae21783e5914c1761ac7d63f882d3d70800e9","label":"7d3ae21783e5","date":"2026-07-24T16:02:36+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"e0288584baa5dc41df4a829a023c4c1b33fe53d7","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/e0288584baa5dc41df4a829a023c4c1b33fe53d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63816","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63816.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63805","title":"crypto: nx - fix nx_crypto_ctx_exit argument","status":"unfixed","project":false,"upstream":[{"sha":"4e67f504ee9ded15e256b64f4fde150e917381d7","url":"https://git.kernel.org/stable/c/4e67f504ee9ded15e256b64f4fde150e917381d7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4e67f504ee9ded15e256b64f4fde150e917381d7","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/4e67f504ee9ded15e256b64f4fde150e917381d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63805","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63805.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53368","title":"f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage","status":"unfixed","project":false,"upstream":[{"sha":"019f9dda7f66e55eb94cd32e1d3fff5835f73fbc","url":"https://git.kernel.org/stable/c/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"019f9dda7f66e55eb94cd32e1d3fff5835f73fbc","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53368","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53368.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53313","title":"drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths","status":"backported","project":false,"upstream":[{"sha":"4ae3e16f4b3bf64140f773629b765d605ee079a9","url":"https://git.kernel.org/stable/c/4ae3e16f4b3bf64140f773629b765d605ee079a9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1cad9afbb2d559b738b83c498f9c1abdfd327e7f","label":"1cad9afbb2d5","date":"2026-10-21T10:27:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"4ae3e16f4b3bf64140f773629b765d605ee079a9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53285","title":"drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED","status":"unfixed","project":false,"upstream":[{"sha":"183182235f6d53bac62c6c39014738a54a68dfa6","url":"https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6"}],"evidence":[],"submission_lore":[],"basis":"dcn32_enable_phantom_plane() allocates a phantom plane through dc_create_plane_state() without re-enabling preemption; the helper is reached from phantom-pipe addition in DML validation and retains the allocation-in-FP/softirq-disabled failure fixed upstream.","review":{"id":"CVE-2026-53285","series":"6.6.y","upstream":["183182235f6d53bac62c6c39014738a54a68dfa6"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"dcn32_enable_phantom_plane() allocates a phantom plane through dc_create_plane_state() without re-enabling preemption; the helper is reached from phantom-pipe addition in DML validation and retains the allocation-in-FP/softirq-disabled failure fixed upstream.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n1633"},{"label":"Upstream fix 183182235f6d","url":"https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6"}]},"size":{"status":"within-limit","patches":[{"sha":"183182235f6d53bac62c6c39014738a54a68dfa6","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/183182235f6d53bac62c6c39014738a54a68dfa6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53285","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53285.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53246","title":"sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing","status":"unfixed","project":false,"upstream":[{"sha":"0861615c28de668669d748ef4eb913ea9262d13b","url":"https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0861615c28de668669d748ef4eb913ea9262d13b","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/0861615c28de668669d748ef4eb913ea9262d13b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53246","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53246.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53226","title":"gpio: rockchip: fix generic IRQ chip leak on remove","status":"backported","project":true,"upstream":[{"sha":"1c1e0fc88d6ef65bf15d517853251f75ab9d18c3","url":"https://git.kernel.org/stable/c/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6198123cac2ffd9d9a9d252dfa84ab81fb487ba3","label":"6198123cac2f","date":"2026-10-21T10:27:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c1e0fc88d6ef65bf15d517853251f75ab9d18c3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53226","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53226.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53185","title":"zram: fix use-after-free in zram_bvec_write_partial()","status":"backported","project":false,"upstream":[{"sha":"732fd9f0b9c1cdc6dfd77162ded60df005182cc0","url":"https://git.kernel.org/stable/c/732fd9f0b9c1cdc6dfd77162ded60df005182cc0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0c2821665ff71be3f4b07ecece384669f2877f6a","label":"0c2821665ff7","date":"2026-06-19T13:39:33+02:00","lore":["https://lore.kernel.org/20260528-zram-v3-1-cab86eef8764@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"732fd9f0b9c1cdc6dfd77162ded60df005182cc0","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/732fd9f0b9c1cdc6dfd77162ded60df005182cc0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53185","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53185.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53179","title":"staging: rtl8723bs: fix buffer over-read in rtw_update_protection","status":"backported","project":false,"upstream":[{"sha":"514ab98364595007d4557ecc85d7e5f012c504d3","url":"https://git.kernel.org/stable/c/514ab98364595007d4557ecc85d7e5f012c504d3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d95edbbf7830d77ad68d437c384055eac8cd9892","label":"d95edbbf7830","date":"2026-10-21T10:27:51+02:00","lore":["https://lore.kernel.org/linux-staging/DI2H39EAAFBZ.3KI5NWN02AQ2S@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"514ab98364595007d4557ecc85d7e5f012c504d3","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/514ab98364595007d4557ecc85d7e5f012c504d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53179","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53179.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53178","title":"staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction","status":"backported","project":false,"upstream":[{"sha":"88e994c57a79f62d5338231d8d37ee8dd98baffe","url":"https://git.kernel.org/stable/c/88e994c57a79f62d5338231d8d37ee8dd98baffe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/18143799ad51a32b1351e4e1591b6285a0a9d7dd","label":"18143799ad51","date":"2026-10-21T10:27:51+02:00","lore":["https://lore.kernel.org/linux-staging/DI2H39EAAFBZ.3KI5NWN02AQ2S@linux.dev/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"88e994c57a79f62d5338231d8d37ee8dd98baffe","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/88e994c57a79f62d5338231d8d37ee8dd98baffe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53178","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53178.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53156","title":"nvmem: core: fix use-after-free bugs in error paths","status":"backported","project":false,"upstream":[{"sha":"5b6b6fc491899d583eaa75344e094796ae9b530b","url":"https://git.kernel.org/stable/c/5b6b6fc491899d583eaa75344e094796ae9b530b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6cdcf0d16c80900f42d60252480cd131c1a83d23","label":"6cdcf0d16c80","date":"2026-10-21T10:27:51+02:00","lore":[]}],"submission_lore":[],"basis":"Upstream reorders nvmem layout-module release ahead of the final device put to avoid using nvmem after it may be freed. Do not backport: 6.1.y lacks the relevant layout ownership, and 6.6.y lacks nvmem_layout_module_get_optional()/nvmem_layout_module_put() and the vulnerable per-cell get/put scheme. Applying fragments would be an effective no-op or invent a foreign lifetime model; neither target can reach the upstream use-after-free sequence.","review":{"id":"CVE-2026-53156","series":"6.6.y","upstream":["5b6b6fc491899d583eaa75344e094796ae9b530b"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"Upstream reorders nvmem layout-module release ahead of the final device put to avoid using nvmem after it may be freed. Do not backport: 6.1.y lacks the relevant layout ownership, and 6.6.y lacks nvmem_layout_module_get_optional()/nvmem_layout_module_put() and the vulnerable per-cell get/put scheme. Applying fragments would be an effective no-op or invent a foreign lifetime model; neither target can reach the upstream use-after-free sequence.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"5b6b6fc491899d583eaa75344e094796ae9b530b","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/5b6b6fc491899d583eaa75344e094796ae9b530b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53156","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53156.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53143","title":"drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11","status":"backported","project":false,"upstream":[{"sha":"352ea59028ea48a6fff77f19ae28f98f71946a80","url":"https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80"}],"evidence":[{"url":"https://git.kernel.org/stable/c/16dad1fb0d783a4008de30e32d0038c393de05b1","label":"16dad1fb0d78","date":"2026-06-19T13:39:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"352ea59028ea48a6fff77f19ae28f98f71946a80","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/352ea59028ea48a6fff77f19ae28f98f71946a80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53143","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53143.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53132","title":"vsock/virtio: fix potential unbounded skb queue","status":"unfixed","project":false,"upstream":[{"sha":"059b7dbd20a6f0c539a45ddff1573cb8946685b5","url":"https://git.kernel.org/stable/c/059b7dbd20a6f0c539a45ddff1573cb8946685b5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"059b7dbd20a6f0c539a45ddff1573cb8946685b5","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/059b7dbd20a6f0c539a45ddff1573cb8946685b5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53132","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53132.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53123","title":"md: wake raid456 reshape waiters before suspend","status":"unfixed","project":false,"upstream":[{"sha":"cf86bb53b9c92354904a328e947a05ffbfdd1840","url":"https://git.kernel.org/stable/c/cf86bb53b9c92354904a328e947a05ffbfdd1840"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf86bb53b9c92354904a328e947a05ffbfdd1840","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/cf86bb53b9c92354904a328e947a05ffbfdd1840.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53120","title":"PCI: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"10a4206a24013be4d558d476010cbf2eb4c9fa64","url":"https://git.kernel.org/stable/c/10a4206a24013be4d558d476010cbf2eb4c9fa64"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fdfa287956d00b936e0ac409b21e4f90501ad109","label":"fdfa287956d0","date":"2026-10-21T10:27:50+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"10a4206a24013be4d558d476010cbf2eb4c9fa64","lines":131,"reason":"","source":"https://github.com/torvalds/linux/commit/10a4206a24013be4d558d476010cbf2eb4c9fa64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53120","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53120.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53118","title":"vdpa: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"85bb534ff12aab6916058897b39c748940a7a4c6","url":"https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4005cb89139f7c9af85046b241dcf3fa2e1b3559","label":"4005cb89139f","date":"2026-10-21T10:27:50+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"85bb534ff12aab6916058897b39c748940a7a4c6","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/85bb534ff12aab6916058897b39c748940a7a4c6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53117","title":"s390/cio: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4","url":"https://git.kernel.org/stable/c/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c4295487124f461405e1ef64dfa8c4ab0cb7ebcf","label":"c4295487124f","date":"2026-05-23T13:03:05+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53117","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53117.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53115","title":"bus: fsl-mc: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"6c8dfb0362732bf1e4829867a2a5239fedc592d0","url":"https://git.kernel.org/stable/c/6c8dfb0362732bf1e4829867a2a5239fedc592d0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dbba371b19129abe9649553ab912e6bccf6c1a5b","label":"dbba371b1912","date":"2026-10-21T10:27:50+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6c8dfb0362732bf1e4829867a2a5239fedc592d0","lines":99,"reason":"","source":"https://github.com/torvalds/linux/commit/6c8dfb0362732bf1e4829867a2a5239fedc592d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53113","title":"wifi: ath11k: fix memory leaks in beacon template setup","status":"backported","project":false,"upstream":[{"sha":"ff49eba595df500e4ddccc593088c8a4ab5f2c27","url":"https://git.kernel.org/stable/c/ff49eba595df500e4ddccc593088c8a4ab5f2c27"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7bedc489611f01634cec20f88f961a1f08e8d935","label":"7bedc489611f","date":"2026-10-21T10:27:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ff49eba595df500e4ddccc593088c8a4ab5f2c27","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53113","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53113.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53107","title":"wifi: libertas: don't kill URBs in interrupt context","status":"unfixed","project":false,"upstream":[{"sha":"7c5c2b661bdb78c1472b8833265c9ed1ee880039","url":"https://git.kernel.org/stable/c/7c5c2b661bdb78c1472b8833265c9ed1ee880039"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c5c2b661bdb78c1472b8833265c9ed1ee880039","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/7c5c2b661bdb78c1472b8833265c9ed1ee880039.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53107","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53107.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53106","title":"bpf: Do not allow deleting local storage in NMI","status":"unfixed","project":false,"upstream":[{"sha":"350de5b8a9befaa2a68861c51f671d4f5f751ca5","url":"https://git.kernel.org/stable/c/350de5b8a9befaa2a68861c51f671d4f5f751ca5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"350de5b8a9befaa2a68861c51f671d4f5f751ca5","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/350de5b8a9befaa2a68861c51f671d4f5f751ca5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53106","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53106.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53102","title":"wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()","status":"backported","project":false,"upstream":[{"sha":"c41075ce8cf05ed8c0e7b7efef000dce548ffc42","url":"https://git.kernel.org/stable/c/c41075ce8cf05ed8c0e7b7efef000dce548ffc42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a2af91af9536922edc3f63de90c3f1fe9db71717","label":"a2af91af9536","date":"2026-10-21T10:27:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"c41075ce8cf05ed8c0e7b7efef000dce548ffc42","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53091","title":"net: pull headers in qdisc_pkt_len_segs_init()","status":"backported","project":false,"upstream":[{"sha":"7fb4c19670110f052c04e1ec1d2b953b9f4f57e4","url":"https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5895cfc76924a629c6eaa5e5f049de642860045f","label":"5895cfc76924","date":"2026-10-21T10:27:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"7fb4c19670110f052c04e1ec1d2b953b9f4f57e4","lines":118,"reason":"","source":"https://github.com/torvalds/linux/commit/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53091","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53091.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53089","title":"bpf: Fix use-after-free in offloaded map/prog info fill","status":"backported","project":false,"upstream":[{"sha":"a0c584fc18056709c8e047a82a6045d6c209f4ce","url":"https://git.kernel.org/stable/c/a0c584fc18056709c8e047a82a6045d6c209f4ce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5662dac41a3442aa378d7c405164903eb109fc05","label":"5662dac41a34","date":"2026-09-02T14:29:17+02:00","lore":["https://lore.kernel.org/bpf/f0aa3678-79c9-47ae-9e8c-02a3d1df160a@hust.edu.cn/","https://lore.kernel.org/r/20260409023733.168050-1-jiayuan.chen@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a0c584fc18056709c8e047a82a6045d6c209f4ce","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53078","title":"bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops","status":"backported","project":true,"upstream":[{"sha":"10f86a2a5c91fc4c4d001960f1c21abe52545ef6","url":"https://git.kernel.org/stable/c/10f86a2a5c91fc4c4d001960f1c21abe52545ef6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/64eaf4ecda007140ddcdb28e00c48c9c69aaba39","label":"64eaf4ecda00","date":"2026-09-14T13:28:57+02:00","lore":["https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"10f86a2a5c91fc4c4d001960f1c21abe52545ef6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53078","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53078.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53070","title":"sctp: disable BH before calling udp_tunnel_xmit_skb()","status":"backported","project":false,"upstream":[{"sha":"2cd7e6971fc2787408ceef17906ea152791448cf","url":"https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7f0062c40781fe0a340965f5bb0816681982ff4c","label":"7f0062c40781","date":"2026-10-21T10:27:50+02:00","lore":[]}],"submission_lore":[],"basis":"The bug depends on 6f1a9140ecda's per-CPU tunnel recursion counter, which is absent from both targets; adding BH disable would not fix an extant target bug.","review":{"id":"CVE-2026-53070","series":"6.6.y","upstream":["2cd7e6971fc2787408ceef17906ea152791448cf"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The bug depends on 6f1a9140ecda's per-CPU tunnel recursion counter, which is absent from both targets; adding BH disable would not fix an extant target bug.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"2cd7e6971fc2787408ceef17906ea152791448cf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53070","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53070.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53024","title":"greybus: raw: fix use-after-free if write is called after disconnect","status":"backported","project":false,"upstream":[{"sha":"84265cbd96b97058ef67e3f8be3933667a000835","url":"https://git.kernel.org/stable/c/84265cbd96b97058ef67e3f8be3933667a000835"}],"evidence":[{"url":"https://git.kernel.org/stable/c/966b941ca469fb794637a0803670454f68515e40","label":"966b941ca469","date":"2026-10-21T10:28:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"84265cbd96b97058ef67e3f8be3933667a000835","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/84265cbd96b97058ef67e3f8be3933667a000835.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53024","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53024.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53015","title":"erofs: unify lcn as u64 for 32-bit platforms","status":"backported","project":true,"upstream":[{"sha":"2d8c7edcb661812249469f4a5b62e9339118846f","url":"https://git.kernel.org/stable/c/2d8c7edcb661812249469f4a5b62e9339118846f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/18f9f3ddbf2ed6d245a4c6f91c51f7248f8a982c","label":"18f9f3ddbf2e","date":"2026-10-21T10:27:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2d8c7edcb661812249469f4a5b62e9339118846f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53010","title":"ksmbd: fix use-after-free in smb2_open during durable reconnect","status":"backported","project":true,"upstream":[{"sha":"1baff47b81f94f9231c91236aa511420d0e266b9","url":"https://git.kernel.org/stable/c/1baff47b81f94f9231c91236aa511420d0e266b9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f0ff7f12398e85b3a11745ff7feab6246f3d75c2","label":"f0ff7f12398e","date":"2026-09-14T13:28:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"1baff47b81f94f9231c91236aa511420d0e266b9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52994","title":"vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting","status":"not-applicable","project":false,"upstream":[{"sha":"1cb36e252211506f51095fe7ced8286cc77b4c80","url":"https://git.kernel.org/stable/c/1cb36e252211506f51095fe7ced8286cc77b4c80"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"1cb36e252211506f51095fe7ced8286cc77b4c80","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/1cb36e252211506f51095fe7ced8286cc77b4c80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52994","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52994.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52961","title":"ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size","status":"backported","project":true,"upstream":[{"sha":"0c22d9511cbde746622f8e4c11aaa63fe76d45f9","url":"https://git.kernel.org/stable/c/0c22d9511cbde746622f8e4c11aaa63fe76d45f9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d161c4456672f8c431e3bdf9bea817b490d14181","label":"d161c4456672","date":"2026-09-14T13:28:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0c22d9511cbde746622f8e4c11aaa63fe76d45f9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52960","title":"ceph: put folios not suitable for writeback","status":"not-applicable","project":false,"upstream":[{"sha":"544576f0f05c4a759806acddfaaeb686f14fb4b0","url":"https://git.kernel.org/stable/c/544576f0f05c4a759806acddfaaeb686f14fb4b0"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"544576f0f05c4a759806acddfaaeb686f14fb4b0","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/544576f0f05c4a759806acddfaaeb686f14fb4b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52960","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52960.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52953","title":"iommu/vt-d: Fix oops due to out of scope access","status":"unfixed","project":false,"upstream":[{"sha":"a6dea58d8625c06b9654c0555f101742481335c3","url":"https://git.kernel.org/stable/c/a6dea58d8625c06b9654c0555f101742481335c3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6dea58d8625c06b9654c0555f101742481335c3","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a6dea58d8625c06b9654c0555f101742481335c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52953","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52953.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52944","title":"ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE","status":"backported","project":false,"upstream":[{"sha":"cc57232cae23c0df91b4a59d0f519141ce9b5b02","url":"https://git.kernel.org/stable/c/cc57232cae23c0df91b4a59d0f519141ce9b5b02"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3127a884525dc8ca4def73254bfcd3ccef0bf812","label":"3127a884525d","date":"2026-06-19T13:39:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"cc57232cae23c0df91b4a59d0f519141ce9b5b02","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46317","title":"KVM: arm64: Reassign nested_mmus array behind mmu_lock","status":"not-applicable","project":false,"upstream":[{"sha":"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8","url":"https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46314","title":"drm/v3d: Reject empty multisync extension to prevent infinite loop","status":"not-applicable","project":false,"upstream":[{"sha":"fb44d589bf3148e13452185a6e772a7efbf2d684","url":"https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684"}],"evidence":[],"submission_lore":[],"basis":"v3d_get_multisync_submit_deps() already rejects requests where both in_sync_count and out_sync_count are zero, matching the upstream fix.","review":{"id":"CVE-2026-46314","series":"6.6.y","upstream":["fb44d589bf3148e13452185a6e772a7efbf2d684"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"already-fixed","applicability":"fixed","reason":"v3d_get_multisync_submit_deps() already rejects requests where both in_sync_count and out_sync_count are zero, matching the upstream fix.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/v3d/v3d_gem.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/v3d/v3d_gem.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n586"},{"label":"Upstream fix fb44d589bf31","url":"https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684"}]},"size":{"status":"within-limit","patches":[{"sha":"fb44d589bf3148e13452185a6e772a7efbf2d684","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/fb44d589bf3148e13452185a6e772a7efbf2d684.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46314","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46314.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46282","title":"iio: frequency: admv1013: fix NULL pointer dereference on str","status":"backported","project":false,"upstream":[{"sha":"aac0a51b16700b403a55b67ba495de021db78763","url":"https://git.kernel.org/stable/c/aac0a51b16700b403a55b67ba495de021db78763"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ef8b71a0fc692f8cb7f124a8143b540446b1fe9d","label":"ef8b71a0fc69","date":"2026-10-21T10:27:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aac0a51b16700b403a55b67ba495de021db78763","lines":93,"reason":"","source":"https://github.com/torvalds/linux/commit/aac0a51b16700b403a55b67ba495de021db78763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46282","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46282.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46279","title":"mm/alloc_tag: clear codetag for pages allocated before page_ext initialization","status":"not-applicable","project":false,"upstream":[{"sha":"6b1842775a460245e97d36d3a67d0cfba7c4ff79","url":"https://git.kernel.org/stable/c/6b1842775a460245e97d36d3a67d0cfba7c4ff79"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"6b1842775a460245e97d36d3a67d0cfba7c4ff79","lines":162,"reason":"","source":"https://github.com/torvalds/linux/commit/6b1842775a460245e97d36d3a67d0cfba7c4ff79.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46279","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46279.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46274","title":"io-wq: check that the predecessor is hashed in io_wq_remove_pending()","status":"backported","project":false,"upstream":[{"sha":"d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc","url":"https://git.kernel.org/stable/c/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d6bda9df0c0a3080804181464d5c0f4d78a4e769","label":"d6bda9df0c0a","date":"2026-05-23T13:03:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46274","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46274.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46254","title":"AppArmor: Allow apparmor to handle unaligned dfa tables","status":"backported","project":true,"upstream":[{"sha":"64802f731214a51dfe3c6c27636b3ddafd003eb0","url":"https://git.kernel.org/stable/c/64802f731214a51dfe3c6c27636b3ddafd003eb0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bd00629b527888a08a5222640fea045c6f64f5b5","label":"bd00629b5278","date":"2026-10-21T10:27:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"64802f731214a51dfe3c6c27636b3ddafd003eb0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46254","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46254.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46245","title":"drm/amd/display: Fix dc_link NULL handling in HPD init","status":"backported","project":false,"upstream":[{"sha":"226a40c06a183abaeb7529a4f54d6c203bd14407","url":"https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d772e8570f19ac05fd9b11c8af86ada98f35f0c8","label":"d772e8570f19","date":"2026-10-21T10:27:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"226a40c06a183abaeb7529a4f54d6c203bd14407","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/226a40c06a183abaeb7529a4f54d6c203bd14407.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46245","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46245.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46157","title":"ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger","status":"backported","project":true,"upstream":[{"sha":"901ac0ff15edf9503162e2cf6579bd11a30f1ed4","url":"https://git.kernel.org/stable/c/901ac0ff15edf9503162e2cf6579bd11a30f1ed4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c937a494901df8fbfaa5037a5883a7cd44282ea8","label":"c937a494901d","date":"2026-10-21T10:27:20+02:00","lore":["https://lore.kernel.org/20260423145330.210035-1-jjy600901@snu.ac.kr"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"901ac0ff15edf9503162e2cf6579bd11a30f1ed4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46157","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46157.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46153","title":"8021q: delete cleared egress QoS mappings","status":"unfixed","project":false,"upstream":[{"sha":"7dddc74af369478ba7f9bc136d0fc1dc4570cb66","url":"https://git.kernel.org/stable/c/7dddc74af369478ba7f9bc136d0fc1dc4570cb66"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7dddc74af369478ba7f9bc136d0fc1dc4570cb66","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7dddc74af369478ba7f9bc136d0fc1dc4570cb66.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46153","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46153.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46147","title":"KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()","status":"unfixed","project":false,"upstream":[{"sha":"73b9c1e5da84cd69b1a86e374e450817cd051371","url":"https://git.kernel.org/stable/c/73b9c1e5da84cd69b1a86e374e450817cd051371"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"73b9c1e5da84cd69b1a86e374e450817cd051371","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/73b9c1e5da84cd69b1a86e374e450817cd051371.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46147","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46147.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46130","title":"dm-verity-fec: fix reading parity bytes split across blocks (take 3)","status":"backported","project":false,"upstream":[{"sha":"430a05cb926f6bdf53e81460a2c3a553257f3f61","url":"https://git.kernel.org/stable/c/430a05cb926f6bdf53e81460a2c3a553257f3f61"}],"evidence":[{"url":"https://git.kernel.org/stable/c/03348b440f69417dc3a3c71d8271cff6b05f67fb","label":"03348b440f69","date":"2026-10-21T10:27:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"over-limit","patches":[{"sha":"430a05cb926f6bdf53e81460a2c3a553257f3f61","lines":129,"reason":"","source":"https://github.com/torvalds/linux/commit/430a05cb926f6bdf53e81460a2c3a553257f3f61.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46130","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46130.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46096","title":"tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()","status":"not-applicable","project":false,"upstream":[{"sha":"f0f75a3d98b7959a8677b6363e23190f3018636b","url":"https://git.kernel.org/stable/c/f0f75a3d98b7959a8677b6363e23190f3018636b"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0f75a3d98b7959a8677b6363e23190f3018636b","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/f0f75a3d98b7959a8677b6363e23190f3018636b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46096","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46096.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46068","title":"crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx","status":"backported","project":false,"upstream":[{"sha":"adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c","url":"https://git.kernel.org/stable/c/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f17a4850d1ce7c11cba8b1830b9bfedfede878bb","label":"f17a4850d1ce","date":"2026-05-23T13:03:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46068","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46068.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46054","title":"selinux: fix overlayfs mmap() and mprotect() access checks","status":"backported","project":false,"upstream":[{"sha":"82544d36b1729153c8aeb179e84750f0c085d3b1","url":"https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bc6c380c1159de52a252ed11f19a42c47f60a735","label":"bc6c380c1159","date":"2026-07-04T13:42:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"82544d36b1729153c8aeb179e84750f0c085d3b1","lines":373,"reason":"","source":"https://github.com/torvalds/linux/commit/82544d36b1729153c8aeb179e84750f0c085d3b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46054","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46054.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46044","title":"ipmi:ssif: Clean up kthread on errors","status":"unfixed","project":false,"upstream":[{"sha":"75c486cb1bcaa1a3ec3a6438498176a3a4998ae4","url":"https://git.kernel.org/stable/c/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"75c486cb1bcaa1a3ec3a6438498176a3a4998ae4","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46017","title":"mm: fix deferred split queue races during migration","status":"unfixed","project":false,"upstream":[{"sha":"3bac01168982ec3e3bf87efdc1807c7933590a85","url":"https://git.kernel.org/stable/c/3bac01168982ec3e3bf87efdc1807c7933590a85"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3bac01168982ec3e3bf87efdc1807c7933590a85","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/3bac01168982ec3e3bf87efdc1807c7933590a85.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46014","title":"KVM: SVM: Add missing save/restore handling of LBR MSRs","status":"backported","project":false,"upstream":[{"sha":"3700f0788da6acf73b2df56690f4b201aa4aefd2","url":"https://git.kernel.org/stable/c/3700f0788da6acf73b2df56690f4b201aa4aefd2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bca0597272f9712b1f8ebd38b184db1dc2902ff7","label":"bca0597272f9","date":"2026-10-21T10:28:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3700f0788da6acf73b2df56690f4b201aa4aefd2","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/3700f0788da6acf73b2df56690f4b201aa4aefd2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46014","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46014.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45988","title":"rxrpc: Fix re-decryption of RESPONSE packets","status":"backported","project":false,"upstream":[{"sha":"0422e7a4883f25101903f3e8105c0808aa5f4ce9","url":"https://git.kernel.org/stable/c/0422e7a4883f25101903f3e8105c0808aa5f4ce9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d61482be4aae1835b78875761206241835a7510e","label":"d61482be4aae","date":"2026-05-17T17:13:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0422e7a4883f25101903f3e8105c0808aa5f4ce9","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/0422e7a4883f25101903f3e8105c0808aa5f4ce9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45981","title":"s390/cio: Fix device lifecycle handling in css_alloc_subchannel()","status":"backported","project":false,"upstream":[{"sha":"f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7","url":"https://git.kernel.org/stable/c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/abb6e07f46a740cda4f07d1b561ae4eaa7a1df42","label":"abb6e07f46a7","date":"2026-03-04T07:19:29-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45981","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45981.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45963","title":"ASoC: nau8821: Cancel delayed work on component remove","status":"backported","project":false,"upstream":[{"sha":"dbd3fd05cddfdeec1e49b0a66269881c09eebd17","url":"https://git.kernel.org/stable/c/dbd3fd05cddfdeec1e49b0a66269881c09eebd17"}],"evidence":[{"url":"https://git.kernel.org/stable/c/36fb28fa033f6544d81f1cc056b27d0c0bf26d4f","label":"36fb28fa033f","date":"2026-09-02T14:29:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"dbd3fd05cddfdeec1e49b0a66269881c09eebd17","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45963","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45963.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45901","title":"netfilter: nf_tables: revert commit_mutex usage in reset path","status":"backported","project":false,"upstream":[{"sha":"7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc","url":"https://git.kernel.org/stable/c/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b0dd8637fbaae8405eb9e8de741f9ce7c9667b6f","label":"b0dd8637fbaa","date":"2026-10-21T10:27:47+02:00","lore":["https://lore.kernel.org/all/aUh_3mVRV8OrGsVo@strlen.de/"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"over-limit","patches":[{"sha":"7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc","lines":372,"reason":"","source":"https://github.com/torvalds/linux/commit/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45897","title":"netfilter: nft_counter: serialize reset with spinlock","status":"backported","project":true,"upstream":[{"sha":"779c60a5190c42689534172f4b49e927c9959e4e","url":"https://git.kernel.org/stable/c/779c60a5190c42689534172f4b49e927c9959e4e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/de6601f1374fab124cd9276df6671f64d940ceb4","label":"de6601f1374f","date":"2026-09-14T13:28:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"779c60a5190c42689534172f4b49e927c9959e4e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45897","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45897.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45893","title":"apparmor: Fix & Optimize table creation from possibly unaligned memory","status":"backported","project":true,"upstream":[{"sha":"6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a","url":"https://git.kernel.org/stable/c/6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1fbc4b24c7443ffd501609be74d9856fb940d703","label":"1fbc4b24c744","date":"2026-10-21T10:27:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45893","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45893.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45877","title":"HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients","status":"backported","project":false,"upstream":[{"sha":"56f7db581ee73af53cd512e00a6261a025bf1d58","url":"https://git.kernel.org/stable/c/56f7db581ee73af53cd512e00a6261a025bf1d58"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cde7f709d1025dadfc52e903e43981c1644bd8bd","label":"cde7f709d102","date":"2026-10-21T10:27:47+02:00","lore":[]}],"submission_lore":[],"basis":"The target loop iterates cl_device and checks cl_device->reference_count; it does not dereference the possibly NULL cl->device fixed upstream.","review":{"id":"CVE-2026-45877","series":"6.6.y","upstream":["56f7db581ee73af53cd512e00a6261a025bf1d58"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The target loop iterates cl_device and checks cl_device->reference_count; it does not dereference the possibly NULL cl->device fixed upstream.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"56f7db581ee73af53cd512e00a6261a025bf1d58","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45877","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45877.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45858","title":"ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1","status":"backported","project":false,"upstream":[{"sha":"1bf6974822d1dba86cf11b5f05498581cf3488a2","url":"https://git.kernel.org/stable/c/1bf6974822d1dba86cf11b5f05498581cf3488a2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/58ddae5d77b1db3a27b891c75a8fa120239ac092","label":"58ddae5d77b1","date":"2026-03-25T11:05:33+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1bf6974822d1dba86cf11b5f05498581cf3488a2","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/1bf6974822d1dba86cf11b5f05498581cf3488a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45858","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45858.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45855","title":"ata: libata-scsi: avoid Non-NCQ command starvation","status":"unfixed","project":false,"upstream":[{"sha":"0ea84089dbf62a92dc7889c79e6b18fc89260808","url":"https://git.kernel.org/stable/c/0ea84089dbf62a92dc7889c79e6b18fc89260808"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"0ea84089dbf62a92dc7889c79e6b18fc89260808","lines":165,"reason":"","source":"https://github.com/torvalds/linux/commit/0ea84089dbf62a92dc7889c79e6b18fc89260808.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45855","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45855.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43500","title":"rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present","status":"backported","project":false,"upstream":[{"sha":"aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","url":"https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b","label":"7c504ffab3ef","date":"2026-05-17T17:13:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43500","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43500.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43485","title":"nouveau/gsp: drop WARN_ON in ACPI probes","status":"not-applicable","project":false,"upstream":[{"sha":"9478c166c46934160135e197b049b5a05753f2ad","url":"https://git.kernel.org/stable/c/9478c166c46934160135e197b049b5a05753f2ad"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"9478c166c46934160135e197b049b5a05753f2ad","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/9478c166c46934160135e197b049b5a05753f2ad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43485","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43485.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43446","title":"accel/amdxdna: Fix runtime suspend deadlock when there is pending job","status":"not-applicable","project":false,"upstream":[{"sha":"6b13cb8f48a42ddf6dd98865b673a82e37ff238b","url":"https://git.kernel.org/stable/c/6b13cb8f48a42ddf6dd98865b673a82e37ff238b"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6b13cb8f48a42ddf6dd98865b673a82e37ff238b","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/6b13cb8f48a42ddf6dd98865b673a82e37ff238b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43446","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43446.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43416","title":"powerpc, perf: Check that current->mm is alive before getting user callchain","status":"unfixed","project":false,"upstream":[{"sha":"e9bbfb4bfa86c6b5515b868d6982ac60505d7e39","url":"https://git.kernel.org/stable/c/e9bbfb4bfa86c6b5515b868d6982ac60505d7e39"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e9bbfb4bfa86c6b5515b868d6982ac60505d7e39","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/e9bbfb4bfa86c6b5515b868d6982ac60505d7e39.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43416","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43416.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43409","title":"kprobes: avoid crash when rmmod/insmod after ftrace killed","status":"backported","project":false,"upstream":[{"sha":"e113f0b46d19626ec15388bcb91432c9a4fd6261","url":"https://git.kernel.org/stable/c/e113f0b46d19626ec15388bcb91432c9a4fd6261"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8b6767e4141b2a42745b544d4555cf1614ba1a2d","label":"8b6767e4141b","date":"2026-03-25T11:05:50+01:00","lore":["https://lore.kernel.org/all/176473947565.1727781.13110060700668331950.stgit@mhiramat.tok.corp.google.com/","https://lore.kernel.org/all/20251125020536.2484381-1-yebin@huaweicloud.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e113f0b46d19626ec15388bcb91432c9a4fd6261","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/e113f0b46d19626ec15388bcb91432c9a4fd6261.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43409","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43409.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43408","title":"ceph: add a bunch of missing ceph_path_info initializers","status":"unfixed","project":false,"upstream":[{"sha":"43323a5934b660afae687e8e4e95ac328615a5c4","url":"https://git.kernel.org/stable/c/43323a5934b660afae687e8e4e95ac328615a5c4"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"43323a5934b660afae687e8e4e95ac328615a5c4","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/43323a5934b660afae687e8e4e95ac328615a5c4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43408","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43408.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43391","title":"nsfs: tighten permission checks for handle opening","status":"not-applicable","project":false,"upstream":[{"sha":"d2324a9317f00013facb0ba00b00440e19d2af5e","url":"https://git.kernel.org/stable/c/d2324a9317f00013facb0ba00b00440e19d2af5e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"d2324a9317f00013facb0ba00b00440e19d2af5e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43391","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43391.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43362","title":"smb: client: fix in-place encryption corruption in SMB2_write()","status":"backported","project":false,"upstream":[{"sha":"d78840a6a38d312dc1a51a65317bb67e46f0b929","url":"https://git.kernel.org/stable/c/d78840a6a38d312dc1a51a65317bb67e46f0b929"}],"evidence":[{"url":"https://git.kernel.org/stable/c/438e77435aee2894d5edf90be5c87004a57f6258","label":"438e77435aee","date":"2026-03-25T11:05:54+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d78840a6a38d312dc1a51a65317bb67e46f0b929","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/d78840a6a38d312dc1a51a65317bb67e46f0b929.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43362","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43362.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43344","title":"perf/x86/intel/uncore: Fix die ID init and look up bugs","status":"backported","project":false,"upstream":[{"sha":"a16d1ec4dd0cdcf689f324adde6067083bce9099","url":"https://git.kernel.org/stable/c/a16d1ec4dd0cdcf689f324adde6067083bce9099"}],"evidence":[{"url":"https://git.kernel.org/stable/c/184870af0e73f8ea2577c751fa098681465249f2","label":"184870af0e73","date":"2026-09-14T13:28:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a16d1ec4dd0cdcf689f324adde6067083bce9099","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43344","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43344.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43326","title":"sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback","status":"not-applicable","project":false,"upstream":[{"sha":"415cb193bb9736f0e830286c72a6fa8eb2a9cc5c","url":"https://git.kernel.org/stable/c/415cb193bb9736f0e830286c72a6fa8eb2a9cc5c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"415cb193bb9736f0e830286c72a6fa8eb2a9cc5c","lines":158,"reason":"","source":"https://github.com/torvalds/linux/commit/415cb193bb9736f0e830286c72a6fa8eb2a9cc5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43326","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43326.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43318","title":"drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify","status":"unfixed","project":false,"upstream":[{"sha":"b18fc0ab837381c1a6ef28386602cd888f2d9edf","url":"https://git.kernel.org/stable/c/b18fc0ab837381c1a6ef28386602cd888f2d9edf"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b18fc0ab837381c1a6ef28386602cd888f2d9edf","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/b18fc0ab837381c1a6ef28386602cd888f2d9edf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43318","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43318.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43317","title":"most: core: fix leak on early registration failure","status":"backported","project":true,"upstream":[{"sha":"2c198c272f9c9213b0fdf6b4a879f445c574f416","url":"https://git.kernel.org/stable/c/2c198c272f9c9213b0fdf6b4a879f445c574f416"}],"evidence":[{"url":"https://git.kernel.org/stable/c/04474009a2ea7aa27c67d323952a23bb16d5acc5","label":"04474009a2ea","date":"2026-10-21T10:27:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c198c272f9c9213b0fdf6b4a879f445c574f416","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/2c198c272f9c9213b0fdf6b4a879f445c574f416.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43309","title":"md raid: fix hang when stopping arrays with metadata through dm-raid","status":"unfixed","project":false,"upstream":[{"sha":"cefcb9297fbdb6d94b61787b4f8d84f55b741470","url":"https://git.kernel.org/stable/c/cefcb9297fbdb6d94b61787b4f8d84f55b741470"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cefcb9297fbdb6d94b61787b4f8d84f55b741470","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/cefcb9297fbdb6d94b61787b4f8d84f55b741470.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43309","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43309.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43301","title":"media: chips-media: wave5: Fix PM runtime usage count underflow","status":"not-applicable","project":false,"upstream":[{"sha":"9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38","url":"https://git.kernel.org/stable/c/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43301","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43301.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43299","title":"btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()","status":"backported","project":false,"upstream":[{"sha":"8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3","url":"https://git.kernel.org/stable/c/8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a35b38cb4b0dd08d7cc0bd4e400208c7aeba8a72","label":"a35b38cb4b0d","date":"2026-10-21T10:27:46+02:00","lore":["https://lore.kernel.org/linux-btrfs/20260126045555.GB31641@lst.de/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43299","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43299.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43288","title":"ext4: move ext4_percpu_param_init() before ext4_mb_init()","status":"backported","project":false,"upstream":[{"sha":"270564513489d98b721a1e4a10017978d5213bff","url":"https://git.kernel.org/stable/c/270564513489d98b721a1e4a10017978d5213bff"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0d5fcb063cdabb9aeaa8554b7fedad2092c4150e","label":"0d5fcb063cda","date":"2026-03-04T07:20:46-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"270564513489d98b721a1e4a10017978d5213bff","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43234","title":"team: avoid NETDEV_CHANGEMTU event when unregistering slave","status":"backported","project":false,"upstream":[{"sha":"bb4c698633c0e19717586a6524a33196cff01a32","url":"https://git.kernel.org/stable/c/bb4c698633c0e19717586a6524a33196cff01a32"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1cf0ef73991880dd89aa1feaf547ab13e4767b85","label":"1cf0ef739918","date":"2026-10-21T10:27:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"bb4c698633c0e19717586a6524a33196cff01a32","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43234","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43234.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43188","title":"ceph: do not propagate page array emplacement errors as batch errors","status":"not-applicable","project":false,"upstream":[{"sha":"707104682e3c163f7c14cdd6b07a3e95fb374759","url":"https://git.kernel.org/stable/c/707104682e3c163f7c14cdd6b07a3e95fb374759"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"707104682e3c163f7c14cdd6b07a3e95fb374759","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/707104682e3c163f7c14cdd6b07a3e95fb374759.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43188","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43188.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43174","title":"io_uring/zcrx: fix post open error handling","status":"not-applicable","project":false,"upstream":[{"sha":"5d540e4508950c674d6feef1d95463d039bbf4f5","url":"https://git.kernel.org/stable/c/5d540e4508950c674d6feef1d95463d039bbf4f5"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"5d540e4508950c674d6feef1d95463d039bbf4f5","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/5d540e4508950c674d6feef1d95463d039bbf4f5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43173","title":"net: ethernet: xscale: Check for PTP support properly","status":"backported","project":false,"upstream":[{"sha":"594163ea88a03bdb412063af50fc7177ef3cbeae","url":"https://git.kernel.org/stable/c/594163ea88a03bdb412063af50fc7177ef3cbeae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/322437972f0a712767f6920ad34aba25f2e9b942","label":"322437972f0a","date":"2026-03-04T07:20:59-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"594163ea88a03bdb412063af50fc7177ef3cbeae","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/594163ea88a03bdb412063af50fc7177ef3cbeae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43173","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43173.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43172","title":"wifi: iwlwifi: fix 22000 series SMEM parsing","status":"backported","project":false,"upstream":[{"sha":"58192b9ce09b0f0f86e2036683bd542130b91a98","url":"https://git.kernel.org/stable/c/58192b9ce09b0f0f86e2036683bd542130b91a98"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5cc021586420c5e13acc65da5bf73edd451e2c3e","label":"5cc021586420","date":"2026-10-21T10:27:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"58192b9ce09b0f0f86e2036683bd542130b91a98","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/58192b9ce09b0f0f86e2036683bd542130b91a98.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43172","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43172.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43161","title":"iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode","status":"unfixed","project":false,"upstream":[{"sha":"42662d19839f34735b718129ea200e3734b07e50","url":"https://git.kernel.org/stable/c/42662d19839f34735b718129ea200e3734b07e50"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"42662d19839f34735b718129ea200e3734b07e50","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/42662d19839f34735b718129ea200e3734b07e50.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43137","title":"ASoC: SOF: Intel: hda: Fix NULL pointer dereference","status":"backported","project":false,"upstream":[{"sha":"16c589567a956d46a7c1363af3f64de3d420af20","url":"https://git.kernel.org/stable/c/16c589567a956d46a7c1363af3f64de3d420af20"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a1d4f3d3c0dc86527da6a19f6901a6a48375500d","label":"a1d4f3d3c0dc","date":"2026-05-23T13:03:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"16c589567a956d46a7c1363af3f64de3d420af20","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/16c589567a956d46a7c1363af3f64de3d420af20.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43126","title":"ALSA: mixer: oss: Add card disconnect checkpoints","status":"backported","project":true,"upstream":[{"sha":"084d5d44418148662365eced3e126ad1a81ee3e2","url":"https://git.kernel.org/stable/c/084d5d44418148662365eced3e126ad1a81ee3e2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/20c52a70414095447da1be076f492cc7a6dce7cf","label":"20c52a704140","date":"2026-10-21T10:27:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"084d5d44418148662365eced3e126ad1a81ee3e2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43126","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43126.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43115","title":"srcu: Use irq_work to start GP in tiny SRCU","status":"backported","project":false,"upstream":[{"sha":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","url":"https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af"}],"evidence":[{"url":"https://git.kernel.org/stable/c/20b98d9ffb09763048a7c84b47403eb0f177272c","label":"20b98d9ffb09","date":"2026-10-21T10:27:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43095","title":"ASoC: SDCA: Fix errors in IRQ cleanup","status":"not-applicable","project":false,"upstream":[{"sha":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","url":"https://git.kernel.org/stable/c/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","lines":145,"reason":"","source":"https://github.com/torvalds/linux/commit/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43095","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43095.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43088","title":"net: af_key: zero aligned sockaddr tail in PF_KEY exports","status":"backported","project":false,"upstream":[{"sha":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","url":"https://git.kernel.org/stable/c/426c355742f02cf743b347d9d7dbdc1bfbfa31ef"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3c19cb8a84ef709d57943bd6664cf31cb91ba6ec","label":"3c19cb8a84ef","date":"2026-06-19T13:39:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43088","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43088.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43073","title":"x86-64: rename misleadingly named '__copy_user_nocache()' function","status":"backported","project":false,"upstream":[{"sha":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","url":"https://git.kernel.org/stable/c/d187a86de793f84766ea40b9ade7ac60aabbb4fe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/73c2dc2c14d6a2efa5dde469546a907482af07fe","label":"73c2dc2c14d6","date":"2026-10-21T10:27:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","lines":84,"reason":"","source":"https://github.com/torvalds/linux/commit/d187a86de793f84766ea40b9ade7ac60aabbb4fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43053","title":"xfs: close crash window in attr dabtree inactivation","status":"unfixed","project":false,"upstream":[{"sha":"b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61","url":"https://git.kernel.org/stable/c/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61","lines":171,"reason":"","source":"https://github.com/torvalds/linux/commit/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43053","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43053.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43045","title":"mshv: Fix error handling in mshv_region_pin","status":"not-applicable","project":false,"upstream":[{"sha":"c0e296f257671ba10249630fe58026f29e4804d9","url":"https://git.kernel.org/stable/c/c0e296f257671ba10249630fe58026f29e4804d9"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"c0e296f257671ba10249630fe58026f29e4804d9","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/c0e296f257671ba10249630fe58026f29e4804d9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43045","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43045.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43042","title":"mpls: add seqcount to protect the platform_label{,s} pair","status":"backported","project":false,"upstream":[{"sha":"629ec78ef8608d955ce217880cdc3e1873af3a15","url":"https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0d377825548fe598595b5a5fa4a309fb593d8fb4","label":"0d377825548f","date":"2026-10-21T10:27:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"629ec78ef8608d955ce217880cdc3e1873af3a15","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/629ec78ef8608d955ce217880cdc3e1873af3a15.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43042","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43042.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43029","title":"mptcp: fix soft lockup in mptcp_recvmsg()","status":"unfixed","project":false,"upstream":[{"sha":"5dd8025a49c268ab6b94d978532af3ad341132a7","url":"https://git.kernel.org/stable/c/5dd8025a49c268ab6b94d978532af3ad341132a7"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5dd8025a49c268ab6b94d978532af3ad341132a7","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/5dd8025a49c268ab6b94d978532af3ad341132a7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43029","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43029.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43009","title":"bpf: Fix incorrect pruning due to atomic fetch precision tracking","status":"backported","project":false,"upstream":[{"sha":"179ee84a89114b854ac2dd1d293633a7f6c8dac1","url":"https://git.kernel.org/stable/c/179ee84a89114b854ac2dd1d293633a7f6c8dac1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1aac6b271e0a80b91c2f6a8f75ab0c0b1fc8ffe8","label":"1aac6b271e0a","date":"2026-10-21T10:27:43+02:00","lore":["https://lore.kernel.org/r/20260331222020.401848-1-daniel@iogearbox.net"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"179ee84a89114b854ac2dd1d293633a7f6c8dac1","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43009","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43009.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31777","title":"ALSA: ctxfi: Check the error for index mapping","status":"unfixed","project":false,"upstream":[{"sha":"277c6960d4ddb94d16198afd70c92c3d4593d131","url":"https://git.kernel.org/stable/c/277c6960d4ddb94d16198afd70c92c3d4593d131"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"277c6960d4ddb94d16198afd70c92c3d4593d131","lines":162,"reason":"","source":"https://github.com/torvalds/linux/commit/277c6960d4ddb94d16198afd70c92c3d4593d131.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31777","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31777.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31729","title":"usb: typec: ucsi: validate connector number in ucsi_notify_common()","status":"not-applicable","project":false,"upstream":[{"sha":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","url":"https://git.kernel.org/stable/c/d2d8c17ac01a1b1f638ea5d340a884ccc5015186"}],"evidence":[],"submission_lore":[],"basis":"Both targets already validate !num || num > cap.num_connectors inside ucsi_connector_change() before indexing connector[num-1], covering every older backend call site. The later centralized check would be redundant and its ucsi_notify_common() function does not exist in these targets.","review":{"id":"CVE-2026-31729","series":"6.6.y","upstream":["d2d8c17ac01a1b1f638ea5d340a884ccc5015186"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"no-op","applicability":"unaffected","reason":"Both targets already validate !num || num > cap.num_connectors inside ucsi_connector_change() before indexing connector[num-1], covering every older backend call site. The later centralized check would be redundant and its ucsi_notify_common() function does not exist in these targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/d2d8c17ac01a1b1f638ea5d340a884ccc5015186.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31729","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31729.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31710","title":"smb: client: fix dir separator in SMB1 UNIX mounts","status":"not-applicable","project":false,"upstream":[{"sha":"c4d3fc5844d685441befd0caaab648321013cdfd","url":"https://git.kernel.org/stable/c/c4d3fc5844d685441befd0caaab648321013cdfd"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c4d3fc5844d685441befd0caaab648321013cdfd","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/c4d3fc5844d685441befd0caaab648321013cdfd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31710","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31710.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31692","title":"rtnetlink: add missing netlink_ns_capable() check for peer netns","status":"unfixed","project":false,"upstream":[{"sha":"7b735ef81286007794a227ce2539419479c02a5f","url":"https://git.kernel.org/stable/c/7b735ef81286007794a227ce2539419479c02a5f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7b735ef81286007794a227ce2539419479c02a5f","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/7b735ef81286007794a227ce2539419479c02a5f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31692","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31692.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31655","title":"pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled","status":"backported","project":false,"upstream":[{"sha":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","url":"https://git.kernel.org/stable/c/e91d5f94acf68618ea3ad9c92ac28614e791ae7d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/80fd0de89805a3f92dc320f5ab5a18007c260374","label":"80fd0de89805","date":"2026-04-18T10:39:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31655","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31655.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31648","title":"mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()","status":"backported","project":false,"upstream":[{"sha":"f58df566524ebcdfa394329c64f47e3c9257516e","url":"https://git.kernel.org/stable/c/f58df566524ebcdfa394329c64f47e3c9257516e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/88591194df736a508dd5461ab2167a61e98caac1","label":"88591194df73","date":"2026-04-18T10:39:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"f58df566524ebcdfa394329c64f47e3c9257516e","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/f58df566524ebcdfa394329c64f47e3c9257516e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31648","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31648.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31591","title":"KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish","status":"not-applicable","project":false,"upstream":[{"sha":"cb923ee6a80f4e604e6242a4702b59251e61a380","url":"https://git.kernel.org/stable/c/cb923ee6a80f4e604e6242a4702b59251e61a380"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"cb923ee6a80f4e604e6242a4702b59251e61a380","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/cb923ee6a80f4e604e6242a4702b59251e61a380.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31579","title":"wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit","status":"unfixed","project":false,"upstream":[{"sha":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","url":"https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31579","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31579.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31573","title":"media: verisilicon: Fix kernel panic due to __initconst misuse","status":"unfixed","project":false,"upstream":[{"sha":"e8d97c270cb46a2a88739019d0f8547adc7d97da","url":"https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e8d97c270cb46a2a88739019d0f8547adc7d97da","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/e8d97c270cb46a2a88739019d0f8547adc7d97da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31573","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31573.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31537","title":"smb: server: make use of smbdirect_socket.send_io.bcredits","status":"unfixed","project":false,"upstream":[{"sha":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","url":"https://git.kernel.org/stable/c/34abd408c8ba24d7c97bd02ba874d8c714f49db1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/34abd408c8ba24d7c97bd02ba874d8c714f49db1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31537","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31537.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31536","title":"smb: server: let send_done handle a completion without IB_SEND_SIGNALED","status":"unfixed","project":false,"upstream":[{"sha":"9da82dc73cb03e85d716a2609364572367a5ff47","url":"https://git.kernel.org/stable/c/9da82dc73cb03e85d716a2609364572367a5ff47"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9da82dc73cb03e85d716a2609364572367a5ff47","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/9da82dc73cb03e85d716a2609364572367a5ff47.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31536","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31536.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31527","title":"driver core: platform: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","url":"https://git.kernel.org/stable/c/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/492349e5e4a369a8b62781100a3ade470bf1ce6b","label":"492349e5e4a3","date":"2026-06-01T17:43:04+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31527","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31527.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31516","title":"xfrm: prevent policy_hthresh.work from racing with netns teardown","status":"unfixed","project":false,"upstream":[{"sha":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","url":"https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/29fe3a61bcdce398ee3955101c39f89c01a8a77e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31516","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31516.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31502","title":"team: fix header_ops type confusion with non-Ethernet ports","status":"backported","project":false,"upstream":[{"sha":"425000dbf17373a4ab8be9428f5dc055ef870a56","url":"https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"}],"evidence":[{"url":"https://git.kernel.org/stable/c/420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53","label":"420e5aad7ba8","date":"2026-07-24T16:02:38+02:00","lore":["https://lore.kernel.org/all/69b46af7.050a0220.36eb34.000e.GAE@google.com/T/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"425000dbf17373a4ab8be9428f5dc055ef870a56","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31502","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31502.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31499","title":"Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()","status":"unfixed","project":false,"upstream":[{"sha":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","url":"https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/00fdebbbc557a2fc21321ff2eaa22fd70c078608.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31493","title":"RDMA/efa: Fix use of completion ctx after free","status":"backported","project":false,"upstream":[{"sha":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","url":"https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8c24b5179af260a5f36571c992d29aab1f448544","label":"8c24b5179af2","date":"2026-10-21T10:28:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","lines":179,"reason":"","source":"https://github.com/torvalds/linux/commit/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31487","title":"spi: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","url":"https://git.kernel.org/stable/c/cc34d77dd48708d810c12bfd6f5bf03304f6c824"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6e8eb467bed6aa1a563dba8f366c9fd76ba0004e","label":"6e8eb467bed6","date":"2026-10-21T10:27:41+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/cc34d77dd48708d810c12bfd6f5bf03304f6c824.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31487","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31487.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31458","title":"mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]","status":"backported","project":false,"upstream":[{"sha":"1bfe9fb5ed2667fb075682408b776b5273162615","url":"https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aba546061341b56e9ffb37e1eb661a3628b6ec12","label":"aba546061341","date":"2026-04-02T13:07:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1bfe9fb5ed2667fb075682408b776b5273162615","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/1bfe9fb5ed2667fb075682408b776b5273162615.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31458","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31458.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31435","title":"netfs: Fix read abandonment during retry","status":"not-applicable","project":false,"upstream":[{"sha":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","url":"https://git.kernel.org/stable/c/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31435","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31435.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31420","title":"bridge: mrp: reject zero test interval to avoid OOM panic","status":"backported","project":true,"upstream":[{"sha":"fa6e24963342de4370e3a3c9af41e38277b74cf3","url":"https://git.kernel.org/stable/c/fa6e24963342de4370e3a3c9af41e38277b74cf3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2120bd8546cd6a63c558d135773aa8f41c8259fc","label":"2120bd8546cd","date":"2026-09-14T13:28:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fa6e24963342de4370e3a3c9af41e38277b74cf3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31420","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31420.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23459","title":"ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS","status":"backported","project":false,"upstream":[{"sha":"8431c602f551549f082bbfa67f3003f2d8e3e132","url":"https://git.kernel.org/stable/c/8431c602f551549f082bbfa67f3003f2d8e3e132"}],"evidence":[{"url":"https://git.kernel.org/stable/c/127c5e6e2d6fa8185314537c08204ec3515eae99","label":"127c5e6e2d6f","date":"2026-10-21T10:28:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"8431c602f551549f082bbfa67f3003f2d8e3e132","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23459","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23459.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23448","title":"net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check","status":"backported","project":false,"upstream":[{"sha":"2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a","url":"https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f1c7701d3ac91b62d672c13690cf295821f0d5c3","label":"f1c7701d3ac9","date":"2026-03-25T11:06:07+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23448","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23448.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23447","title":"net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check","status":"backported","project":false,"upstream":[{"sha":"77914255155e68a20aa41175edeecf8121dac391","url":"https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391"}],"evidence":[{"url":"https://git.kernel.org/stable/c/125f932a76a97904ef8a555f1dd53e5d0e288c54","label":"125f932a76a9","date":"2026-03-25T11:06:07+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"77914255155e68a20aa41175edeecf8121dac391","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23447","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23447.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23393","title":"bridge: cfm: Fix race condition in peer_mep deletion","status":"unfixed","project":false,"upstream":[{"sha":"3715a00855316066cdda69d43648336367422127","url":"https://git.kernel.org/stable/c/3715a00855316066cdda69d43648336367422127"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3715a00855316066cdda69d43648336367422127","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/3715a00855316066cdda69d43648336367422127.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23393","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23393.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23371","title":"sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting","status":"backported","project":false,"upstream":[{"sha":"d658686a1331db3bb108ca079d76deb3208ed949","url":"https://git.kernel.org/stable/c/d658686a1331db3bb108ca079d76deb3208ed949"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ce6253fe718811cceb3a0ae0dbf0a5941dea3eb6","label":"ce6253fe7188","date":"2026-10-21T10:27:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-23371","series":"6.6.y","upstream":["d658686a1331db3bb108ca079d76deb3208ed949"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"__sched_setscheduler lacks deadline PI replenish handling","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/sched/core.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/sched/core.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n7618"},{"label":"Upstream fix d658686a1331","url":"https://git.kernel.org/stable/c/d658686a1331db3bb108ca079d76deb3208ed949"}]},"size":{"status":"unknown","patches":[{"sha":"d658686a1331db3bb108ca079d76deb3208ed949","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23371","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23371.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23348","title":"cxl: Fix race of nvdimm_bus object when creating nvdimm objects","status":"unfixed","project":false,"upstream":[{"sha":"96a1fd0d84b17360840f344826897fa71049870e","url":"https://git.kernel.org/stable/c/96a1fd0d84b17360840f344826897fa71049870e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"96a1fd0d84b17360840f344826897fa71049870e","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/96a1fd0d84b17360840f344826897fa71049870e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23348","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23348.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23346","title":"arm64: io: Extract user memory type in ioremap_prot()","status":"backported","project":false,"upstream":[{"sha":"8f098037139b294050053123ab2bc0f819d08932","url":"https://git.kernel.org/stable/c/8f098037139b294050053123ab2bc0f819d08932"}],"evidence":[{"url":"https://git.kernel.org/stable/c/64858b76ec67c5fc40fef8ec1841fecb78c1ebde","label":"64858b76ec67","date":"2026-06-19T13:39:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f098037139b294050053123ab2bc0f819d08932","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8f098037139b294050053123ab2bc0f819d08932.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23346","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23346.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23295","title":"accel/amdxdna: Fix dead lock for suspend and resume","status":"not-applicable","project":false,"upstream":[{"sha":"1aa82181a3c285c7351523d587f7981ae4c015c8","url":"https://git.kernel.org/stable/c/1aa82181a3c285c7351523d587f7981ae4c015c8"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"1aa82181a3c285c7351523d587f7981ae4c015c8","lines":144,"reason":"","source":"https://github.com/torvalds/linux/commit/1aa82181a3c285c7351523d587f7981ae4c015c8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23295","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23295.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23276","title":"net: add xmit recursion limit to tunnel xmit functions","status":"backported","project":false,"upstream":[{"sha":"6f1a9140ecda3baba3d945b9a6155af4268aafc4","url":"https://git.kernel.org/stable/c/6f1a9140ecda3baba3d945b9a6155af4268aafc4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/da5f0166cef3d4285ddbb1b638661263fc03ee92","label":"da5f0166cef3","date":"2026-10-21T10:27:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"6f1a9140ecda3baba3d945b9a6155af4268aafc4","lines":152,"reason":"","source":"https://github.com/torvalds/linux/commit/6f1a9140ecda3baba3d945b9a6155af4268aafc4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23276","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23276.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23265","title":"f2fs: fix to do sanity check on node footer in {read,write}_end_io","status":"unfixed","project":false,"upstream":[{"sha":"50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4","url":"https://git.kernel.org/stable/c/50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4","lines":107,"reason":"","source":"https://github.com/torvalds/linux/commit/50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23265","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23265.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23240","title":"tls: Fix race condition in tls_sw_cancel_work_tx()","status":"unfixed","project":false,"upstream":[{"sha":"7bb09315f93dce6acc54bf59e5a95ba7365c2be4","url":"https://git.kernel.org/stable/c/7bb09315f93dce6acc54bf59e5a95ba7365c2be4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7bb09315f93dce6acc54bf59e5a95ba7365c2be4","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7bb09315f93dce6acc54bf59e5a95ba7365c2be4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23240","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23240.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23239","title":"espintcp: Fix race condition in espintcp_close()","status":"unfixed","project":false,"upstream":[{"sha":"e1512c1db9e8794d8d130addd2615ec27231d994","url":"https://git.kernel.org/stable/c/e1512c1db9e8794d8d130addd2615ec27231d994"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e1512c1db9e8794d8d130addd2615ec27231d994","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/e1512c1db9e8794d8d130addd2615ec27231d994.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23239","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23239.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23152","title":"wifi: mac80211: correctly decode TTLM with default link map","status":"not-applicable","project":false,"upstream":[{"sha":"1eab33aa63c993685dd341e03bd5b267dd7403fa","url":"https://git.kernel.org/stable/c/1eab33aa63c993685dd341e03bd5b267dd7403fa"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"1eab33aa63c993685dd341e03bd5b267dd7403fa","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/1eab33aa63c993685dd341e03bd5b267dd7403fa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23152","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23152.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23137","title":"of: unittest: Fix memory leak in unittest_data_add()","status":"backported","project":false,"upstream":[{"sha":"235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b","url":"https://git.kernel.org/stable/c/235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4c7ad40c285ab85e3614433e063f14aac2e2fe17","label":"4c7ad40c285a","date":"2026-10-21T10:27:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23102","title":"arm64/fpsimd: signal: Fix restoration of SVE context","status":"backported","project":false,"upstream":[{"sha":"d2907cbe9ea0a54cbe078076f9d089240ee1e2d9","url":"https://git.kernel.org/stable/c/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ce820dd4e6e2d711242dc4331713b9bb4fe06d09","label":"ce820dd4e6e2","date":"2026-02-06T16:48:27+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2907cbe9ea0a54cbe078076f9d089240ee1e2d9","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23088","title":"tracing: Fix crash on synthetic stacktrace field usage","status":"backported","project":false,"upstream":[{"sha":"90f9f5d64cae4e72defd96a2a22760173cb3c9ec","url":"https://git.kernel.org/stable/c/90f9f5d64cae4e72defd96a2a22760173cb3c9ec"}],"evidence":[{"url":"https://git.kernel.org/stable/c/98ecbfb2598c9c7ca755a29f402da9d36c057077","label":"98ecbfb2598c","date":"2026-01-30T10:27:39+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"90f9f5d64cae4e72defd96a2a22760173cb3c9ec","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/90f9f5d64cae4e72defd96a2a22760173cb3c9ec.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23088","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23088.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23035","title":"net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv","status":"backported","project":true,"upstream":[{"sha":"4ef8512e1427111f7ba92b4a847d181ff0aeec42","url":"https://git.kernel.org/stable/c/4ef8512e1427111f7ba92b4a847d181ff0aeec42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/444b0e44aa43081d4ddd138575e5a2dcabf439c7","label":"444b0e44aa43","date":"2026-10-21T10:27:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4ef8512e1427111f7ba92b4a847d181ff0aeec42","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/4ef8512e1427111f7ba92b4a847d181ff0aeec42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23035","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23035.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23007","title":"block: zero non-PI portion of auto integrity buffer","status":"not-applicable","project":false,"upstream":[{"sha":"ca22c566b89164f6e670af56ecc45f47ef3df819","url":"https://git.kernel.org/stable/c/ca22c566b89164f6e670af56ecc45f47ef3df819"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"ca22c566b89164f6e670af56ecc45f47ef3df819","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/ca22c566b89164f6e670af56ecc45f47ef3df819.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23007","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23007.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23000","title":"net/mlx5e: Fix crash on profile change rollback failure","status":"unfixed","project":false,"upstream":[{"sha":"4dadc4077e3f77d6d31e199a925fc7a705e7adeb","url":"https://git.kernel.org/stable/c/4dadc4077e3f77d6d31e199a925fc7a705e7adeb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"4dadc4077e3f77d6d31e199a925fc7a705e7adeb","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/4dadc4077e3f77d6d31e199a925fc7a705e7adeb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23000","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23000.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-22996","title":"net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv","status":"backported","project":true,"upstream":[{"sha":"123eda2e5b1638e298e3a66bb1e64a8da92de5e1","url":"https://git.kernel.org/stable/c/123eda2e5b1638e298e3a66bb1e64a8da92de5e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7b3b902320214835013ce625053b0743a71c804c","label":"7b3b90232021","date":"2026-10-21T10:27:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"123eda2e5b1638e298e3a66bb1e64a8da92de5e1","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/123eda2e5b1638e298e3a66bb1e64a8da92de5e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-22996","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-22996.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71315","title":"drm/vkms: Convert to DRM's vblank timer","status":"unfixed","project":false,"upstream":[{"sha":"02e2681ffe1addde1fc8c35d05657b16bfa79613","url":"https://git.kernel.org/stable/c/02e2681ffe1addde1fc8c35d05657b16bfa79613"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"02e2681ffe1addde1fc8c35d05657b16bfa79613","lines":130,"reason":"","source":"https://github.com/torvalds/linux/commit/02e2681ffe1addde1fc8c35d05657b16bfa79613.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71302","title":"drm/panthor: fix for dma-fence safe access rules","status":"not-applicable","project":false,"upstream":[{"sha":"efe24898485c5c831e629d9c6fb9350c35cb576f","url":"https://git.kernel.org/stable/c/efe24898485c5c831e629d9c6fb9350c35cb576f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"efe24898485c5c831e629d9c6fb9350c35cb576f","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/efe24898485c5c831e629d9c6fb9350c35cb576f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71302","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71302.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71272","title":"most: core: fix resource leak in most_register_interface error paths","status":"backported","project":true,"upstream":[{"sha":"1f4c9d8a1021281750c6cda126d6f8a40cc24e71","url":"https://git.kernel.org/stable/c/1f4c9d8a1021281750c6cda126d6f8a40cc24e71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/82f42a13e3d7a07a950ee4fa2d4c74843a3e7ace","label":"82f42a13e3d7","date":"2026-10-21T10:27:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1f4c9d8a1021281750c6cda126d6f8a40cc24e71","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/1f4c9d8a1021281750c6cda126d6f8a40cc24e71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71272","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71272.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71225","title":"md: suspend array while updating raid_disks via sysfs","status":"backported","project":false,"upstream":[{"sha":"2cc583653bbe050bacd1cadcc9776d39bf449740","url":"https://git.kernel.org/stable/c/2cc583653bbe050bacd1cadcc9776d39bf449740"}],"evidence":[{"url":"https://git.kernel.org/stable/c/863b9b7be824a6b2c0587532d3ece3022c6dd451","label":"863b9b7be824","date":"2026-10-21T10:27:39+02:00","lore":["https://lore.kernel.org/linux-raid/20251226101816.4506-1-dannyshih@synology.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2cc583653bbe050bacd1cadcc9776d39bf449740","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/2cc583653bbe050bacd1cadcc9776d39bf449740.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71225","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71225.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71202","title":"iommu/sva: invalidate stale IOTLB entries for kernel address space","status":"unfixed","project":false,"upstream":[{"sha":"e37d5a2d60a338c5917c45296bac65da1382eda5","url":"https://git.kernel.org/stable/c/e37d5a2d60a338c5917c45296bac65da1382eda5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"e37d5a2d60a338c5917c45296bac65da1382eda5","lines":110,"reason":"","source":"https://github.com/torvalds/linux/commit/e37d5a2d60a338c5917c45296bac65da1382eda5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71202","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71202.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71160","title":"netfilter: nf_tables: avoid chain re-validation if possible","status":"backported","project":false,"upstream":[{"sha":"8e1a1bc4f5a42747c08130b8242ebebd1210b32f","url":"https://git.kernel.org/stable/c/8e1a1bc4f5a42747c08130b8242ebebd1210b32f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/53de1e6cde8f9b791d9cf61aa0e7b02cf5bbe8b1","label":"53de1e6cde8f","date":"2026-01-17T16:30:01+01:00","lore":["https://lore.kernel.org/netfilter-devel/20251118221735.GA5477@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8e1a1bc4f5a42747c08130b8242ebebd1210b32f","lines":177,"reason":"","source":"https://github.com/torvalds/linux/commit/8e1a1bc4f5a42747c08130b8242ebebd1210b32f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71160","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71160.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71129","title":"LoongArch: BPF: Sign extend kfunc call arguments","status":"backported","project":false,"upstream":[{"sha":"3f5a238f24d7b75f9efe324d3539ad388f58536e","url":"https://git.kernel.org/stable/c/3f5a238f24d7b75f9efe324d3539ad388f58536e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fd43edf357a3a1f5ed1c4bf450b60001c9091c39","label":"fd43edf357a3","date":"2026-01-11T15:22:18+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f5a238f24d7b75f9efe324d3539ad388f58536e","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/3f5a238f24d7b75f9efe324d3539ad388f58536e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71117","title":"block: Remove queue freezing from several sysfs store callbacks","status":"not-applicable","project":false,"upstream":[{"sha":"935a20d1bebf6236076785fac3ff81e3931834e9","url":"https://git.kernel.org/stable/c/935a20d1bebf6236076785fac3ff81e3931834e9"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"935a20d1bebf6236076785fac3ff81e3931834e9","lines":113,"reason":"","source":"https://github.com/torvalds/linux/commit/935a20d1bebf6236076785fac3ff81e3931834e9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71117","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71117.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71065","title":"f2fs: fix to avoid potential deadlock","status":"backported","project":false,"upstream":[{"sha":"ca8b201f28547e28343a6f00a6e91fa8c09572fe","url":"https://git.kernel.org/stable/c/ca8b201f28547e28343a6f00a6e91fa8c09572fe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8bd6dff8b801abaa362272894bda795bf0cf1307","label":"8bd6dff8b801","date":"2026-01-11T15:22:22+01:00","lore":["https://lore.kernel.org/linux-f2fs-devel/68eae49b.050a0220.ac43.0001.GAE@google.com","https://lore.kernel.org/lkml/CANypQFa-Gy9sD-N35o3PC+FystOWkNuN8pv6S75HLT0ga-Tzgw@mail.gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ca8b201f28547e28343a6f00a6e91fa8c09572fe","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/ca8b201f28547e28343a6f00a6e91fa8c09572fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71065","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71065.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68781","title":"usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal","status":"unfixed","project":false,"upstream":[{"sha":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","url":"https://git.kernel.org/stable/c/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f"}],"evidence":[],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"within-limit","patches":[{"sha":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68781","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68781.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68768","title":"inet: frags: flush pending skbs in fqdir_pre_exit()","status":"backported","project":false,"upstream":[{"sha":"006a5035b495dec008805df249f92c22c89c3d2e","url":"https://git.kernel.org/stable/c/006a5035b495dec008805df249f92c22c89c3d2e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/22ee4010866da81aeee08e1ea3fddbe418feb212","label":"22ee4010866d","date":"2026-06-19T13:39:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"006a5035b495dec008805df249f92c22c89c3d2e","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/006a5035b495dec008805df249f92c22c89c3d2e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68751","title":"s390/fpu: Fix false-positive kmsan report in fpu_vstl()","status":"not-applicable","project":false,"upstream":[{"sha":"14e4e4175b64dd9216b522f6ece8af6997d063b2","url":"https://git.kernel.org/stable/c/14e4e4175b64dd9216b522f6ece8af6997d063b2"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"14e4e4175b64dd9216b522f6ece8af6997d063b2","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/14e4e4175b64dd9216b522f6ece8af6997d063b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68751","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68751.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68338","title":"net: dsa: microchip: Don't free uninitialized ksz_irq","status":"not-applicable","project":false,"upstream":[{"sha":"25b62cc5b22c45face094ae3e8717258e46d1d19","url":"https://git.kernel.org/stable/c/25b62cc5b22c45face094ae3e8717258e46d1d19"}],"evidence":[],"submission_lore":[],"basis":"Already fixed equivalently: 6.6's older error path uses dsa_switch_for_each_port_continue_reverse() and filters user ports before freeing initialized per-port IRQs. No patch should be generated merely to reproduce the newer helper spelling. The target cleanup resumes before the failed port, so it does not free the uninitialized ksz_irq described by the CVE.","review":{"id":"CVE-2025-68338","series":"6.6.y","upstream":["25b62cc5b22c45face094ae3e8717258e46d1d19"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"no-op","applicability":"unaffected","reason":"Already fixed equivalently: 6.6's older error path uses dsa_switch_for_each_port_continue_reverse() and filters user ports before freeing initialized per-port IRQs. No patch should be generated merely to reproduce the newer helper spelling. The target cleanup resumes before the failed port, so it does not free the uninitialized ksz_irq described by the CVE.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"25b62cc5b22c45face094ae3e8717258e46d1d19","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/25b62cc5b22c45face094ae3e8717258e46d1d19.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68338","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68338.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68334","title":"platform/x86/amd/pmc: Add support for Van Gogh SoC","status":"backported","project":false,"upstream":[{"sha":"db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb","url":"https://git.kernel.org/stable/c/db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8af210df4f71dda74dc027da69372a028c6d4d84","label":"8af210df4f71","date":"2026-03-25T11:06:01+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68322","title":"parisc: Avoid crash due to unaligned access in unwinder","status":"unfixed","project":false,"upstream":[{"sha":"fd9f30d1038ee1624baa17a6ff11effe5f7617cb","url":"https://git.kernel.org/stable/c/fd9f30d1038ee1624baa17a6ff11effe5f7617cb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":{"id":"CVE-2025-68322","series":"6.6.y","upstream":["fd9f30d1038ee1624baa17a6ff11effe5f7617cb"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"needs-review","applicability":"unknown","reason":"Upstream adds alignment checks around unwinder frame reads introduced by the newer unwinder path. Do not backport: the upstream commit explicitly carries Cc: stable # v6.12+, and the relevant target control-flow/layout does not match the v6.12+ faulting path. Treating CNA range alone as proof would override explicit maintainer scoping; fragments on these older unwinders would not establish that the reported bug is fixed and risk a semantic no-op.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"fd9f30d1038ee1624baa17a6ff11effe5f7617cb","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/fd9f30d1038ee1624baa17a6ff11effe5f7617cb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68322","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68322.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68313","title":"x86/CPU/AMD: Add RDSEED fix for Zen5","status":"unfixed","project":false,"upstream":[{"sha":"607b9fb2ce248cc5b633c5949e0153838992c152","url":"https://git.kernel.org/stable/c/607b9fb2ce248cc5b633c5949e0153838992c152"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"607b9fb2ce248cc5b633c5949e0153838992c152","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/607b9fb2ce248cc5b633c5949e0153838992c152.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68304","title":"Bluetooth: hci_core: lookup hci_conn on RX path on protocol side","status":"unfixed","project":false,"upstream":[{"sha":"79a2d4678ba90bdba577dc3af88cc900d6dcd5ee","url":"https://git.kernel.org/stable/c/79a2d4678ba90bdba577dc3af88cc900d6dcd5ee"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"79a2d4678ba90bdba577dc3af88cc900d6dcd5ee","lines":327,"reason":"","source":"https://github.com/torvalds/linux/commit/79a2d4678ba90bdba577dc3af88cc900d6dcd5ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68304","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68304.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68296","title":"drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup","status":"backported","project":false,"upstream":[{"sha":"eb76d0f5553575599561010f24c277cc5b31d003","url":"https://git.kernel.org/stable/c/eb76d0f5553575599561010f24c277cc5b31d003"}],"evidence":[{"url":"https://git.kernel.org/stable/c/711ebd961190def4c69ea24b2f0be75e995af24a","label":"711ebd961190","date":"2026-06-19T13:39:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb76d0f5553575599561010f24c277cc5b31d003","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/eb76d0f5553575599561010f24c277cc5b31d003.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68296","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68296.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68251","title":"erofs: avoid infinite loops due to corrupted subpage compact indexes","status":"backported","project":true,"upstream":[{"sha":"e13d315ae077bb7c3c6027cc292401bc0f4ec683","url":"https://git.kernel.org/stable/c/e13d315ae077bb7c3c6027cc292401bc0f4ec683"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b18a82503a67a530d48f5a5b429e162749fe2c89","label":"b18a82503a67","date":"2026-10-21T10:27:10+02:00","lore":["https://lore.kernel.org/r/35167.1760645886@localhost"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"e13d315ae077bb7c3c6027cc292401bc0f4ec683","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68251","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68251.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68174","title":"amd/amdkfd: enhance kfd process check in switch partition","status":"unfixed","project":false,"upstream":[{"sha":"45da20e00d5da842e17dfc633072b127504f0d0e","url":"https://git.kernel.org/stable/c/45da20e00d5da842e17dfc633072b127504f0d0e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"45da20e00d5da842e17dfc633072b127504f0d0e","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/45da20e00d5da842e17dfc633072b127504f0d0e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40355","title":"sysfs: check visibility before changing group attribute ownership","status":"unfixed","project":false,"upstream":[{"sha":"c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33","url":"https://git.kernel.org/stable/c/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40354","title":"drm/amd/display: increase max link count and fix link->enc NULL pointer access","status":"not-applicable","project":false,"upstream":[{"sha":"bec947cbe9a65783adb475a5fb47980d7b4f4796","url":"https://git.kernel.org/stable/c/bec947cbe9a65783adb475a5fb47980d7b4f4796"}],"evidence":[],"submission_lore":[],"basis":"The targets lack DCN401 and the 14-link MAX_LINKS configuration changed upstream; neither the overflow configuration nor the dcn401 NULL link encoder path exists.","review":{"id":"CVE-2025-40354","series":"6.6.y","upstream":["bec947cbe9a65783adb475a5fb47980d7b4f4796"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The targets lack DCN401 and the 14-link MAX_LINKS configuration changed upstream; neither the overflow configuration nor the dcn401 NULL link encoder path exists.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"bec947cbe9a65783adb475a5fb47980d7b4f4796","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/bec947cbe9a65783adb475a5fb47980d7b4f4796.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40354","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40354.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40339","title":"drm/amdgpu: fix nullptr err of vm_handle_moved","status":"not-applicable","project":false,"upstream":[{"sha":"859958a7faefe5b7742b7b8cdbc170713d4bf158","url":"https://git.kernel.org/stable/c/859958a7faefe5b7742b7b8cdbc170713d4bf158"}],"evidence":[],"submission_lore":[],"basis":"Neither target restore_process_bos() calls amdgpu_vm_handle_moved(); the later NULL-BO PRT dereference path fixed upstream is absent.","review":{"id":"CVE-2025-40339","series":"6.6.y","upstream":["859958a7faefe5b7742b7b8cdbc170713d4bf158"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"Neither target restore_process_bos() calls amdgpu_vm_handle_moved(); the later NULL-BO PRT dereference path fixed upstream is absent.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"859958a7faefe5b7742b7b8cdbc170713d4bf158","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/859958a7faefe5b7742b7b8cdbc170713d4bf158.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40339","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40339.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40333","title":"f2fs: fix infinite loop in __insert_extent_tree()","status":"backported","project":false,"upstream":[{"sha":"23361bd54966b437e1ed3eb1a704572f4b279e58","url":"https://git.kernel.org/stable/c/23361bd54966b437e1ed3eb1a704572f4b279e58"}],"evidence":[{"url":"https://git.kernel.org/stable/c/765f8816d3959ef1f3f7f85e2af748594d091f40","label":"765f8816d395","date":"2025-11-24T10:29:40+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"23361bd54966b437e1ed3eb1a704572f4b279e58","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/23361bd54966b437e1ed3eb1a704572f4b279e58.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40311","title":"accel/habanalabs: support mapping cb with vmalloc-backed coherent memory","status":"backported","project":false,"upstream":[{"sha":"513024d5a0e34fd34247043f1876b6138ca52847","url":"https://git.kernel.org/stable/c/513024d5a0e34fd34247043f1876b6138ca52847"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7ec8ac9f73d4a9438c2186768d6de27ace37531e","label":"7ec8ac9f73d4","date":"2025-11-24T10:29:44+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"513024d5a0e34fd34247043f1876b6138ca52847","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40311","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40311.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40303","title":"btrfs: ensure no dirty metadata is written back for an fs with errors","status":"backported","project":false,"upstream":[{"sha":"2618849f31e7cf51fadd4a5242458501a6d5b315","url":"https://git.kernel.org/stable/c/2618849f31e7cf51fadd4a5242458501a6d5b315"}],"evidence":[{"url":"https://git.kernel.org/stable/c/066ee13f05fbd82ada01883e51f0695172f98dff","label":"066ee13f05fb","date":"2025-11-24T10:30:10+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2618849f31e7cf51fadd4a5242458501a6d5b315","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/2618849f31e7cf51fadd4a5242458501a6d5b315.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40303","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40303.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40266","title":"KVM: arm64: Check the untrusted offset in FF-A memory share","status":"backported","project":false,"upstream":[{"sha":"103e17aac09cdd358133f9e00998b75d6c1f1518","url":"https://git.kernel.org/stable/c/103e17aac09cdd358133f9e00998b75d6c1f1518"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fc3139d9f4c1fe1c7d5f25f99676bd8e9c6a1041","label":"fc3139d9f4c1","date":"2025-12-01T11:41:52+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"103e17aac09cdd358133f9e00998b75d6c1f1518","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/103e17aac09cdd358133f9e00998b75d6c1f1518.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40266","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40266.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40247","title":"drm/msm: Fix pgtable prealloc error path","status":"unfixed","project":false,"upstream":[{"sha":"830d68f2cb8ab6fb798bb9555016709a9e012af0","url":"https://git.kernel.org/stable/c/830d68f2cb8ab6fb798bb9555016709a9e012af0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"830d68f2cb8ab6fb798bb9555016709a9e012af0","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/830d68f2cb8ab6fb798bb9555016709a9e012af0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40247","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40247.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40217","title":"pidfs: validate extensible ioctls","status":"not-applicable","project":false,"upstream":[{"sha":"3c17001b21b9f168c957ced9384abe969019b609","url":"https://git.kernel.org/stable/c/3c17001b21b9f168c957ced9384abe969019b609"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"3c17001b21b9f168c957ced9384abe969019b609","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/3c17001b21b9f168c957ced9384abe969019b609.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40168","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().","status":"backported","project":false,"upstream":[{"sha":"235f81045c008169cc4e1955b4a64e118eebe61b","url":"https://git.kernel.org/stable/c/235f81045c008169cc4e1955b4a64e118eebe61b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4f5f52a5842937f945582a93cb9daed9ea526fee","label":"4f5f52a58429","date":"2026-09-02T14:29:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"235f81045c008169cc4e1955b4a64e118eebe61b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40168","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40168.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40146","title":"blk-mq: fix potential deadlock while nr_requests grown","status":"unfixed","project":false,"upstream":[{"sha":"b86433721f46d934940528f28d49c1dedb690df1","url":"https://git.kernel.org/stable/c/b86433721f46d934940528f28d49c1dedb690df1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"b86433721f46d934940528f28d49c1dedb690df1","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/b86433721f46d934940528f28d49c1dedb690df1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40146","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40146.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40139","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().","status":"backported","project":false,"upstream":[{"sha":"935d783e5de9b64587f3adb25641dd8385e64ddb","url":"https://git.kernel.org/stable/c/935d783e5de9b64587f3adb25641dd8385e64ddb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/80d1fd39f4e37d836655e9f7ffccaf78925049bf","label":"80d1fd39f4e3","date":"2026-09-02T14:29:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"935d783e5de9b64587f3adb25641dd8385e64ddb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40139","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40139.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40102","title":"KVM: arm64: Prevent access to vCPU events before init","status":"backported","project":false,"upstream":[{"sha":"0aa1b76fe1429629215a7c79820e4b96233ac4a3","url":"https://git.kernel.org/stable/c/0aa1b76fe1429629215a7c79820e4b96233ac4a3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7b854e68365a84dfa984ee81268e10b9311ac9d2","label":"7b854e68365a","date":"2026-09-02T14:29:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0aa1b76fe1429629215a7c79820e4b96233ac4a3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40079","title":"riscv, bpf: Sign extend struct ops return values properly","status":"unfixed","project":false,"upstream":[{"sha":"fd2e08128944a7679e753f920e9eda72057e427c","url":"https://git.kernel.org/stable/c/fd2e08128944a7679e753f920e9eda72057e427c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd2e08128944a7679e753f920e9eda72057e427c","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/fd2e08128944a7679e753f920e9eda72057e427c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40064","title":"smc: Fix use-after-free in __pnet_find_base_ndev().","status":"backported","project":false,"upstream":[{"sha":"3d3466878afd8d43ec0ca2facfbc7f03e40d0f79","url":"https://git.kernel.org/stable/c/3d3466878afd8d43ec0ca2facfbc7f03e40d0f79"}],"evidence":[{"url":"https://git.kernel.org/stable/c/302dbed4760bcd19a661cc1c282d91bb7481307e","label":"302dbed4760b","date":"2026-09-02T14:29:17+02:00","lore":["https://lore.kernel.org/netdev/68c237c7.050a0220.3c6139.0036.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3d3466878afd8d43ec0ca2facfbc7f03e40d0f79","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40064","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40064.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40025","title":"f2fs: fix to do sanity check on node footer for non inode dnode","status":"unfixed","project":false,"upstream":[{"sha":"c18ecd99e0c707ef8f83cace861cbc3162f4fdf1","url":"https://git.kernel.org/stable/c/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c18ecd99e0c707ef8f83cace861cbc3162f4fdf1","lines":144,"reason":"","source":"https://github.com/torvalds/linux/commit/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40025","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40025.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40000","title":"wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()","status":"unfixed","project":false,"upstream":[{"sha":"3e31a6bc07312b448fad3b45de578471f86f0e77","url":"https://git.kernel.org/stable/c/3e31a6bc07312b448fad3b45de578471f86f0e77"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3e31a6bc07312b448fad3b45de578471f86f0e77","lines":172,"reason":"","source":"https://github.com/torvalds/linux/commit/3e31a6bc07312b448fad3b45de578471f86f0e77.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40000","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40000.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39990","title":"bpf: Check the helper function is valid in get_helper_proto","status":"backported","project":false,"upstream":[{"sha":"e4414b01c1cd9887bbde92f946c1ba94e40d6d64","url":"https://git.kernel.org/stable/c/e4414b01c1cd9887bbde92f946c1ba94e40d6d64"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dfbff47f120e4b0793ca0e0b8660361ccac25a74","label":"dfbff47f120e","date":"2026-10-21T10:27:36+02:00","lore":["https://lore.kernel.org/bpf/20250814200655.945632-1-jolsa@kernel.org","https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e4414b01c1cd9887bbde92f946c1ba94e40d6d64","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/e4414b01c1cd9887bbde92f946c1ba94e40d6d64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39981","title":"Bluetooth: MGMT: Fix possible UAFs","status":"backported","project":false,"upstream":[{"sha":"302a1f674c00dd5581ab8e493ef44767c5101aab","url":"https://git.kernel.org/stable/c/302a1f674c00dd5581ab8e493ef44767c5101aab"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a","label":"0b60eb04b852","date":"2026-05-17T17:13:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"302a1f674c00dd5581ab8e493ef44767c5101aab","lines":615,"reason":"","source":"https://github.com/torvalds/linux/commit/302a1f674c00dd5581ab8e493ef44767c5101aab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39981","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39981.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39961","title":"iommu/amd/pgtbl: Fix possible race while increase page table level","status":"backported","project":false,"upstream":[{"sha":"1e56310b40fd2e7e0b9493da9ff488af145bdd0c","url":"https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/075abf0b1a958acfbea2435003d228e738e90346","label":"075abf0b1a95","date":"2025-09-25T11:00:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1e56310b40fd2e7e0b9493da9ff488af145bdd0c","lines":76,"reason":"","source":"https://github.com/torvalds/linux/commit/1e56310b40fd2e7e0b9493da9ff488af145bdd0c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39947","title":"net/mlx5e: Harden uplink netdev access against device unbind","status":"backported","project":false,"upstream":[{"sha":"6b4be64fd9fec16418f365c2d8e47a7566e9eba5","url":"https://git.kernel.org/stable/c/6b4be64fd9fec16418f365c2d8e47a7566e9eba5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2cb17c88edd3a1c7aa6bc880dcdb35a6866fcb2e","label":"2cb17c88edd3","date":"2025-09-25T11:00:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6b4be64fd9fec16418f365c2d8e47a7566e9eba5","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/6b4be64fd9fec16418f365c2d8e47a7566e9eba5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39940","title":"dm-stripe: fix a possible integer overflow","status":"backported","project":false,"upstream":[{"sha":"1071d560afb4c245c2076494226df47db5a35708","url":"https://git.kernel.org/stable/c/1071d560afb4c245c2076494226df47db5a35708"}],"evidence":[{"url":"https://git.kernel.org/stable/c/891ab8c6954199e4f36029b49df86c8b1d6b0b2f","label":"891ab8c69541","date":"2026-10-21T10:27:36+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1071d560afb4c245c2076494226df47db5a35708","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/1071d560afb4c245c2076494226df47db5a35708.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39940","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39940.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39932","title":"smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)","status":"unfixed","project":false,"upstream":[{"sha":"d9dcbbcf9145b68aa85c40947311a6907277e097","url":"https://git.kernel.org/stable/c/d9dcbbcf9145b68aa85c40947311a6907277e097"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d9dcbbcf9145b68aa85c40947311a6907277e097","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d9dcbbcf9145b68aa85c40947311a6907277e097.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39927","title":"ceph: fix race condition validating r_parent before applying state","status":"backported","project":false,"upstream":[{"sha":"15f519e9f883b316d86e2bb6b767a023aafd9d83","url":"https://git.kernel.org/stable/c/15f519e9f883b316d86e2bb6b767a023aafd9d83"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dc5aad078abc416dd3d555c50f5308c16ba918a7","label":"dc5aad078abc","date":"2026-10-21T10:27:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"15f519e9f883b316d86e2bb6b767a023aafd9d83","lines":556,"reason":"","source":"https://github.com/torvalds/linux/commit/15f519e9f883b316d86e2bb6b767a023aafd9d83.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39927","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39927.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39925","title":"can: j1939: implement NETDEV_UNREGISTER notification handler","status":"backported","project":false,"upstream":[{"sha":"7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a","url":"https://git.kernel.org/stable/c/7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/76957b618ce729c3bd1e782fbc9d9991af653925","label":"76957b618ce7","date":"2026-09-02T14:29:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39925","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39925.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39862","title":"wifi: mt76: mt7915: fix list corruption after hardware restart","status":"backported","project":false,"upstream":[{"sha":"065c79df595af21d6d1b27d642860faa1d938774","url":"https://git.kernel.org/stable/c/065c79df595af21d6d1b27d642860faa1d938774"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6d40c15d70c2dba2f68dd50e452255bfa1b016f0","label":"6d40c15d70c2","date":"2026-10-21T10:27:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"065c79df595af21d6d1b27d642860faa1d938774","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/065c79df595af21d6d1b27d642860faa1d938774.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39834","title":"net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow","status":"not-applicable","project":false,"upstream":[{"sha":"a630f83592cdad1253523a1b760cfe78fef6cd9c","url":"https://git.kernel.org/stable/c/a630f83592cdad1253523a1b760cfe78fef6cd9c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"a630f83592cdad1253523a1b760cfe78fef6cd9c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/a630f83592cdad1253523a1b760cfe78fef6cd9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39833","title":"mISDN: hfcpci: Fix warning when deleting uninitialized timer","status":"backported","project":false,"upstream":[{"sha":"97766512a9951b9fd6fc97f1b93211642bb0b220","url":"https://git.kernel.org/stable/c/97766512a9951b9fd6fc97f1b93211642bb0b220"}],"evidence":[{"url":"https://git.kernel.org/stable/c/75194165e65018c581b128379b91b0b2d64638d9","label":"75194165e650","date":"2026-09-02T14:29:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"97766512a9951b9fd6fc97f1b93211642bb0b220","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39833","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39833.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39830","title":"net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path","status":"not-applicable","project":false,"upstream":[{"sha":"2c0a959bebdc1ada13cf9a8242f177c5400299e6","url":"https://git.kernel.org/stable/c/2c0a959bebdc1ada13cf9a8242f177c5400299e6"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c0a959bebdc1ada13cf9a8242f177c5400299e6","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/2c0a959bebdc1ada13cf9a8242f177c5400299e6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39830","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39830.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39822","title":"io_uring/kbuf: fix signedness in this_len calculation","status":"not-applicable","project":false,"upstream":[{"sha":"c64eff368ac676e8540344d27a3de47e0ad90d21","url":"https://git.kernel.org/stable/c/c64eff368ac676e8540344d27a3de47e0ad90d21"},{"sha":"c4dbca5be33c6203d2f611dbd7502f887e4cd954","url":"https://git.kernel.org/stable/c/c4dbca5be33c6203d2f611dbd7502f887e4cd954"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"c64eff368ac676e8540344d27a3de47e0ad90d21","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/c64eff368ac676e8540344d27a3de47e0ad90d21.patch"},{"sha":"c4dbca5be33c6203d2f611dbd7502f887e4cd954","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/c4dbca5be33c6203d2f611dbd7502f887e4cd954.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39822","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39822.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39789","title":"crypto: x86/aegis - Add missing error checks","status":"backported","project":false,"upstream":[{"sha":"3d9eb180fbe8828cce43bce4c370124685b205c3","url":"https://git.kernel.org/stable/c/3d9eb180fbe8828cce43bce4c370124685b205c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/74d3b91f1598eedf87a977702f9f55e32698206d","label":"74d3b91f1598","date":"2026-10-21T10:27:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3d9eb180fbe8828cce43bce4c370124685b205c3","lines":97,"reason":"","source":"https://github.com/torvalds/linux/commit/3d9eb180fbe8828cce43bce4c370124685b205c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39789","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39789.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39779","title":"btrfs: subpage: keep TOWRITE tag until folio is cleaned","status":"not-applicable","project":false,"upstream":[{"sha":"b1511360c8ac882b0c52caa263620538e8d73220","url":"https://git.kernel.org/stable/c/b1511360c8ac882b0c52caa263620538e8d73220"}],"evidence":[],"submission_lore":[],"basis":"The upstream stable qualifier is 6.12+ and the affected subpage writeback implementation is not present in these forms on 6.1/6.6; do not transplant the folio-tag logic.","review":{"id":"CVE-2025-39779","series":"6.6.y","upstream":["b1511360c8ac882b0c52caa263620538e8d73220"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The upstream stable qualifier is 6.12+ and the affected subpage writeback implementation is not present in these forms on 6.1/6.6; do not transplant the folio-tag logic.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"b1511360c8ac882b0c52caa263620538e8d73220","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/b1511360c8ac882b0c52caa263620538e8d73220.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39779","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39779.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39775","title":"mm/mremap: fix WARN with uffd that has remap events disabled","status":"unfixed","project":false,"upstream":[{"sha":"772e5b4a5e8360743645b9a466842d16092c4f94","url":"https://git.kernel.org/stable/c/772e5b4a5e8360743645b9a466842d16092c4f94"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"772e5b4a5e8360743645b9a466842d16092c4f94","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/772e5b4a5e8360743645b9a466842d16092c4f94.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39762","title":"drm/amd/display: add null check","status":"unfixed","project":false,"upstream":[{"sha":"158b9201c17fc93ed4253c2f03b77fd2671669a1","url":"https://git.kernel.org/stable/c/158b9201c17fc93ed4253c2f03b77fd2671669a1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"158b9201c17fc93ed4253c2f03b77fd2671669a1","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/158b9201c17fc93ed4253c2f03b77fd2671669a1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39747","title":"drm/msm: Add error handling for krealloc in metadata setup","status":"not-applicable","project":false,"upstream":[{"sha":"1c8c354098ea9d4376a58c96ae6b65288a6f15d8","url":"https://git.kernel.org/stable/c/1c8c354098ea9d4376a58c96ae6b65288a6f15d8"}],"evidence":[],"submission_lore":[],"basis":"msm_ioctl_gem_info_set_metadata() is absent from both targets, so the vulnerable krealloc assignment is not present and a backport would have no security effect.","review":{"id":"CVE-2025-39747","series":"6.6.y","upstream":["1c8c354098ea9d4376a58c96ae6b65288a6f15d8"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"msm_ioctl_gem_info_set_metadata() is absent from both targets, so the vulnerable krealloc assignment is not present and a backport would have no security effect.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"1c8c354098ea9d4376a58c96ae6b65288a6f15d8","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/1c8c354098ea9d4376a58c96ae6b65288a6f15d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39747","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39747.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39746","title":"wifi: ath10k: shutdown driver when hardware is unreliable","status":"unfixed","project":false,"upstream":[{"sha":"c256a94d1b1b15109740306f7f2a7c2173e12072","url":"https://git.kernel.org/stable/c/c256a94d1b1b15109740306f7f2a7c2173e12072"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c256a94d1b1b15109740306f7f2a7c2173e12072","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/c256a94d1b1b15109740306f7f2a7c2173e12072.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39746","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39746.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39732","title":"wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()","status":"backported","project":false,"upstream":[{"sha":"65c12b104cb942d588a1a093acc4537fb3d3b129","url":"https://git.kernel.org/stable/c/65c12b104cb942d588a1a093acc4537fb3d3b129"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1f45a710c82b29d4c501b1cb472dff68d59ecc8c","label":"1f45a710c82b","date":"2026-10-21T10:27:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"65c12b104cb942d588a1a093acc4537fb3d3b129","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/65c12b104cb942d588a1a093acc4537fb3d3b129.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39732","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39732.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39707","title":"drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities","status":"not-applicable","project":false,"upstream":[{"sha":"b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288","url":"https://git.kernel.org/stable/c/b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288"}],"evidence":[],"submission_lore":[],"basis":"No effect: the amdgpu_dm_capabilities capabilities_show() path and its hubbub dereference are absent from both targets. None; adding the newer debugfs feature is not a vulnerability backport. The reported NULL dereference is unreachable without the later debugfs implementation.","review":{"id":"CVE-2025-39707","series":"6.6.y","upstream":["b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"No effect: the amdgpu_dm_capabilities capabilities_show() path and its hubbub dereference are absent from both targets. None; adding the newer debugfs feature is not a vulnerability backport. The reported NULL dereference is unreachable without the later debugfs implementation.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39707","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39707.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38722","title":"habanalabs: fix UAF in export_dmabuf()","status":"backported","project":false,"upstream":[{"sha":"33927f3d0ecdcff06326d6e4edb6166aed42811c","url":"https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d26058c2349d77d1ef179a2cc9752ca12004b6ff","label":"d26058c2349d","date":"2026-10-21T10:27:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"33927f3d0ecdcff06326d6e4edb6166aed42811c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38722","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38722.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38717","title":"net: kcm: Fix race condition in kcm_unattach()","status":"unfixed","project":false,"upstream":[{"sha":"52565a935213cd6a8662ddb8efe5b4219343a25d","url":"https://git.kernel.org/stable/c/52565a935213cd6a8662ddb8efe5b4219343a25d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"52565a935213cd6a8662ddb8efe5b4219343a25d","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/52565a935213cd6a8662ddb8efe5b4219343a25d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38717","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38717.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38716","title":"hfs: fix general protection fault in hfs_find_init()","status":"backported","project":false,"upstream":[{"sha":"736a0516a16268995f4898eded49bfef077af709","url":"https://git.kernel.org/stable/c/736a0516a16268995f4898eded49bfef077af709"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4f032979b63ad52e08aadf0faeac34ed35133ec0","label":"4f032979b63a","date":"2025-08-28T16:28:14+02:00","lore":["https://lore.kernel.org/r/20250710213657.108285-1-slava@dubeyko.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"736a0516a16268995f4898eded49bfef077af709","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/736a0516a16268995f4898eded49bfef077af709.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38716","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38716.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38675","title":"xfrm: state: initialize state_ptrs earlier in xfrm_state_find","status":"not-applicable","project":false,"upstream":[{"sha":"94d077c331730510d5611b438640a292097341f0","url":"https://git.kernel.org/stable/c/94d077c331730510d5611b438640a292097341f0"}],"evidence":[],"submission_lore":[],"basis":"6.6 lacks the later per-CPU state-cache traversal and pcpu_id path that can jump to found before xfrm_hash_ptrs_get(); it initializes state_ptrs immediately after rcu_read_lock before first use. Moving the existing initialization has no semantic effect and cannot fix a path absent from 6.6.","review":{"id":"CVE-2025-38675","series":"6.6.y","upstream":["94d077c331730510d5611b438640a292097341f0"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"no-op","applicability":"unaffected","reason":"6.6 lacks the later per-CPU state-cache traversal and pcpu_id path that can jump to found before xfrm_hash_ptrs_get(); it initializes state_ptrs immediately after rcu_read_lock before first use. Moving the existing initialization has no semantic effect and cannot fix a path absent from 6.6.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"94d077c331730510d5611b438640a292097341f0","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/94d077c331730510d5611b438640a292097341f0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38675","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38675.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38660","title":"[ceph] parse_longname(): strrchr() expects NUL-terminated string","status":"backported","project":true,"upstream":[{"sha":"101841c38346f4ca41dc1802c867da990ffb32eb","url":"https://git.kernel.org/stable/c/101841c38346f4ca41dc1802c867da990ffb32eb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4b9aee707c4580511983a0998547f3b28514e6a6","label":"4b9aee707c45","date":"2026-09-14T13:28:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"101841c38346f4ca41dc1802c867da990ffb32eb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38660","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38660.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38656","title":"wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()","status":"backported","project":false,"upstream":[{"sha":"cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6","url":"https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5c432da1ee191e9f7830dd516456706063d7bec3","label":"5c432da1ee19","date":"2026-10-21T10:27:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38656","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38656.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38636","title":"rv: Use strings in da monitors tracepoints","status":"backported","project":false,"upstream":[{"sha":"7f904ff6e58d398c4336f3c19c42b338324451f7","url":"https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dcae71222c8b9e5b5dd88a2d67347dedf10e68c6","label":"dcae71222c8b","date":"2026-10-21T10:27:34+02:00","lore":["https://lore.kernel.org/20250728135022.255578-4-gmonaco@redhat.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2025-38636","series":"6.6.y","upstream":["7f904ff6e58d398c4336f3c19c42b338324451f7"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"DA trace classes use fixed __array plus MAX_DA_NAME_LEN memcpy","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: include/trace/events/rv.h","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/trace/events/rv.h?id=79643295eba17affbd16ca97f3ef04c90266b28c"},{"label":"Upstream fix 7f904ff6e58d","url":"https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7"}]},"size":{"status":"unknown","patches":[{"sha":"7f904ff6e58d398c4336f3c19c42b338324451f7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38636","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38636.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38621","title":"md: make rdev_addable usable for rcu mode","status":"not-applicable","project":false,"upstream":[{"sha":"13017b427118f4311471ee47df74872372ca8482","url":"https://git.kernel.org/stable/c/13017b427118f4311471ee47df74872372ca8482"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"13017b427118f4311471ee47df74872372ca8482","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38621","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38621.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38616","title":"tls: handle data disappearing from under the TLS ULP","status":"backported","project":false,"upstream":[{"sha":"6db015fc4b5d5f63a64a193f65d98da3a7fc811d","url":"https://git.kernel.org/stable/c/6db015fc4b5d5f63a64a193f65d98da3a7fc811d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f1fe99919f629f980d0b8a7ff16950bffe06a859","label":"f1fe99919f62","date":"2025-08-28T16:28:14+02:00","lore":["https://lore.kernel.org/tFjq_kf7sWIG3A7CrCg_egb8CVsT_gsmHAK0_wxDPJXfIzxFAMxqmLwp3MlU5EHiet0AwwJldaaFdgyHpeIUCS-3m3llsmRzp9xIOBR4lAI=@syst3mfailure.io"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6db015fc4b5d5f63a64a193f65d98da3a7fc811d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38616","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38616.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38591","title":"bpf: Reject narrower access to pointer ctx fields","status":"backported","project":true,"upstream":[{"sha":"e09299225d5ba3916c91ef70565f7d2187e4cca0","url":"https://git.kernel.org/stable/c/e09299225d5ba3916c91ef70565f7d2187e4cca0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e2e9599f3503df7cf3569d2b6c50d5488fb59435","label":"e2e9599f3503","date":"2026-09-14T13:28:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e09299225d5ba3916c91ef70565f7d2187e4cca0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38585","title":"staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()","status":"unfixed","project":false,"upstream":[{"sha":"ee4cf798202d285dcbe85e4467a094c44f5ed8e6","url":"https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","url":"https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ee4cf798202d285dcbe85e4467a094c44f5ed8e6","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/ee4cf798202d285dcbe85e4467a094c44f5ed8e6.patch"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","lines":168072,"reason":"","source":"https://github.com/torvalds/linux/commit/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38585","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38585.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38449","title":"drm/gem: Acquire references on GEM handles for framebuffers","status":"backported","project":false,"upstream":[{"sha":"5307dce878d4126e1b375587318955bd019c3741","url":"https://git.kernel.org/stable/c/5307dce878d4126e1b375587318955bd019c3741"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cb4c956a15f8b7f870649454771fc3761f504b5f","label":"cb4c956a15f8","date":"2025-07-17T18:35:13+02:00","lore":["https://lore.kernel.org/r/20250630084001.293053-1-tzimmermann@suse.de"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"5307dce878d4126e1b375587318955bd019c3741","lines":122,"reason":"","source":"https://github.com/torvalds/linux/commit/5307dce878d4126e1b375587318955bd019c3741.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38438","title":"ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.","status":"not-applicable","project":false,"upstream":[{"sha":"6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e","url":"https://git.kernel.org/stable/c/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e"}],"evidence":[],"submission_lore":[],"basis":"The leaking remove_file_ext() helper changed by upstream is absent; the targets' similarly named fixup path frees its temporary kstrdup(), so transplanting the patch would be a no-op/misbackport.","review":{"id":"CVE-2025-38438","series":"6.6.y","upstream":["6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"no-op","applicability":"unaffected","reason":"The leaking remove_file_ext() helper changed by upstream is absent; the targets' similarly named fixup path frees its temporary kstrdup(), so transplanting the patch would be a no-op/misbackport.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38438","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38438.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38426","title":"drm/amdgpu: Add basic validation for RAS header","status":"backported","project":false,"upstream":[{"sha":"5df0d6addb7e9b6f71f7162d1253762a5be9138e","url":"https://git.kernel.org/stable/c/5df0d6addb7e9b6f71f7162d1253762a5be9138e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e1903358b2152f5d64a83e796bb776aba0d3628d","label":"e1903358b215","date":"2026-03-25T11:06:00+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5df0d6addb7e9b6f71f7162d1253762a5be9138e","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/5df0d6addb7e9b6f71f7162d1253762a5be9138e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38426","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38426.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38372","title":"RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling","status":"unfixed","project":false,"upstream":[{"sha":"2c6b640ea08bff1a192bf87fa45246ff1e40767c","url":"https://git.kernel.org/stable/c/2c6b640ea08bff1a192bf87fa45246ff1e40767c"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c6b640ea08bff1a192bf87fa45246ff1e40767c","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/2c6b640ea08bff1a192bf87fa45246ff1e40767c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38372","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38372.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38369","title":"dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using","status":"backported","project":false,"upstream":[{"sha":"17502e7d7b7113346296f6758324798d536c31fd","url":"https://git.kernel.org/stable/c/17502e7d7b7113346296f6758324798d536c31fd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e0051a3daa8b2cb318b03b2f9317c3e40855847a","label":"e0051a3daa8b","date":"2025-07-06T11:00:06+02:00","lore":["https://lore.kernel.org/r/20250509000304.1402863-1-yi.sun@intel.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"17502e7d7b7113346296f6758324798d536c31fd","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/17502e7d7b7113346296f6758324798d536c31fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38369","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38369.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38333","title":"f2fs: fix to bail out in get_new_segment()","status":"unfixed","project":false,"upstream":[{"sha":"bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2","url":"https://git.kernel.org/stable/c/bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38311","title":"iavf: get rid of the crit lock","status":"unfixed","project":false,"upstream":[{"sha":"120f28a6f314fef7f282c99f196923fe44081cad","url":"https://git.kernel.org/stable/c/120f28a6f314fef7f282c99f196923fe44081cad"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"120f28a6f314fef7f282c99f196923fe44081cad","lines":513,"reason":"","source":"https://github.com/torvalds/linux/commit/120f28a6f314fef7f282c99f196923fe44081cad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38311","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38311.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38264","title":"nvme-tcp: sanitize request list handling","status":"backported","project":true,"upstream":[{"sha":"0bf04c874fcb1ae46a863034296e4b33d8fbd66c","url":"https://git.kernel.org/stable/c/0bf04c874fcb1ae46a863034296e4b33d8fbd66c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8f27d152b2a59f443091cf9e3d815f06e32e9b96","label":"8f27d152b2a5","date":"2026-10-21T10:27:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0bf04c874fcb1ae46a863034296e4b33d8fbd66c","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/0bf04c874fcb1ae46a863034296e4b33d8fbd66c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38264","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38264.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38237","title":"media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()","status":"backported","project":false,"upstream":[{"sha":"bd9f6ce7d512fa21249415c16af801a4ed5d97b6","url":"https://git.kernel.org/stable/c/bd9f6ce7d512fa21249415c16af801a4ed5d97b6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/71209954f1e8ff0f0ba944c8d3b64bbed83d400c","label":"71209954f1e8","date":"2026-09-02T14:29:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"bd9f6ce7d512fa21249415c16af801a4ed5d97b6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38207","title":"mm: fix uprobe pte be overwritten when expanding vma","status":"unfixed","project":false,"upstream":[{"sha":"2b12d06c37fd3a394376f42f026a7478d826ed63","url":"https://git.kernel.org/stable/c/2b12d06c37fd3a394376f42f026a7478d826ed63"}],"evidence":[],"submission_lore":[],"basis":"copy_vma and merge paths call uprobe_mmap without copied-VMA skip","review":{"id":"CVE-2025-38207","series":"6.6.y","upstream":["2b12d06c37fd3a394376f42f026a7478d826ed63"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"copy_vma and merge paths call uprobe_mmap without copied-VMA skip","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: mm/mmap.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/mm/mmap.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n3384"},{"label":"Upstream fix 2b12d06c37fd","url":"https://git.kernel.org/stable/c/2b12d06c37fd3a394376f42f026a7478d826ed63"}]},"size":{"status":"within-limit","patches":[{"sha":"2b12d06c37fd3a394376f42f026a7478d826ed63","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/2b12d06c37fd3a394376f42f026a7478d826ed63.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38207","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38207.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38206","title":"exfat: fix double free in delayed_free","status":"backported","project":false,"upstream":[{"sha":"1f3d9724e16d62c7d42c67d6613b8512f2887c22","url":"https://git.kernel.org/stable/c/1f3d9724e16d62c7d42c67d6613b8512f2887c22"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ac65f76db9b2ff3fbc9e198c0e9aaf81b111b7d0","label":"ac65f76db9b2","date":"2026-09-02T14:29:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1f3d9724e16d62c7d42c67d6613b8512f2887c22","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38206","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38206.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38205","title":"drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1","status":"not-applicable","project":false,"upstream":[{"sha":"7e40f64896e8e3dca471e287672db5ace12ea0be","url":"https://git.kernel.org/stable/c/7e40f64896e8e3dca471e287672db5ace12ea0be"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"7e40f64896e8e3dca471e287672db5ace12ea0be","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38205","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38205.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38203","title":"jfs: Fix null-ptr-deref in jfs_ioc_trim","status":"backported","project":false,"upstream":[{"sha":"a4685408ff6c3e2af366ad9a7274f45ff3f394ee","url":"https://git.kernel.org/stable/c/a4685408ff6c3e2af366ad9a7274f45ff3f394ee"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a39f811a9f5edb6d97bede8e6fe730393d3c8537","label":"a39f811a9f5e","date":"2026-09-02T14:29:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a4685408ff6c3e2af366ad9a7274f45ff3f394ee","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38203","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38203.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38199","title":"wifi: ath12k: Fix memory leak due to multiple rx_stats allocation","status":"unfixed","project":false,"upstream":[{"sha":"c426497fa2055c8005196922e7d29c41d7e0948a","url":"https://git.kernel.org/stable/c/c426497fa2055c8005196922e7d29c41d7e0948a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c426497fa2055c8005196922e7d29c41d7e0948a","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/c426497fa2055c8005196922e7d29c41d7e0948a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38199","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38199.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38187","title":"drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()","status":"not-applicable","project":false,"upstream":[{"sha":"9802f0a63b641f4cddb2139c814c2e95cb825099","url":"https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"9802f0a63b641f4cddb2139c814c2e95cb825099","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/9802f0a63b641f4cddb2139c814c2e95cb825099.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38187","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38187.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38140","title":"dm: limit swapping tables for devices with zone write plugs","status":"unfixed","project":false,"upstream":[{"sha":"121218bef4c1df165181f5cd8fc3a2246bac817e","url":"https://git.kernel.org/stable/c/121218bef4c1df165181f5cd8fc3a2246bac817e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"121218bef4c1df165181f5cd8fc3a2246bac817e","lines":166,"reason":"","source":"https://github.com/torvalds/linux/commit/121218bef4c1df165181f5cd8fc3a2246bac817e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38140","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38140.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38137","title":"PCI/pwrctrl: Cancel outstanding rescan work when unregistering","status":"not-applicable","project":false,"upstream":[{"sha":"8b926f237743f020518162c62b93cb7107a2b5eb","url":"https://git.kernel.org/stable/c/8b926f237743f020518162c62b93cb7107a2b5eb"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"8b926f237743f020518162c62b93cb7107a2b5eb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/8b926f237743f020518162c62b93cb7107a2b5eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38080","title":"drm/amd/display: Increase block_sequence array size","status":"backported","project":false,"upstream":[{"sha":"3a7810c212bcf2f722671dadf4b23ff70a7d23ee","url":"https://git.kernel.org/stable/c/3a7810c212bcf2f722671dadf4b23ff70a7d23ee"}],"evidence":[{"url":"https://git.kernel.org/stable/c/de67e80ab48f1f23663831007a2fa3c1471a7757","label":"de67e80ab48f","date":"2025-06-04T14:42:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a7810c212bcf2f722671dadf4b23ff70a7d23ee","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3a7810c212bcf2f722671dadf4b23ff70a7d23ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38080","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38080.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38039","title":"net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled","status":"backported","project":false,"upstream":[{"sha":"689805dcc474c2accb5cffbbcea1c06ee4a54570","url":"https://git.kernel.org/stable/c/689805dcc474c2accb5cffbbcea1c06ee4a54570"}],"evidence":[{"url":"https://git.kernel.org/stable/c/090c0ba179eaf7b670e720aa054533756a43d565","label":"090c0ba179ea","date":"2025-06-04T14:42:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"689805dcc474c2accb5cffbbcea1c06ee4a54570","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/689805dcc474c2accb5cffbbcea1c06ee4a54570.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38039","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38039.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38038","title":"cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost","status":"not-applicable","project":false,"upstream":[{"sha":"db1cafc77aaaf871509da06f4a864e9af6d6791f","url":"https://git.kernel.org/stable/c/db1cafc77aaaf871509da06f4a864e9af6d6791f"}],"evidence":[],"submission_lore":[],"basis":"No effect: amd_pstate_set_boost() has no amd_pstate_driver_lock acquisition in either target. None; removing a nonexistent guard would be an effective no-op. The deadlocking lock arrangement was introduced after these implementations.","review":{"id":"CVE-2025-38038","series":"6.6.y","upstream":["db1cafc77aaaf871509da06f4a864e9af6d6791f"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"No effect: amd_pstate_set_boost() has no amd_pstate_driver_lock acquisition in either target. None; removing a nonexistent guard would be an effective no-op. The deadlocking lock arrangement was introduced after these implementations.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"db1cafc77aaaf871509da06f4a864e9af6d6791f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/db1cafc77aaaf871509da06f4a864e9af6d6791f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38038","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38038.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38036","title":"drm/xe/vf: Perform early GT MMIO initialization to read GMDID","status":"not-applicable","project":false,"upstream":[{"sha":"13265fe7426ec9ba5aa86baab913417ca361e8a4","url":"https://git.kernel.org/stable/c/13265fe7426ec9ba5aa86baab913417ca361e8a4"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"13265fe7426ec9ba5aa86baab913417ca361e8a4","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/13265fe7426ec9ba5aa86baab913417ca361e8a4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38036","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38036.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38014","title":"dmaengine: idxd: Refactor remove call with idxd_cleanup() helper","status":"backported","project":false,"upstream":[{"sha":"a409e919ca321cc0e28f8abf96fde299f0072a81","url":"https://git.kernel.org/stable/c/a409e919ca321cc0e28f8abf96fde299f0072a81"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d530dd65f6f3c04bbf141702ecccd70170ed04ad","label":"d530dd65f6f3","date":"2025-05-22T14:12:24+02:00","lore":["https://lore.kernel.org/r/20250404120217.48772-10-xueshuai@linux.alibaba.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a409e919ca321cc0e28f8abf96fde299f0072a81","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/a409e919ca321cc0e28f8abf96fde299f0072a81.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38014","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38014.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37907","title":"accel/ivpu: Fix locking order in ivpu_job_submit","status":"not-applicable","project":false,"upstream":[{"sha":"ab680dc6c78aa035e944ecc8c48a1caab9f39924","url":"https://git.kernel.org/stable/c/ab680dc6c78aa035e944ecc8c48a1caab9f39924"}],"evidence":[],"submission_lore":[],"basis":"6.6 has no submitted_jobs_lock, so the upstream submitted_jobs_lock/file_priv->lock ABBA ordering cannot occur.","review":{"id":"CVE-2025-37907","series":"6.6.y","upstream":["ab680dc6c78aa035e944ecc8c48a1caab9f39924"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"6.6 has no submitted_jobs_lock, so the upstream submitted_jobs_lock/file_priv->lock ABBA ordering cannot occur.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"ab680dc6c78aa035e944ecc8c48a1caab9f39924","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/ab680dc6c78aa035e944ecc8c48a1caab9f39924.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37907","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37907.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37880","title":"um: work around sched_yield not yielding in time-travel mode","status":"unfixed","project":false,"upstream":[{"sha":"887c5c12e80c8424bd471122d2e8b6b462e12874","url":"https://git.kernel.org/stable/c/887c5c12e80c8424bd471122d2e8b6b462e12874"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"887c5c12e80c8424bd471122d2e8b6b462e12874","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/887c5c12e80c8424bd471122d2e8b6b462e12874.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37880","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37880.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37870","title":"drm/amd/display: prevent hang on link training fail","status":"backported","project":false,"upstream":[{"sha":"8058061ed9d6bc259d1e678607b07d259342c08f","url":"https://git.kernel.org/stable/c/8058061ed9d6bc259d1e678607b07d259342c08f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/52cdc47cf6519e2912a34d29b7eeb3f10ca85efa","label":"52cdc47cf651","date":"2026-10-21T10:27:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2025-37870","series":"6.6.y","upstream":["8058061ed9d6bc259d1e678607b07d259342c08f"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"dcn20_enable_stream() calls enable_symclk32_se() in the HPO/128b path after link training without validating the link rate that can trigger the hang.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n2714"},{"label":"Upstream fix 8058061ed9d6","url":"https://git.kernel.org/stable/c/8058061ed9d6bc259d1e678607b07d259342c08f"}]},"size":{"status":"within-limit","patches":[{"sha":"8058061ed9d6bc259d1e678607b07d259342c08f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8058061ed9d6bc259d1e678607b07d259342c08f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37834","title":"mm/vmscan: don't try to reclaim hwpoison folio","status":"unfixed","project":false,"upstream":[{"sha":"1b0449544c6482179ac84530b61fc192a6527bfd","url":"https://git.kernel.org/stable/c/1b0449544c6482179ac84530b61fc192a6527bfd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1b0449544c6482179ac84530b61fc192a6527bfd","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/1b0449544c6482179ac84530b61fc192a6527bfd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37833","title":"net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads","status":"backported","project":true,"upstream":[{"sha":"fbb429ddff5c8e479edcc7dde5a542c9295944e6","url":"https://git.kernel.org/stable/c/fbb429ddff5c8e479edcc7dde5a542c9295944e6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0afd48b173bebd6d94769ba2c91bd7404b9eb3c9","label":"0afd48b173be","date":"2026-09-14T13:28:56+02:00","lore":["https://lore.kernel.org/all/20241117234843.19236-3-dullfire@yahoo.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fbb429ddff5c8e479edcc7dde5a542c9295944e6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37833","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37833.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37826","title":"scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()","status":"not-applicable","project":false,"upstream":[{"sha":"08a966a917fe3d92150fa3cc15793ad5e57051eb","url":"https://git.kernel.org/stable/c/08a966a917fe3d92150fa3cc15793ad5e57051eb"}],"evidence":[],"submission_lore":[],"basis":"6.6 computes hwq directly as &hba->uhq[hwq_num]; it does not call the nullable ufshcd_mcq_req_to_hwq() operation guarded upstream.","review":{"id":"CVE-2025-37826","series":"6.6.y","upstream":["08a966a917fe3d92150fa3cc15793ad5e57051eb"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"6.6 computes hwq directly as &hba->uhq[hwq_num]; it does not call the nullable ufshcd_mcq_req_to_hwq() operation guarded upstream.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"08a966a917fe3d92150fa3cc15793ad5e57051eb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/08a966a917fe3d92150fa3cc15793ad5e57051eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37802","title":"ksmbd: fix WARNING \"do not call blocking ops when !TASK_RUNNING\"","status":"backported","project":true,"upstream":[{"sha":"1df0d4c616138784e033ad337961b6e1a6bcd999","url":"https://git.kernel.org/stable/c/1df0d4c616138784e033ad337961b6e1a6bcd999"}],"evidence":[{"url":"https://git.kernel.org/stable/c/97aabdbf7ba82da20e698f0e62917fb206d42941","label":"97aabdbf7ba8","date":"2026-09-14T13:28:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1df0d4c616138784e033ad337961b6e1a6bcd999","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/1df0d4c616138784e033ad337961b6e1a6bcd999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37802","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37802.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37800","title":"driver core: fix potential NULL pointer dereference in dev_uevent()","status":"backported","project":false,"upstream":[{"sha":"18daa52418e7e4629ed1703b64777294209d2622","url":"https://git.kernel.org/stable/c/18daa52418e7e4629ed1703b64777294209d2622"}],"evidence":[{"url":"https://git.kernel.org/stable/c/abe56be73eb10a677d16066f65ff9d30251f5eee","label":"abe56be73eb1","date":"2025-05-02T07:51:03+02:00","lore":["https://lore.kernel.org/r/20250311052417.1846985-3-dmitry.torokhov@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"18daa52418e7e4629ed1703b64777294209d2622","lines":79,"reason":"","source":"https://github.com/torvalds/linux/commit/18daa52418e7e4629ed1703b64777294209d2622.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37800","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37800.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37777","title":"ksmbd: fix use-after-free in __smb2_lease_break_noti()","status":"backported","project":false,"upstream":[{"sha":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","url":"https://git.kernel.org/stable/c/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1da8bd9a10ecd718692732294d15fd801c0eabb5","label":"1da8bd9a10ec","date":"2025-08-01T09:47:32+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37777","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37777.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37776","title":"ksmbd: fix use-after-free in smb_break_all_levII_oplock()","status":"backported","project":false,"upstream":[{"sha":"18b4fac5ef17f77fed9417d22210ceafd6525fc7","url":"https://git.kernel.org/stable/c/18b4fac5ef17f77fed9417d22210ceafd6525fc7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/296cb5457cc6f4a754c4ae29855f8a253d52bcc6","label":"296cb5457cc6","date":"2025-04-25T10:45:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"18b4fac5ef17f77fed9417d22210ceafd6525fc7","lines":91,"reason":"","source":"https://github.com/torvalds/linux/commit/18b4fac5ef17f77fed9417d22210ceafd6525fc7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37776","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37776.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37750","title":"smb: client: fix UAF in decryption with multichannel","status":"backported","project":false,"upstream":[{"sha":"9502dd5c7029902f4a425bf959917a5a9e7c0e50","url":"https://git.kernel.org/stable/c/9502dd5c7029902f4a425bf959917a5a9e7c0e50"}],"evidence":[{"url":"https://git.kernel.org/stable/c/08160de2a65227e5b64fcb6765cd936ec384ee93","label":"08160de2a652","date":"2026-10-21T10:27:30+02:00","lore":["https://lore.kernel.org/r/CAH2r5mu6Yc0-RJXM3kFyBYUB09XmXBrNodOiCVR4EDrmxq5Szg@mail.gmail.com"]}],"submission_lore":[],"basis":"Both targets already allocate and release separate enc/dec AEAD transforms for every channel during negotiate; neither shares primary_server->secmech, so the raced shared-transform state fixed upstream is absent. Applying the source change would reproduce existing target behavior and therefore have no security effect.","review":{"id":"CVE-2025-37750","series":"6.6.y","upstream":["9502dd5c7029902f4a425bf959917a5a9e7c0e50"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"no-op","applicability":"unaffected","reason":"Both targets already allocate and release separate enc/dec AEAD transforms for every channel during negotiate; neither shares primary_server->secmech, so the raced shared-transform state fixed upstream is absent. Applying the source change would reproduce existing target behavior and therefore have no security effect.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"9502dd5c7029902f4a425bf959917a5a9e7c0e50","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37750","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37750.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23133","title":"wifi: ath11k: update channel list in reg notifier instead reg worker","status":"backported","project":false,"upstream":[{"sha":"933ab187e679e6fbdeea1835ae39efcc59c022d2","url":"https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ec97bd5378c594be1f1c7a15dcf381e075b665d9","label":"ec97bd5378c5","date":"2026-10-21T10:27:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"933ab187e679e6fbdeea1835ae39efcc59c022d2","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/933ab187e679e6fbdeea1835ae39efcc59c022d2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23133","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23133.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23132","title":"f2fs: quota: fix to avoid warning in dquot_writeback_dquots()","status":"unfixed","project":false,"upstream":[{"sha":"eb85c2410d6f581e957cd03a644ff6ddbe592af9","url":"https://git.kernel.org/stable/c/eb85c2410d6f581e957cd03a644ff6ddbe592af9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"eb85c2410d6f581e957cd03a644ff6ddbe592af9","lines":232,"reason":"","source":"https://github.com/torvalds/linux/commit/eb85c2410d6f581e957cd03a644ff6ddbe592af9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23132","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23132.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23130","title":"f2fs: fix to avoid panic once fallocation fails for pinfile","status":"unfixed","project":false,"upstream":[{"sha":"48ea8b200414ac69ea96f4c231f5c7ef1fbeffef","url":"https://git.kernel.org/stable/c/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"48ea8b200414ac69ea96f4c231f5c7ef1fbeffef","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23130","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23130.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23129","title":"wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path","status":"backported","project":true,"upstream":[{"sha":"68410c5bd381a81bcc92b808e7dc4e6b9ed25d11","url":"https://git.kernel.org/stable/c/68410c5bd381a81bcc92b808e7dc4e6b9ed25d11"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7493b9baf0e54b44caae46715aaa409a84bd9f4b","label":"7493b9baf0e5","date":"2026-09-14T13:28:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"68410c5bd381a81bcc92b808e7dc4e6b9ed25d11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22127","title":"f2fs: fix potential deadloop in prepare_compress_overwrite()","status":"backported","project":false,"upstream":[{"sha":"3147ee567dd9004a49826ddeaf0a4b12865d4409","url":"https://git.kernel.org/stable/c/3147ee567dd9004a49826ddeaf0a4b12865d4409"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4513843d58d8fa1daebd3817205a15309b146342","label":"4513843d58d8","date":"2026-10-21T10:27:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3147ee567dd9004a49826ddeaf0a4b12865d4409","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22127","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22127.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22125","title":"md/raid1,raid10: don't ignore IO flags","status":"backported","project":false,"upstream":[{"sha":"e879a0d9cb086c8e52ce6c04e5bfa63825a6213c","url":"https://git.kernel.org/stable/c/e879a0d9cb086c8e52ce6c04e5bfa63825a6213c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/10f4ff4baeb6951cf58282954318827b6852d501","label":"10f4ff4baeb6","date":"2026-04-27T07:23:33-06:00","lore":["https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicloud.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e879a0d9cb086c8e52ce6c04e5bfa63825a6213c","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/e879a0d9cb086c8e52ce6c04e5bfa63825a6213c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22124","title":"md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb","status":"backported","project":true,"upstream":[{"sha":"6130825f34d41718c98a9b1504a79a23e379701e","url":"https://git.kernel.org/stable/c/6130825f34d41718c98a9b1504a79a23e379701e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5eaf57fdfa37c869e61e9908e03edd707f9145b8","label":"5eaf57fdfa37","date":"2026-09-14T13:28:56+02:00","lore":["https://lore.kernel.org/linux-raid/20250303033918.32136-1-glass.su@suse.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"6130825f34d41718c98a9b1504a79a23e379701e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22124","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22124.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22113","title":"ext4: avoid journaling sb update on error if journal is destroying","status":"backported","project":false,"upstream":[{"sha":"ce2f26e73783b4a7c46a86e3af5b5c8de0971790","url":"https://git.kernel.org/stable/c/ce2f26e73783b4a7c46a86e3af5b5c8de0971790"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b6d27f4869c9c4dedce0ba1c719d6c748a4ecc68","label":"b6d27f4869c9","date":"2026-10-21T10:27:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ce2f26e73783b4a7c46a86e3af5b5c8de0971790","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/ce2f26e73783b4a7c46a86e3af5b5c8de0971790.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22113","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22113.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22108","title":"bnxt_en: Mask the bd_cnt field in the TX BD properly","status":"unfixed","project":false,"upstream":[{"sha":"107b25db61122d8f990987895c2912927b8b6e3f","url":"https://git.kernel.org/stable/c/107b25db61122d8f990987895c2912927b8b6e3f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"107b25db61122d8f990987895c2912927b8b6e3f","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/107b25db61122d8f990987895c2912927b8b6e3f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22108","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22108.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22104","title":"ibmvnic: Use kernel helpers for hex dumps","status":"backported","project":false,"upstream":[{"sha":"d93a6caab5d7d9b5ce034d75b1e1e993338e3852","url":"https://git.kernel.org/stable/c/d93a6caab5d7d9b5ce034d75b1e1e993338e3852"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9bc078818ec76344c2e06b81d7aee2df3adecfbf","label":"9bc078818ec7","date":"2026-09-02T14:29:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d93a6caab5d7d9b5ce034d75b1e1e993338e3852","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22104","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22104.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22103","title":"net: fix NULL pointer dereference in l3mdev_l3_rcv","status":"backported","project":false,"upstream":[{"sha":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","url":"https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/52b44d8c653459c658b733d13658afdde45f6836","label":"52b44d8c6534","date":"2025-11-24T10:30:04+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22101","title":"net: libwx: fix Tx L4 checksum","status":"backported","project":true,"upstream":[{"sha":"c7d82913d5f9e97860772ee4051eaa66b56a6273","url":"https://git.kernel.org/stable/c/c7d82913d5f9e97860772ee4051eaa66b56a6273"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9c6c85ae77efbe29420883082b3a7b9fd2c57602","label":"9c6c85ae77ef","date":"2026-09-14T13:28:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"c7d82913d5f9e97860772ee4051eaa66b56a6273","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22043","title":"ksmbd: add bounds check for durable handle context","status":"backported","project":false,"upstream":[{"sha":"542027e123fc0bfd61dd59e21ae0ee4ef2101b29","url":"https://git.kernel.org/stable/c/542027e123fc0bfd61dd59e21ae0ee4ef2101b29"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8d4848c45943c9cf5e86142fd7347efa97f497db","label":"8d4848c45943","date":"2025-04-10T14:37:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"542027e123fc0bfd61dd59e21ae0ee4ef2101b29","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/542027e123fc0bfd61dd59e21ae0ee4ef2101b29.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22039","title":"ksmbd: fix overflow in dacloffset bounds check","status":"backported","project":true,"upstream":[{"sha":"beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42","url":"https://git.kernel.org/stable/c/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/73f074fb5e139cd42ad75089abe4e28a49a30003","label":"73f074fb5e13","date":"2026-09-14T13:28:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22039","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22039.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22028","title":"media: vimc: skip .s_stream() for stopped entities","status":"backported","project":false,"upstream":[{"sha":"36cef585e2a31e4ddf33a004b0584a7a572246de","url":"https://git.kernel.org/stable/c/36cef585e2a31e4ddf33a004b0584a7a572246de"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a505075730d23ccc19fc4ac382a0ed73b630c057","label":"a505075730d2","date":"2025-05-02T07:50:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"36cef585e2a31e4ddf33a004b0584a7a572246de","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/36cef585e2a31e4ddf33a004b0584a7a572246de.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21985","title":"drm/amd/display: Fix out-of-bound accesses","status":"not-applicable","project":false,"upstream":[{"sha":"8adbb2a98b00926315fd513b5fe2596b5716b82d","url":"https://git.kernel.org/stable/c/8adbb2a98b00926315fd513b5fe2596b5716b82d"}],"evidence":[],"submission_lore":[],"basis":"Upstream bounds DML2 and DML2.1 translation-helper indices before accessing fixed-size arrays. Do not backport: neither target contains dml2_translation_helper.c or dml21_translation_helper.c, nor the affected DML2 mapping arrays. There is no target code path to modify, so any fabricated analogue would be an effective no-op with respect to this CVE.","review":{"id":"CVE-2025-21985","series":"6.6.y","upstream":["8adbb2a98b00926315fd513b5fe2596b5716b82d"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"Upstream bounds DML2 and DML2.1 translation-helper indices before accessing fixed-size arrays. Do not backport: neither target contains dml2_translation_helper.c or dml21_translation_helper.c, nor the affected DML2 mapping arrays. There is no target code path to modify, so any fabricated analogue would be an effective no-op with respect to this CVE.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"8adbb2a98b00926315fd513b5fe2596b5716b82d","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/8adbb2a98b00926315fd513b5fe2596b5716b82d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21985","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21985.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21976","title":"fbdev: hyperv_fb: Allow graceful removal of framebuffer","status":"backported","project":true,"upstream":[{"sha":"ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","url":"https://git.kernel.org/stable/c/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b1a86a5ab0d44160534f495a3630646092d98e27","label":"b1a86a5ab0d4","date":"2026-10-21T10:27:10+02:00","lore":["https://lore.kernel.org/r/1740845791-19977-3-git-send-email-ssengar@linux.microsoft.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21976","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21976.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21949","title":"LoongArch: Set hugetlb mmap base address aligned with pmd size","status":"unfixed","project":false,"upstream":[{"sha":"3109d5ff484b7bc7b955f166974c6776d91f247b","url":"https://git.kernel.org/stable/c/3109d5ff484b7bc7b955f166974c6776d91f247b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3109d5ff484b7bc7b955f166974c6776d91f247b","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/3109d5ff484b7bc7b955f166974c6776d91f247b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21942","title":"btrfs: zoned: fix extent range end unlock in cow_file_range()","status":"unfixed","project":false,"upstream":[{"sha":"5a4041f2c47247575a6c2e53ce14f7b0ac946c33","url":"https://git.kernel.org/stable/c/5a4041f2c47247575a6c2e53ce14f7b0ac946c33"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5a4041f2c47247575a6c2e53ce14f7b0ac946c33","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/5a4041f2c47247575a6c2e53ce14f7b0ac946c33.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21942","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21942.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21907","title":"mm: memory-failure: update ttu flag inside unmap_poisoned_folio","status":"unfixed","project":false,"upstream":[{"sha":"b81679b1633aa43c0d973adfa816d78c1ed0d032","url":"https://git.kernel.org/stable/c/b81679b1633aa43c0d973adfa816d78c1ed0d032"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"b81679b1633aa43c0d973adfa816d78c1ed0d032","lines":128,"reason":"","source":"https://github.com/torvalds/linux/commit/b81679b1633aa43c0d973adfa816d78c1ed0d032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21907","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21907.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21886","title":"RDMA/mlx5: Fix implicit ODP hang on parent deregistration","status":"unfixed","project":false,"upstream":[{"sha":"3d8c6f26893d55fab218ad086719de1fc9bb86ba","url":"https://git.kernel.org/stable/c/3d8c6f26893d55fab218ad086719de1fc9bb86ba"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3d8c6f26893d55fab218ad086719de1fc9bb86ba","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/3d8c6f26893d55fab218ad086719de1fc9bb86ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21886","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21886.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21870","title":"ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers","status":"backported","project":true,"upstream":[{"sha":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","url":"https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6b6b47c1aa717a0ed3400e00a81dfea686a41d7f","label":"6b6b47c1aa71","date":"2026-10-21T10:27:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21836","title":"io_uring/kbuf: reallocate buf lists on upgrade","status":"backported","project":false,"upstream":[{"sha":"8802766324e1f5d414a81ac43365c20142e85603","url":"https://git.kernel.org/stable/c/8802766324e1f5d414a81ac43365c20142e85603"}],"evidence":[{"url":"https://git.kernel.org/stable/c/146a185f6c05ee263db715f860620606303c4633","label":"146a185f6c05","date":"2025-02-21T13:57:27+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8802766324e1f5d414a81ac43365c20142e85603","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/8802766324e1f5d414a81ac43365c20142e85603.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21836","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21836.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21825","title":"bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT","status":"backported","project":false,"upstream":[{"sha":"58f038e6d209d2dd862fcf5de55407855856794d","url":"https://git.kernel.org/stable/c/58f038e6d209d2dd862fcf5de55407855856794d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/50e44aa5f9905d237c245b8012937ef4dd971dcb","label":"50e44aa5f990","date":"2026-10-21T10:27:28+02:00","lore":["https://lore.kernel.org/bpf/20241106084527.4gPrMnHt@linutronix.de","https://lore.kernel.org/r/20250117101816.2101857-5-houtao@huaweicloud.com"]}],"submission_lore":[],"basis":"Upstream explicitly marks this as depending on v6.12+ PREEMPT_RT; neither target has the configuration/locking combination, so the kworker cancellation backport would be ineffective.","review":{"id":"CVE-2025-21825","series":"6.6.y","upstream":["58f038e6d209d2dd862fcf5de55407855856794d"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"Upstream explicitly marks this as depending on v6.12+ PREEMPT_RT; neither target has the configuration/locking combination, so the kworker cancellation backport would be ineffective.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"58f038e6d209d2dd862fcf5de55407855856794d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/58f038e6d209d2dd862fcf5de55407855856794d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21825","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21825.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21817","title":"block: mark GFP_NOIO around sysfs ->store()","status":"not-applicable","project":false,"upstream":[{"sha":"7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c","url":"https://git.kernel.org/stable/c/7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"unknown","patches":[{"sha":"7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21817","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21817.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21752","title":"btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents","status":"unfixed","project":false,"upstream":[{"sha":"dc14ba10781bd2629835696b7cc1febf914768e9","url":"https://git.kernel.org/stable/c/dc14ba10781bd2629835696b7cc1febf914768e9"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"dc14ba10781bd2629835696b7cc1febf914768e9","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/dc14ba10781bd2629835696b7cc1febf914768e9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21732","title":"RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error","status":"unfixed","project":false,"upstream":[{"sha":"abb604a1a9c87255c7a6f3b784410a9707baf467","url":"https://git.kernel.org/stable/c/abb604a1a9c87255c7a6f3b784410a9707baf467"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"abb604a1a9c87255c7a6f3b784410a9707baf467","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/abb604a1a9c87255c7a6f3b784410a9707baf467.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21732","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21732.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21693","title":"mm: zswap: properly synchronize freeing resources during CPU hotunplug","status":"unfixed","project":false,"upstream":[{"sha":"12dcb0ef540629a281533f9dedc1b6b8e14cfb65","url":"https://git.kernel.org/stable/c/12dcb0ef540629a281533f9dedc1b6b8e14cfb65"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"12dcb0ef540629a281533f9dedc1b6b8e14cfb65","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/12dcb0ef540629a281533f9dedc1b6b8e14cfb65.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21693","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21693.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21651","title":"net: hns3: don't auto enable misc vector","status":"backported","project":true,"upstream":[{"sha":"98b1e3b27734139c76295754b6c317aa4df6d32e","url":"https://git.kernel.org/stable/c/98b1e3b27734139c76295754b6c317aa4df6d32e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7f1fe43907a6339a41364f4f7915fbf3ab2775a8","label":"7f1fe43907a6","date":"2026-09-14T13:28:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"98b1e3b27734139c76295754b6c317aa4df6d32e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21651","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21651.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21649","title":"net: hns3: fix kernel crash when 1588 is sent on HIP08 devices","status":"backported","project":true,"upstream":[{"sha":"9741e72b2286de8b38de9db685588ac421a95c87","url":"https://git.kernel.org/stable/c/9741e72b2286de8b38de9db685588ac421a95c87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9d213ca0cb49e2d829f8338baf776f32cc8d9efa","label":"9d213ca0cb49","date":"2026-09-14T13:28:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9741e72b2286de8b38de9db685588ac421a95c87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21649","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21649.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21634","title":"cgroup/cpuset: remove kernfs active break","status":"unfixed","project":false,"upstream":[{"sha":"3cb97a927fffe443e1e7e8eddbfebfdb062e86ed","url":"https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3cb97a927fffe443e1e7e8eddbfebfdb062e86ed","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58241","title":"Bluetooth: hci_core: Disable works on hci_unregister_dev","status":"unfixed","project":false,"upstream":[{"sha":"989fa5171f005ecf63440057218d8aeb1795287d","url":"https://git.kernel.org/stable/c/989fa5171f005ecf63440057218d8aeb1795287d"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"989fa5171f005ecf63440057218d8aeb1795287d","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/989fa5171f005ecf63440057218d8aeb1795287d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58241","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58241.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58237","title":"bpf: consider that tail calls invalidate packet pointers","status":"backported","project":false,"upstream":[{"sha":"1a4607ffba35bf2a630aab299e34dd3f6e658d70","url":"https://git.kernel.org/stable/c/1a4607ffba35bf2a630aab299e34dd3f6e658d70"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f1692ee23dcaaddc24ba407b269707ee5df1301f","label":"f1692ee23dca","date":"2025-05-09T09:43:55+02:00","lore":["https://lore.kernel.org/r/20241210041100.1898468-8-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a4607ffba35bf2a630aab299e34dd3f6e658d70","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/1a4607ffba35bf2a630aab299e34dd3f6e658d70.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58100","title":"bpf: check changes_pkt_data property for extension programs","status":"backported","project":false,"upstream":[{"sha":"81f6d0530ba031b5f038a091619bf2ff29568852","url":"https://git.kernel.org/stable/c/81f6d0530ba031b5f038a091619bf2ff29568852"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7197fc4acdf238ec8ad06de5a8235df0c1f9c7d7","label":"7197fc4acdf2","date":"2025-05-09T09:43:54+02:00","lore":["https://lore.kernel.org/r/20241210041100.1898468-6-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"81f6d0530ba031b5f038a091619bf2ff29568852","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/81f6d0530ba031b5f038a091619bf2ff29568852.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58100","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58100.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58098","title":"bpf: track changes_pkt_data property for global functions","status":"backported","project":false,"upstream":[{"sha":"51081a3f25c742da5a659d7fc6fd77ebfdd555be","url":"https://git.kernel.org/stable/c/51081a3f25c742da5a659d7fc6fd77ebfdd555be"}],"evidence":[{"url":"https://git.kernel.org/stable/c/79751e9227a5910c0e5a2c7186877d91821d957d","label":"79751e9227a5","date":"2025-05-09T09:43:54+02:00","lore":["https://lore.kernel.org/bpf/0498CA22-5779-4767-9C0C-A9515CEA711F@gmail.com/","https://lore.kernel.org/r/20241210041100.1898468-4-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"51081a3f25c742da5a659d7fc6fd77ebfdd555be","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/51081a3f25c742da5a659d7fc6fd77ebfdd555be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58098","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58098.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58097","title":"wifi: ath11k: fix RCU stall while reaping monitor destination ring","status":"backported","project":false,"upstream":[{"sha":"16c6c35c03ea73054a1f6d3302a4ce4a331b427d","url":"https://git.kernel.org/stable/c/16c6c35c03ea73054a1f6d3302a4ce4a331b427d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8db5de0cf02fccf4c759aa58edbe65659daf607c","label":"8db5de0cf02f","date":"2026-01-30T10:27:43+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"16c6c35c03ea73054a1f6d3302a4ce4a331b427d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58095","title":"jfs: add check read-only before txBeginAnon() call","status":"backported","project":false,"upstream":[{"sha":"0176e69743ecc02961f2ae1ea42439cd2bf9ed58","url":"https://git.kernel.org/stable/c/0176e69743ecc02961f2ae1ea42439cd2bf9ed58"}],"evidence":[{"url":"https://git.kernel.org/stable/c/47a99881ecc50ff2bf4e7a6c3058fe1704073df9","label":"47a99881ecc5","date":"2026-09-02T14:29:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0176e69743ecc02961f2ae1ea42439cd2bf9ed58","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58095","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58095.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58094","title":"jfs: add check read-only before truncation in jfs_truncate_nolock()","status":"backported","project":false,"upstream":[{"sha":"b5799dd77054c1ec49b0088b006c9908e256843b","url":"https://git.kernel.org/stable/c/b5799dd77054c1ec49b0088b006c9908e256843b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/41da1715cd24e177678f93ee27f737b095fc838b","label":"41da1715cd24","date":"2026-09-02T14:29:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"b5799dd77054c1ec49b0088b006c9908e256843b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58094","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58094.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58089","title":"btrfs: fix double accounting race when btrfs_run_delalloc_range() failed","status":"unfixed","project":false,"upstream":[{"sha":"72dad8e377afa50435940adfb697e070d3556670","url":"https://git.kernel.org/stable/c/72dad8e377afa50435940adfb697e070d3556670"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"72dad8e377afa50435940adfb697e070d3556670","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/72dad8e377afa50435940adfb697e070d3556670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58053","title":"rxrpc: Fix handling of received connection abort","status":"backported","project":false,"upstream":[{"sha":"0e56ebde245e4799ce74d38419426f2a80d39950","url":"https://git.kernel.org/stable/c/0e56ebde245e4799ce74d38419426f2a80d39950"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9c6702260557c0183d8417c79a37777a3d3e58e8","label":"9c6702260557","date":"2025-02-08T09:51:50+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0e56ebde245e4799ce74d38419426f2a80d39950","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/0e56ebde245e4799ce74d38419426f2a80d39950.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58053","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58053.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58015","title":"wifi: ath12k: Fix for out-of bound access error","status":"not-applicable","project":false,"upstream":[{"sha":"eb8c0534713865d190856f10bfc97cf0b88475b1","url":"https://git.kernel.org/stable/c/eb8c0534713865d190856f10bfc97cf0b88475b1"}],"evidence":[],"submission_lore":[],"basis":"The affected ath12k HTT debug statistics implementation is absent; this target has the separate ath11k statistics code.","review":{"id":"CVE-2024-58015","series":"6.6.y","upstream":["eb8c0534713865d190856f10bfc97cf0b88475b1"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The affected ath12k HTT debug statistics implementation is absent; this target has the separate ath11k statistics code.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/ath/ath12k?id=79643295eba17affbd16ca97f3ef04c90266b28c"},{"label":"Upstream fix eb8c05347138","url":"https://git.kernel.org/stable/c/eb8c0534713865d190856f10bfc97cf0b88475b1"}]},"size":{"status":"within-limit","patches":[{"sha":"eb8c0534713865d190856f10bfc97cf0b88475b1","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/eb8c0534713865d190856f10bfc97cf0b88475b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58012","title":"ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params","status":"backported","project":true,"upstream":[{"sha":"569922b82ca660f8b24e705f6cf674e6b1f99cc7","url":"https://git.kernel.org/stable/c/569922b82ca660f8b24e705f6cf674e6b1f99cc7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2be324c89993c51c9554a84415604be098876d42","label":"2be324c89993","date":"2026-10-21T10:27:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"569922b82ca660f8b24e705f6cf674e6b1f99cc7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58012","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58012.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57984","title":"i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition","status":"backported","project":false,"upstream":[{"sha":"b75439c945b94dd8a2b645355bdb56f948052601","url":"https://git.kernel.org/stable/c/b75439c945b94dd8a2b645355bdb56f948052601"}],"evidence":[{"url":"https://git.kernel.org/stable/c/60d2fb033a999bb644f8e8606ff4a1b82de36c6f","label":"60d2fb033a99","date":"2025-02-08T09:52:22+01:00","lore":["https://lore.kernel.org/r/bfc49c9527be5b513e7ceafeba314ca40a5be4bc.1732703537.git.xiaopei01@kylinos.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b75439c945b94dd8a2b645355bdb56f948052601","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b75439c945b94dd8a2b645355bdb56f948052601.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57984","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57984.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57975","title":"btrfs: do proper folio cleanup when run_delalloc_nocow() failed","status":"backported","project":false,"upstream":[{"sha":"c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","url":"https://git.kernel.org/stable/c/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed"}],"evidence":[{"url":"https://git.kernel.org/stable/c/545d6893d3a34737d000af103e1557c592075c41","label":"545d6893d3a3","date":"2026-10-21T10:27:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","lines":150,"reason":"","source":"https://github.com/torvalds/linux/commit/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57872","title":"scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()","status":"unfixed","project":false,"upstream":[{"sha":"897df60c16d54ad515a3d0887edab5c63da06d1f","url":"https://git.kernel.org/stable/c/897df60c16d54ad515a3d0887edab5c63da06d1f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"897df60c16d54ad515a3d0887edab5c63da06d1f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/897df60c16d54ad515a3d0887edab5c63da06d1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57857","title":"RDMA/siw: Remove direct link to net_device","status":"backported","project":false,"upstream":[{"sha":"16b87037b48889d21854c8e97aec8a1baf2642b3","url":"https://git.kernel.org/stable/c/16b87037b48889d21854c8e97aec8a1baf2642b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6a97bfc0293db234ac6ec32f6a32bd6702191a95","label":"6a97bfc0293d","date":"2026-10-21T10:27:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"16b87037b48889d21854c8e97aec8a1baf2642b3","lines":204,"reason":"","source":"https://github.com/torvalds/linux/commit/16b87037b48889d21854c8e97aec8a1baf2642b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57857","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57857.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57809","title":"PCI: imx6: Fix suspend/resume support on i.MX6QDL","status":"backported","project":false,"upstream":[{"sha":"0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3","url":"https://git.kernel.org/stable/c/0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/30fc8f6d33bb23ce68650148486391847de6cdf3","label":"30fc8f6d33bb","date":"2026-10-21T10:27:27+02:00","lore":["https://lore.kernel.org/r/20241030103250.83640-1-eichest@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57809","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57809.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57795","title":"RDMA/rxe: Remove the direct link to net_device","status":"backported","project":false,"upstream":[{"sha":"2ac5415022d16d63d912a39a06f32f1f51140261","url":"https://git.kernel.org/stable/c/2ac5415022d16d63d912a39a06f32f1f51140261"}],"evidence":[{"url":"https://git.kernel.org/stable/c/32ca3557d968e662957131374a5f81c9c9cdbba8","label":"32ca3557d968","date":"2026-01-11T15:22:31+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2ac5415022d16d63d912a39a06f32f1f51140261","lines":260,"reason":"","source":"https://github.com/torvalds/linux/commit/2ac5415022d16d63d912a39a06f32f1f51140261.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57795","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57795.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56775","title":"drm/amd/display: Fix handling of plane refcount","status":"not-applicable","project":false,"upstream":[{"sha":"27227a234c1487cb7a684615f0749c455218833a","url":"https://git.kernel.org/stable/c/27227a234c1487cb7a684615f0749c455218833a"}],"evidence":[],"submission_lore":[],"basis":"No effect: neither target contains restore_planes_and_stream_state() or the scratch plane-state overwrite that loses the live refcount. Do not import the later backup/restore mechanism. The operation corrected by the patch is absent, so an adapted patch would be a no-op or unrelated redesign.","review":{"id":"CVE-2024-56775","series":"6.6.y","upstream":["27227a234c1487cb7a684615f0749c455218833a"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"No effect: neither target contains restore_planes_and_stream_state() or the scratch plane-state overwrite that loses the live refcount. Do not import the later backup/restore mechanism. The operation corrected by the patch is absent, so an adapted patch would be a no-op or unrelated redesign.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"27227a234c1487cb7a684615f0749c455218833a","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/27227a234c1487cb7a684615f0749c455218833a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56591","title":"Bluetooth: hci_conn: Use disable_delayed_work_sync","status":"unfixed","project":false,"upstream":[{"sha":"2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df","url":"https://git.kernel.org/stable/c/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56544","title":"udmabuf: change folios array from kmalloc to kvmalloc","status":"backported","project":false,"upstream":[{"sha":"1c0844c6184e658064e14c4335885785ad3bf84b","url":"https://git.kernel.org/stable/c/1c0844c6184e658064e14c4335885785ad3bf84b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2384a29db79bd2cfe0b7646ac0030cb355825e29","label":"2384a29db79b","date":"2026-10-21T10:27:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c0844c6184e658064e14c4335885785ad3bf84b","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/1c0844c6184e658064e14c4335885785ad3bf84b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56544","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56544.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56538","title":"drm: zynqmp_kms: Unplug DRM device before removal","status":"backported","project":false,"upstream":[{"sha":"2e07c88914fc5289c21820b1aa94f058feb38197","url":"https://git.kernel.org/stable/c/2e07c88914fc5289c21820b1aa94f058feb38197"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a17b9afe58c474657449cf87e238b1788200576b","label":"a17b9afe58c4","date":"2024-12-09T10:32:07+01:00","lore":["https://lore.kernel.org/dri-devel/4d8f4c9b-2efb-4774-9a37-2f257f79b2c9@linux.dev/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2e07c88914fc5289c21820b1aa94f058feb38197","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53687","title":"riscv: Fix IPIs usage in kfence_protect_page()","status":"backported","project":false,"upstream":[{"sha":"b3431a8bb336cece8adc452437befa7d4534b2fd","url":"https://git.kernel.org/stable/c/b3431a8bb336cece8adc452437befa7d4534b2fd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6f796a6a396d6f963f2cc8f5edd7dfba2cca097f","label":"6f796a6a396d","date":"2024-12-19T18:11:22+01:00","lore":["https://lore.kernel.org/r/20241209074125.52322-1-alexghiti@rivosinc.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b3431a8bb336cece8adc452437befa7d4534b2fd","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/b3431a8bb336cece8adc452437befa7d4534b2fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53687","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53687.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53219","title":"virtiofs: use pages instead of pointer for kernel direct IO","status":"backported","project":false,"upstream":[{"sha":"41748675c0bf252b3c5f600a95830f0936d366c1","url":"https://git.kernel.org/stable/c/41748675c0bf252b3c5f600a95830f0936d366c1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0015d54a47995867781224450525e60a1a0077ab","label":"0015d54a4799","date":"2026-10-21T10:27:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"41748675c0bf252b3c5f600a95830f0936d366c1","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/41748675c0bf252b3c5f600a95830f0936d366c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53219","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53219.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53218","title":"f2fs: fix race in concurrent f2fs_stop_gc_thread","status":"backported","project":false,"upstream":[{"sha":"7b0033dbc48340a1c1c3f12448ba17d6587ca092","url":"https://git.kernel.org/stable/c/7b0033dbc48340a1c1c3f12448ba17d6587ca092"}],"evidence":[{"url":"https://git.kernel.org/stable/c/794fa8792d4eacac191f1cbcc2e81b7369e4662a","label":"794fa8792d4e","date":"2024-12-09T10:32:27+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7b0033dbc48340a1c1c3f12448ba17d6587ca092","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/7b0033dbc48340a1c1c3f12448ba17d6587ca092.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53218","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53218.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53201","title":"drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe","status":"backported","project":false,"upstream":[{"sha":"6a057072ddd127255350357dd880903e8fa23f36","url":"https://git.kernel.org/stable/c/6a057072ddd127255350357dd880903e8fa23f36"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0335fb698ab0415d87650bc7a0f465c563ddec7d","label":"0335fb698ab0","date":"2026-10-21T10:27:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":{"id":"CVE-2024-53201","series":"6.6.y","upstream":["6a057072ddd127255350357dd880903e8fa23f36"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"dcn20_program_pipe() has only partial plane_state checks inside an OR condition; pipe and stream update flags can still reach subsequent plane-state use when plane_state is NULL.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n1685"},{"label":"Upstream fix 6a057072ddd1","url":"https://git.kernel.org/stable/c/6a057072ddd127255350357dd880903e8fa23f36"}]},"size":{"status":"within-limit","patches":[{"sha":"6a057072ddd127255350357dd880903e8fa23f36","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/6a057072ddd127255350357dd880903e8fa23f36.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53201","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53201.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53187","title":"io_uring: check for overflows in io_pin_pages","status":"backported","project":false,"upstream":[{"sha":"0c0a4eae26ac78379d0c1db053de168a8febc6c9","url":"https://git.kernel.org/stable/c/0c0a4eae26ac78379d0c1db053de168a8febc6c9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1a0aecabff72a95d240e6d7645949bfe0620dcd7","label":"1a0aecabff72","date":"2026-10-21T10:27:26+02:00","lore":["https://lore.kernel.org/r/1b7520ddb168e1d537d64be47414a0629d0d8f8f.1732581026.git.asml.silence@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2024-53187","series":"6.6.y","upstream":["0c0a4eae26ac78379d0c1db053de168a8febc6c9"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"io_pin_pages uses unchecked uaddr + len + PAGE_SIZE - 1","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: io_uring/io_uring.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/io_uring/io_uring.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n2715"},{"label":"Upstream fix 0c0a4eae26ac","url":"https://git.kernel.org/stable/c/0c0a4eae26ac78379d0c1db053de168a8febc6c9"}]},"size":{"status":"unknown","patches":[{"sha":"0c0a4eae26ac78379d0c1db053de168a8febc6c9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53187","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53187.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53176","title":"smb: During unmount, ensure all cached dir instances drop their dentry","status":"backported","project":false,"upstream":[{"sha":"3fa640d035e5ae526769615c35cb9ed4be6e3662","url":"https://git.kernel.org/stable/c/3fa640d035e5ae526769615c35cb9ed4be6e3662"}],"evidence":[{"url":"https://git.kernel.org/stable/c/73934e535cffbda1490fa97d82690a0f9aa73e94","label":"73934e535cff","date":"2024-12-09T10:32:53+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"3fa640d035e5ae526769615c35cb9ed4be6e3662","lines":357,"reason":"","source":"https://github.com/torvalds/linux/commit/3fa640d035e5ae526769615c35cb9ed4be6e3662.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53176","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53176.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53134","title":"pmdomain: imx93-blk-ctrl: correct remove path","status":"backported","project":false,"upstream":[{"sha":"f7c7c5aa556378a2c8da72c1f7f238b6648f95fb","url":"https://git.kernel.org/stable/c/f7c7c5aa556378a2c8da72c1f7f238b6648f95fb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8fc228ab5d38a026eae7183a5f74a4fac43d9b6a","label":"8fc228ab5d38","date":"2024-11-22T15:38:35+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"f7c7c5aa556378a2c8da72c1f7f238b6648f95fb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53134","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53134.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53114","title":"x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client","status":"backported","project":true,"upstream":[{"sha":"a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0","url":"https://git.kernel.org/stable/c/a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cf79df17706605032461f1ebde730b4391d1ca9c","label":"cf79df177066","date":"2026-10-21T10:26:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53114","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53114.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53089","title":"LoongArch: KVM: Mark hrtimer to expire in hard interrupt context","status":"not-applicable","project":false,"upstream":[{"sha":"73adbd92f3223dc0c3506822b71c6b259d5d537b","url":"https://git.kernel.org/stable/c/73adbd92f3223dc0c3506822b71c6b259d5d537b"}],"evidence":[],"submission_lore":[],"basis":"LoongArch KVM is absent from both targets.","review":{"id":"CVE-2024-53089","series":"6.6.y","upstream":["73adbd92f3223dc0c3506822b71c6b259d5d537b"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"LoongArch KVM is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"73adbd92f3223dc0c3506822b71c6b259d5d537b","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/73adbd92f3223dc0c3506822b71c6b259d5d537b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53085","title":"tpm: Lock TPM chip in tpm_pm_suspend() first","status":"backported","project":false,"upstream":[{"sha":"9265fed6db601ee2ec47577815387458ef4f047a","url":"https://git.kernel.org/stable/c/9265fed6db601ee2ec47577815387458ef4f047a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cfaf83501a0cbb104499c5b0892ee5ebde4e967f","label":"cfaf83501a0c","date":"2024-12-09T10:33:10+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9265fed6db601ee2ec47577815387458ef4f047a","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/9265fed6db601ee2ec47577815387458ef4f047a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53079","title":"mm/thp: fix deferred split unqueue naming and locking","status":"backported","project":false,"upstream":[{"sha":"f8f931bba0f92052cf842b7e30917b1afcc77d5a","url":"https://git.kernel.org/stable/c/f8f931bba0f92052cf842b7e30917b1afcc77d5a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fc4951c3e3358dd82ea508e893695b916c813f17","label":"fc4951c3e335","date":"2024-11-17T15:08:59+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"f8f931bba0f92052cf842b7e30917b1afcc77d5a","lines":214,"reason":"","source":"https://github.com/torvalds/linux/commit/f8f931bba0f92052cf842b7e30917b1afcc77d5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53056","title":"drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()","status":"backported","project":true,"upstream":[{"sha":"4018651ba5c409034149f297d3dd3328b91561fd","url":"https://git.kernel.org/stable/c/4018651ba5c409034149f297d3dd3328b91561fd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fb05e973698f4af008c7fb6e0cfa6a2fa1d98409","label":"fb05e973698f","date":"2026-10-03T12:31:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"4018651ba5c409034149f297d3dd3328b91561fd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53056","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53056.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53051","title":"drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability","status":"backported","project":true,"upstream":[{"sha":"31b42af516afa1e184d1a9f9dd4096c54044269a","url":"https://git.kernel.org/stable/c/31b42af516afa1e184d1a9f9dd4096c54044269a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/df17aa6038f96355640ace6ef3c3ff59c10c633f","label":"df17aa6038f9","date":"2026-10-21T10:26:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"31b42af516afa1e184d1a9f9dd4096c54044269a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53051","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53051.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53050","title":"drm/i915/hdcp: Add encoder check in hdcp2_get_capability","status":"backported","project":true,"upstream":[{"sha":"d34f4f058edf1235c103ca9c921dc54820d14d40","url":"https://git.kernel.org/stable/c/d34f4f058edf1235c103ca9c921dc54820d14d40"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d233c8da8b70fbf5d986d3ef55005f17b2ee6d32","label":"d233c8da8b70","date":"2026-10-21T10:26:42+02:00","lore":[]}],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"d34f4f058edf1235c103ca9c921dc54820d14d40","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53050","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53050.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50289","title":"media: av7110: fix a spectre vulnerability","status":"backported","project":true,"upstream":[{"sha":"458ea1c0be991573ec436aa0afa23baacfae101a","url":"https://git.kernel.org/stable/c/458ea1c0be991573ec436aa0afa23baacfae101a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0e58d7070eef16615e280d9b25d334b08e042b61","label":"0e58d7070eef","date":"2026-10-21T10:26:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"458ea1c0be991573ec436aa0afa23baacfae101a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50282","title":"drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()","status":"backported","project":false,"upstream":[{"sha":"4d75b9468021c73108b4439794d69e892b1d24e3","url":"https://git.kernel.org/stable/c/4d75b9468021c73108b4439794d69e892b1d24e3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8906728f2fbd6504cb488f4afdd66af28f330a7a","label":"8906728f2fbd","date":"2024-11-14T13:19:36+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4d75b9468021c73108b4439794d69e892b1d24e3","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/4d75b9468021c73108b4439794d69e892b1d24e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50282","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50282.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50225","title":"btrfs: fix error propagation of split bios","status":"unfixed","project":false,"upstream":[{"sha":"d48e1dea3931de64c26717adc2b89743c7ab6594","url":"https://git.kernel.org/stable/c/d48e1dea3931de64c26717adc2b89743c7ab6594"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d48e1dea3931de64c26717adc2b89743c7ab6594","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/d48e1dea3931de64c26717adc2b89743c7ab6594.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50225","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50225.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50217","title":"btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()","status":"not-applicable","project":false,"upstream":[{"sha":"aec8e6bf839101784f3ef037dcdb9432c3f32343","url":"https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343"}],"evidence":[],"submission_lore":[],"basis":"No effect: neither target has struct btrfs_device.bdev_file, which is the stale pointer cleared by the fix. Do not synthesize the newer bdev_file conversion merely to apply this fix. The older targets close and clear device->bdev and cannot execute the reported bdev_file use-after-free path.","review":{"id":"CVE-2024-50217","series":"6.6.y","upstream":["aec8e6bf839101784f3ef037dcdb9432c3f32343"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"No effect: neither target has struct btrfs_device.bdev_file, which is the stale pointer cleared by the fix. Do not synthesize the newer bdev_file conversion merely to apply this fix. The older targets close and clear device->bdev and cannot execute the reported bdev_file use-after-free path.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"aec8e6bf839101784f3ef037dcdb9432c3f32343","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/aec8e6bf839101784f3ef037dcdb9432c3f32343.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50211","title":"udf: refactor inode_bmap() to handle error","status":"backported","project":false,"upstream":[{"sha":"c226964ec786f3797ed389a16392ce4357697d24","url":"https://git.kernel.org/stable/c/c226964ec786f3797ed389a16392ce4357697d24"}],"evidence":[{"url":"https://git.kernel.org/stable/c/493447dd8336607fce426f7879e581095f6c606e","label":"493447dd8336","date":"2024-11-01T01:58:27+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c226964ec786f3797ed389a16392ce4357697d24","lines":173,"reason":"","source":"https://github.com/torvalds/linux/commit/c226964ec786f3797ed389a16392ce4357697d24.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50166","title":"fsl/fman: Fix refcount handling of fman-related devices","status":"backported","project":false,"upstream":[{"sha":"1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1","url":"https://git.kernel.org/stable/c/1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5ed4334fc9512f934fe2ae9c4cf7f8142e451b8b","label":"5ed4334fc951","date":"2024-11-01T01:58:29+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1","lines":151,"reason":"","source":"https://github.com/torvalds/linux/commit/1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50166","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50166.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50111","title":"LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context","status":"backported","project":false,"upstream":[{"sha":"69cc6fad5df4ce652d969be69acc60e269e5eea1","url":"https://git.kernel.org/stable/c/69cc6fad5df4ce652d969be69acc60e269e5eea1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8915ed160dbd32b5ef5864df9a9fc11db83a77bb","label":"8915ed160dbd","date":"2024-11-01T01:58:33+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"69cc6fad5df4ce652d969be69acc60e269e5eea1","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/69cc6fad5df4ce652d969be69acc60e269e5eea1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50111","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50111.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50102","title":"x86: fix user address masking non-canonical speculation issue","status":"unfixed","project":false,"upstream":[{"sha":"86e6b1547b3d013bc392adf775b89318441403c2","url":"https://git.kernel.org/stable/c/86e6b1547b3d013bc392adf775b89318441403c2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"86e6b1547b3d013bc392adf775b89318441403c2","lines":116,"reason":"","source":"https://github.com/torvalds/linux/commit/86e6b1547b3d013bc392adf775b89318441403c2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50057","title":"usb: typec: tipd: Free IRQ only if it was requested before","status":"backported","project":false,"upstream":[{"sha":"db63d9868f7f310de44ba7bea584e2454f8b4ed0","url":"https://git.kernel.org/stable/c/db63d9868f7f310de44ba7bea584e2454f8b4ed0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b72bf5cade51ba4055c8a8998d275e72e6b521ce","label":"b72bf5cade51","date":"2024-10-17T15:24:19+02:00","lore":["https://lore.kernel.org/r/20240816124150.608125-1-w.egorov@phytec.de"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"db63d9868f7f310de44ba7bea584e2454f8b4ed0","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/db63d9868f7f310de44ba7bea584e2454f8b4ed0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50057","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50057.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50043","title":"nfsd: fix possible badness in FREE_STATEID","status":"unfixed","project":false,"upstream":[{"sha":"c88c150a467fcb670a1608e2272beeee3e86df6e","url":"https://git.kernel.org/stable/c/c88c150a467fcb670a1608e2272beeee3e86df6e"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c88c150a467fcb670a1608e2272beeee3e86df6e","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/c88c150a467fcb670a1608e2272beeee3e86df6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50028","title":"thermal: core: Reference count the zone in thermal_zone_get_by_id()","status":"unfixed","project":false,"upstream":[{"sha":"a42a5839f400e929c489bb1b58f54596c4535167","url":"https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a42a5839f400e929c489bb1b58f54596c4535167","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/a42a5839f400e929c489bb1b58f54596c4535167.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50017","title":"x86/mm/ident_map: Use gbpages only where full GB page should be mapped.","status":"backported","project":false,"upstream":[{"sha":"cc31744a294584a36bf764a0ffa3255a8e69f036","url":"https://git.kernel.org/stable/c/cc31744a294584a36bf764a0ffa3255a8e69f036"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d113f9723f2bfd9c6feeb899b8ddbee6b8a6e01f","label":"d113f9723f2b","date":"2025-02-17T09:40:43+01:00","lore":["https://lore.kernel.org/all/20240717213121.3064030-3-steve.wahl@hpe.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"cc31744a294584a36bf764a0ffa3255a8e69f036","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49988","title":"ksmbd: add refcnt to ksmbd_conn struct","status":"backported","project":false,"upstream":[{"sha":"ee426bfb9d09b29987369b897fe9b6485ac2be27","url":"https://git.kernel.org/stable/c/ee426bfb9d09b29987369b897fe9b6485ac2be27"}],"evidence":[{"url":"https://git.kernel.org/stable/c/18f06bacc197d4ac9b518ad1c69999bc3d83e7aa","label":"18f06bacc197","date":"2024-10-10T11:57:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ee426bfb9d09b29987369b897fe9b6485ac2be27","lines":186,"reason":"","source":"https://github.com/torvalds/linux/commit/ee426bfb9d09b29987369b897fe9b6485ac2be27.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49970","title":"drm/amd/display: Implement bounds check for stream encoder creation in DCN401","status":"backported","project":false,"upstream":[{"sha":"bdf606810210e8e07a0cdf1af3c467291363b295","url":"https://git.kernel.org/stable/c/bdf606810210e8e07a0cdf1af3c467291363b295"}],"evidence":[{"url":"https://git.kernel.org/stable/c/00872dcc2a3e4a42155c2f3b7f21952a62301035","label":"00872dcc2a3e","date":"2026-10-21T10:27:26+02:00","lore":[]}],"submission_lore":[],"basis":"The DCN401 stream-encoder factory and fixed register array are absent from both targets.","review":{"id":"CVE-2024-49970","series":"6.6.y","upstream":["bdf606810210e8e07a0cdf1af3c467291363b295"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The DCN401 stream-encoder factory and fixed register array are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"bdf606810210e8e07a0cdf1af3c467291363b295","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49970","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49970.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49923","title":"drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags","status":"backported","project":false,"upstream":[{"sha":"5559598742fb4538e4c51c48ef70563c49c2af23","url":"https://git.kernel.org/stable/c/5559598742fb4538e4c51c48ef70563c49c2af23"}],"evidence":[{"url":"https://git.kernel.org/stable/c/39a580cd15397e102aaec25986ae5acf492f8930","label":"39a580cd1539","date":"2025-02-21T13:57:25+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5559598742fb4538e4c51c48ef70563c49c2af23","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49923","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49923.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49922","title":"drm/amd/display: Check null pointers before using them","status":"backported","project":true,"upstream":[{"sha":"1ff12bcd7deaeed25efb5120433c6a45dd5504a8","url":"https://git.kernel.org/stable/c/1ff12bcd7deaeed25efb5120433c6a45dd5504a8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/336bc3461b1c74e085bb0f2e1488df4dcc6dc983","label":"336bc3461b1c","date":"2026-10-03T12:31:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1ff12bcd7deaeed25efb5120433c6a45dd5504a8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49922","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49922.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49919","title":"drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer","status":"backported","project":false,"upstream":[{"sha":"f22f4754aaa47d8c59f166ba3042182859e5dff7","url":"https://git.kernel.org/stable/c/f22f4754aaa47d8c59f166ba3042182859e5dff7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/16ce8fd94da8599bb6f0496895d392a69aead1c0","label":"16ce8fd94da8","date":"2025-02-21T13:57:25+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"f22f4754aaa47d8c59f166ba3042182859e5dff7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49919","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49919.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49918","title":"drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer","status":"backported","project":false,"upstream":[{"sha":"ac2140449184a26eac99585b7f69814bd3ba8f2d","url":"https://git.kernel.org/stable/c/ac2140449184a26eac99585b7f69814bd3ba8f2d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/180280f3c4621d699d903773bb84bf7f0bc6a891","label":"180280f3c462","date":"2026-10-21T10:27:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2024-49918","series":"6.6.y","upstream":["ac2140449184a26eac99585b7f69814bd3ba8f2d"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"ineffective-fix","applicability":"affected","reason":"The sole target caller dereferences the candidate before the new NULL guard, so the isolated backport does not prevent the fault.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"ac2140449184a26eac99585b7f69814bd3ba8f2d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49916","title":"drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw","status":"not-applicable","project":false,"upstream":[{"sha":"4b6377f0e96085cbec96eb7f0b282430ccdd3d75","url":"https://git.kernel.org/stable/c/4b6377f0e96085cbec96eb7f0b282430ccdd3d75"}],"evidence":[],"submission_lore":[],"basis":"The DCN401 init path is absent from both targets.","review":{"id":"CVE-2024-49916","series":"6.6.y","upstream":["4b6377f0e96085cbec96eb7f0b282430ccdd3d75"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The DCN401 init path is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"4b6377f0e96085cbec96eb7f0b282430ccdd3d75","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/4b6377f0e96085cbec96eb7f0b282430ccdd3d75.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49916","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49916.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49914","title":"drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe","status":"backported","project":false,"upstream":[{"sha":"8e4ed3cf1642df0c4456443d865cff61a9598aa8","url":"https://git.kernel.org/stable/c/8e4ed3cf1642df0c4456443d865cff61a9598aa8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/68f75e6f08aad66069a629db8d7840919156c761","label":"68f75e6f08aa","date":"2024-12-09T10:31:42+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8e4ed3cf1642df0c4456443d865cff61a9598aa8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49910","title":"drm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func","status":"not-applicable","project":false,"upstream":[{"sha":"dd340acd42c24a3f28dd22fae6bf38662334264c","url":"https://git.kernel.org/stable/c/dd340acd42c24a3f28dd22fae6bf38662334264c"}],"evidence":[],"submission_lore":[],"basis":"The DCN401 output-transfer function is absent from both targets.","review":{"id":"CVE-2024-49910","series":"6.6.y","upstream":["dd340acd42c24a3f28dd22fae6bf38662334264c"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The DCN401 output-transfer function is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"dd340acd42c24a3f28dd22fae6bf38662334264c","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/dd340acd42c24a3f28dd22fae6bf38662334264c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49910","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49910.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49908","title":"drm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2)","status":"not-applicable","project":false,"upstream":[{"sha":"0fe20258b4989b9112b5e9470df33a0939403fd4","url":"https://git.kernel.org/stable/c/0fe20258b4989b9112b5e9470df33a0939403fd4"}],"evidence":[],"submission_lore":[],"basis":"The amdgpu_dm_update_cursor() path and its afb pitch use are absent from both targets.","review":{"id":"CVE-2024-49908","series":"6.6.y","upstream":["0fe20258b4989b9112b5e9470df33a0939403fd4"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The amdgpu_dm_update_cursor() path and its afb pitch use are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"0fe20258b4989b9112b5e9470df33a0939403fd4","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/0fe20258b4989b9112b5e9470df33a0939403fd4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49908","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49908.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49906","title":"drm/amd/display: Check null pointer before try to access it","status":"backported","project":false,"upstream":[{"sha":"1b686053c06ffb9f4524b288110cf2a831ff7a25","url":"https://git.kernel.org/stable/c/1b686053c06ffb9f4524b288110cf2a831ff7a25"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ebef6616219ff04abdeb39450625f85419787ee3","label":"ebef6616219f","date":"2024-12-09T10:32:40+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1b686053c06ffb9f4524b288110cf2a831ff7a25","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49893","title":"drm/amd/display: Check stream_status before it is used","status":"not-applicable","project":false,"upstream":[{"sha":"58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9","url":"https://git.kernel.org/stable/c/58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9"}],"evidence":[],"submission_lore":[],"basis":"The FAMS2 fast-update path and nullable stream_status consumer are absent from both targets.","review":{"id":"CVE-2024-49893","series":"6.6.y","upstream":["58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The FAMS2 fast-update path and nullable stream_status consumer are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49893","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49893.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47752","title":"media: mediatek: vcodec: Fix H264 stateless decoder smatch warning","status":"backported","project":false,"upstream":[{"sha":"7878d3a385efab560dce793b595447867fb163f2","url":"https://git.kernel.org/stable/c/7878d3a385efab560dce793b595447867fb163f2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c6b9f971b43980de8893610f606d751131fb5d86","label":"c6b9f971b439","date":"2024-10-04T16:29:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7878d3a385efab560dce793b595447867fb163f2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47703","title":"bpf, lsm: Add check for BPF LSM return value","status":"unfixed","project":false,"upstream":[{"sha":"5d99e198be279045e6ecefe220f5c52f8ce9bfd5","url":"https://git.kernel.org/stable/c/5d99e198be279045e6ecefe220f5c52f8ce9bfd5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"5d99e198be279045e6ecefe220f5c52f8ce9bfd5","lines":200,"reason":"","source":"https://github.com/torvalds/linux/commit/5d99e198be279045e6ecefe220f5c52f8ce9bfd5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47703","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47703.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47702","title":"bpf: Fail verification for sign-extension of packet data/data_end/data_meta","status":"backported","project":true,"upstream":[{"sha":"92de36080c93296ef9005690705cba260b9bd68a","url":"https://git.kernel.org/stable/c/92de36080c93296ef9005690705cba260b9bd68a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4b48228eebce2ab1b01e3133da822164472b7e46","label":"4b48228eebce","date":"2026-10-03T12:31:16+02:00","lore":["https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/","https://lore.kernel.org/r/20240723153439.2429035-1-yonghong.song@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"92de36080c93296ef9005690705cba260b9bd68a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47702","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47702.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47691","title":"f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()","status":"backported","project":false,"upstream":[{"sha":"c7f114d864ac91515bb07ac271e9824a20f5ed95","url":"https://git.kernel.org/stable/c/c7f114d864ac91515bb07ac271e9824a20f5ed95"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fc18e655b62ac6bc9f12f5de0d749b4a3fe1e812","label":"fc18e655b62a","date":"2024-10-04T16:29:37+02:00","lore":["https://lore.kernel.org/linux-f2fs-devel/0000000000005c7ccb061e032b9b@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7f114d864ac91515bb07ac271e9824a20f5ed95","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/c7f114d864ac91515bb07ac271e9824a20f5ed95.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47691","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47691.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47683","title":"drm/amd/display: Skip Recompute DSC Params if no Stream on Link","status":"unfixed","project":false,"upstream":[{"sha":"8151a6c13111b465dbabe07c19f572f7cbd16fef","url":"https://git.kernel.org/stable/c/8151a6c13111b465dbabe07c19f572f7cbd16fef"},{"sha":"50e376f1fe3bf571d0645ddf48ad37eb58323919","url":"https://git.kernel.org/stable/c/50e376f1fe3bf571d0645ddf48ad37eb58323919"}],"evidence":[],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"within-limit","patches":[{"sha":"8151a6c13111b465dbabe07c19f572f7cbd16fef","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/8151a6c13111b465dbabe07c19f572f7cbd16fef.patch"},{"sha":"50e376f1fe3bf571d0645ddf48ad37eb58323919","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/50e376f1fe3bf571d0645ddf48ad37eb58323919.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47683","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47683.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47662","title":"drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection","status":"not-applicable","project":false,"upstream":[{"sha":"466423c6dd8af23ebb3a69d43434d01aed0db356","url":"https://git.kernel.org/stable/c/466423c6dd8af23ebb3a69d43434d01aed0db356"}],"evidence":[],"submission_lore":[],"basis":"The DCN35 diagnostic path and prohibited register read are absent from both targets.","review":{"id":"CVE-2024-47662","series":"6.6.y","upstream":["466423c6dd8af23ebb3a69d43434d01aed0db356"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The DCN35 diagnostic path and prohibited register read are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"466423c6dd8af23ebb3a69d43434d01aed0db356","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/466423c6dd8af23ebb3a69d43434d01aed0db356.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47662","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47662.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47661","title":"drm/amd/display: Avoid overflow from uint32_t to uint8_t","status":"backported","project":false,"upstream":[{"sha":"d6b54900c564e35989cf6813e4071504fa0a90e0","url":"https://git.kernel.org/stable/c/d6b54900c564e35989cf6813e4071504fa0a90e0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6fc6ef4cd858a45479fed881e326d2449a2c9e51","label":"6fc6ef4cd858","date":"2026-10-21T10:27:25+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2024-47661","series":"6.6.y","upstream":["d6b54900c564e35989cf6813e4071504fa0a90e0"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"no-op","applicability":"unknown","reason":"The proposed write is an effective no-op because 0xffff already truncates to 0xff in the target field.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"d6b54900c564e35989cf6813e4071504fa0a90e0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46870","title":"drm/amd/display: Disable DMCUB timeout for DCN35","status":"not-applicable","project":false,"upstream":[{"sha":"7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f","url":"https://git.kernel.org/stable/c/7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f"}],"evidence":[],"submission_lore":[],"basis":"The DCN35 IPS and DMCUB timeout path is absent from both targets.","review":{"id":"CVE-2024-46870","series":"6.6.y","upstream":["7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The DCN35 IPS and DMCUB timeout path is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46842","title":"scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info","status":"backported","project":true,"upstream":[{"sha":"ede596b1434b57c0b3fd5c02b326efe5c54f6e48","url":"https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c6d8cce685d6088d795b29a0f47e6fd04548fd64","label":"c6d8cce685d6","date":"2026-10-21T10:26:52+02:00","lore":["https://lore.kernel.org/r/20240628172011.25921-6-justintee8345@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ede596b1434b57c0b3fd5c02b326efe5c54f6e48","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46842","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46842.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46834","title":"ethtool: fail closed if we can't get max channel used in indirection tables","status":"backported","project":true,"upstream":[{"sha":"2899d58462ba868287d6ff3acad3675e7adf934f","url":"https://git.kernel.org/stable/c/2899d58462ba868287d6ff3acad3675e7adf934f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7e6ff8c58985fbe20d131112aba0a8867cdedc59","label":"7e6ff8c58985","date":"2026-10-21T10:26:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2899d58462ba868287d6ff3acad3675e7adf934f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46813","title":"drm/amd/display: Check link_index before accessing dc->links[]","status":"backported","project":false,"upstream":[{"sha":"8aa2864044b9d13e95fe224f32e808afbf79ecdf","url":"https://git.kernel.org/stable/c/8aa2864044b9d13e95fe224f32e808afbf79ecdf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/032c5407a608ac3b2a98bf4fbda27d12c20c5887","label":"032c5407a608","date":"2025-04-10T14:37:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8aa2864044b9d13e95fe224f32e808afbf79ecdf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46813","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46813.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46808","title":"drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range","status":"backported","project":false,"upstream":[{"sha":"5524fa301ba649f8cf00848f91468e0ba7e4f24c","url":"https://git.kernel.org/stable/c/5524fa301ba649f8cf00848f91468e0ba7e4f24c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/117df33ecfd8ab41cde8e582ec90d3cb8d82ee9d","label":"117df33ecfd8","date":"2026-10-21T10:27:25+02:00","lore":[]}],"submission_lore":[],"basis":"The allocation path is absent, and the upstream ASSERT would not prevent a NULL dereference if transplanted elsewhere.","review":{"id":"CVE-2024-46808","series":"6.6.y","upstream":["5524fa301ba649f8cf00848f91468e0ba7e4f24c"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The allocation path is absent, and the upstream ASSERT would not prevent a NULL dereference if transplanted elsewhere.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"5524fa301ba649f8cf00848f91468e0ba7e4f24c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46806","title":"drm/amdgpu: Fix the warning division or modulo by zero","status":"backported","project":false,"upstream":[{"sha":"1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c","url":"https://git.kernel.org/stable/c/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d116bb921e8b104f45d1f30a473ea99ef4262b9a","label":"d116bb921e8b","date":"2024-09-08T07:54:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46776","title":"drm/amd/display: Run DC_LOG_DC after checking link->link_enc","status":"backported","project":false,"upstream":[{"sha":"3a82f62b0d9d7687eac47603bb6cd14a50fa718b","url":"https://git.kernel.org/stable/c/3a82f62b0d9d7687eac47603bb6cd14a50fa718b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/874e3bb302f97b94ac548959ec4f925b8e7b45e2","label":"874e3bb302f9","date":"2024-09-12T11:11:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a82f62b0d9d7687eac47603bb6cd14a50fa718b","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/3a82f62b0d9d7687eac47603bb6cd14a50fa718b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46776","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46776.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46775","title":"drm/amd/display: Validate function returns","status":"backported","project":true,"upstream":[{"sha":"673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c","url":"https://git.kernel.org/stable/c/673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e2379b2e343e34f8f73f5d9f0e348b0b203ff68f","label":"e2379b2e343e","date":"2026-10-03T12:31:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46760","title":"wifi: rtw88: usb: schedule rx work after everything is set up","status":"backported","project":false,"upstream":[{"sha":"adc539784c98a7cc602cbf557debfc2e7b9be8b3","url":"https://git.kernel.org/stable/c/adc539784c98a7cc602cbf557debfc2e7b9be8b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c83d464b82a8ad62ec9077637f75d73fe955635a","label":"c83d464b82a8","date":"2024-09-12T11:11:36+02:00","lore":["https://lore.kernel.org/linux-wireless/CA+shoWQ7P49jhQasofDcTdQhiuarPTjYEDa--NiVVx494WcuQw@mail.gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"adc539784c98a7cc602cbf557debfc2e7b9be8b3","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/adc539784c98a7cc602cbf557debfc2e7b9be8b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46760","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46760.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46754","title":"bpf: Remove tst_run from lwt_seg6local_prog_ops.","status":"backported","project":false,"upstream":[{"sha":"c13fda93aca118b8e5cd202e339046728ee7dddb","url":"https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e217492f6fa2228ad703ee3006d8fc4e5969fbd4","label":"e217492f6fa2","date":"2026-09-02T14:29:16+02:00","lore":["https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"c13fda93aca118b8e5cd202e339046728ee7dddb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46754","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46754.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46730","title":"drm/amd/display: Ensure array index tg_inst won't be -1","status":"backported","project":true,"upstream":[{"sha":"687fe329f18ab0ab0496b20ed2cb003d4879d931","url":"https://git.kernel.org/stable/c/687fe329f18ab0ab0496b20ed2cb003d4879d931"}],"evidence":[{"url":"https://git.kernel.org/stable/c/15403445b873a4ce45b2d4ecfb5928a025297282","label":"15403445b873","date":"2026-10-03T12:31:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"687fe329f18ab0ab0496b20ed2cb003d4879d931","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46730","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46730.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46729","title":"drm/amd/display: Fix incorrect size calculation for loop","status":"not-applicable","project":false,"upstream":[{"sha":"3941a3aa4b653b69876d894d08f3fff1cc965267","url":"https://git.kernel.org/stable/c/3941a3aa4b653b69876d894d08f3fff1cc965267"}],"evidence":[],"submission_lore":[],"basis":"The DCN35 DCCG path and fe_clk_en loop are absent from both targets.","review":{"id":"CVE-2024-46729","series":"6.6.y","upstream":["3941a3aa4b653b69876d894d08f3fff1cc965267"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The DCN35 DCCG path and fe_clk_en loop are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"3941a3aa4b653b69876d894d08f3fff1cc965267","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3941a3aa4b653b69876d894d08f3fff1cc965267.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46729","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46729.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46728","title":"drm/amd/display: Check index for aux_rd_interval before using","status":"backported","project":false,"upstream":[{"sha":"9ba2ea6337b4f159aecb177555a6a81da92d302e","url":"https://git.kernel.org/stable/c/9ba2ea6337b4f159aecb177555a6a81da92d302e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/48e0b68e2360b16edf2a0bae05c0051c00fbb48a","label":"48e0b68e2360","date":"2024-09-08T07:54:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9ba2ea6337b4f159aecb177555a6a81da92d302e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46728","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46728.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46727","title":"drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update","status":"not-applicable","project":false,"upstream":[{"sha":"871cd9d881fa791d3f82885000713de07041c0ae","url":"https://git.kernel.org/stable/c/871cd9d881fa791d3f82885000713de07041c0ae"}],"evidence":[],"submission_lore":[],"basis":"The topology logger, phantom-stream lookup, and otg_master consumer are absent from both targets.","review":{"id":"CVE-2024-46727","series":"6.6.y","upstream":["871cd9d881fa791d3f82885000713de07041c0ae"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The topology logger, phantom-stream lookup, and otg_master consumer are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"871cd9d881fa791d3f82885000713de07041c0ae","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/871cd9d881fa791d3f82885000713de07041c0ae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46727","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46727.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46701","title":"libfs: fix infinite directory reads for offset dir","status":"unfixed","project":false,"upstream":[{"sha":"64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a","url":"https://git.kernel.org/stable/c/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46701","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46701.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46698","title":"video/aperture: optionally match the device in sysfb_disable()","status":"unfixed","project":false,"upstream":[{"sha":"b49420d6a1aeb399e5b107fc6eb8584d0860fbd7","url":"https://git.kernel.org/stable/c/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"b49420d6a1aeb399e5b107fc6eb8584d0860fbd7","lines":108,"reason":"","source":"https://github.com/torvalds/linux/commit/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46698","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46698.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46682","title":"nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open","status":"unfixed","project":false,"upstream":[{"sha":"a204501e1743d695ca2930ed25a2be9f8ced96d3","url":"https://git.kernel.org/stable/c/a204501e1743d695ca2930ed25a2be9f8ced96d3"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a204501e1743d695ca2930ed25a2be9f8ced96d3","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/a204501e1743d695ca2930ed25a2be9f8ced96d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46682","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46682.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46678","title":"bonding: change ipsec_lock from spin lock to mutex","status":"backported","project":false,"upstream":[{"sha":"2aeeef906d5a526dc60cf4af92eda69836c39b1f","url":"https://git.kernel.org/stable/c/2aeeef906d5a526dc60cf4af92eda69836c39b1f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6b598069164ac1bb60996d6ff94e7f9169dbd2d3","label":"6b598069164a","date":"2024-09-04T13:28:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2aeeef906d5a526dc60cf4af92eda69836c39b1f","lines":199,"reason":"","source":"https://github.com/torvalds/linux/commit/2aeeef906d5a526dc60cf4af92eda69836c39b1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46678","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46678.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-45015","title":"drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()","status":"backported","project":false,"upstream":[{"sha":"aedf02e46eb549dac8db4821a6b9f0c6bf6e3990","url":"https://git.kernel.org/stable/c/aedf02e46eb549dac8db4821a6b9f0c6bf6e3990"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3fb61718bcbe309279205d1cc275a6435611dc77","label":"3fb61718bcbe","date":"2024-08-29T17:33:51+02:00","lore":["https://lore.kernel.org/r/20240731191723.3050932-1-quic_abhinavk@quicinc.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aedf02e46eb549dac8db4821a6b9f0c6bf6e3990","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/aedf02e46eb549dac8db4821a6b9f0c6bf6e3990.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-45015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-45015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43901","title":"drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401","status":"not-applicable","project":false,"upstream":[{"sha":"5af757124792817f8eb1bd0c80ad60fab519586b","url":"https://git.kernel.org/stable/c/5af757124792817f8eb1bd0c80ad60fab519586b"}],"evidence":[],"submission_lore":[],"basis":"The DCN401 color-state logging path fixed upstream is absent from both targets.","review":{"id":"CVE-2024-43901","series":"6.6.y","upstream":["5af757124792817f8eb1bd0c80ad60fab519586b"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The DCN401 color-state logging path fixed upstream is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"5af757124792817f8eb1bd0c80ad60fab519586b","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/5af757124792817f8eb1bd0c80ad60fab519586b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43899","title":"drm/amd/display: Fix null pointer deref in dcn20_resource.c","status":"backported","project":false,"upstream":[{"sha":"ecbf60782662f0a388493685b85a645a0ba1613c","url":"https://git.kernel.org/stable/c/ecbf60782662f0a388493685b85a645a0ba1613c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6940c1d0c84a34d5a2038714c218238101a1db5b","label":"6940c1d0c84a","date":"2026-01-11T15:22:25+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ecbf60782662f0a388493685b85a645a0ba1613c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43888","title":"mm: list_lru: fix UAF for memory cgroup","status":"unfixed","project":false,"upstream":[{"sha":"5161b48712dcd08ec427c450399d4d1483e21dea","url":"https://git.kernel.org/stable/c/5161b48712dcd08ec427c450399d4d1483e21dea"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5161b48712dcd08ec427c450399d4d1483e21dea","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/5161b48712dcd08ec427c450399d4d1483e21dea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43888","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43888.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43872","title":"RDMA/hns: Fix soft lockup under heavy CEQE load","status":"unfixed","project":false,"upstream":[{"sha":"2fdf34038369c0a27811e7b4680662a14ada1d6b","url":"https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2fdf34038369c0a27811e7b4680662a14ada1d6b","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/2fdf34038369c0a27811e7b4680662a14ada1d6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43824","title":"PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()","status":"backported","project":false,"upstream":[{"sha":"5a5095a8bd1bd349cce1c879e5e44407a34dda8a","url":"https://git.kernel.org/stable/c/5a5095a8bd1bd349cce1c879e5e44407a34dda8a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/97cee643a825808711cc78475fd61a30824b7a0f","label":"97cee643a825","date":"2026-10-21T10:27:24+02:00","lore":["https://lore.kernel.org/linux-pci/024b5826-7180-4076-ae08-57d2584cca3f@moroto.mountain","https://lore.kernel.org/linux-pci/20240418-pci-epf-test-fix-v2-1-eacd54831444@linaro.org"]}],"submission_lore":[],"basis":"The upstream changelog identifies a false-positive warning and states that the alleged NULL dereference is impossible.","review":{"id":"CVE-2024-43824","series":"6.6.y","upstream":["5a5095a8bd1bd349cce1c879e5e44407a34dda8a"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"no-op","applicability":"unaffected","reason":"The upstream changelog identifies a false-positive warning and states that the alleged NULL dereference is impossible.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"5a5095a8bd1bd349cce1c879e5e44407a34dda8a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43824","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43824.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43819","title":"kvm: s390: Reject memory region operations for ucontrol VMs","status":"backported","project":true,"upstream":[{"sha":"7816e58967d0e6cadce05c8540b47ed027dc2499","url":"https://git.kernel.org/stable/c/7816e58967d0e6cadce05c8540b47ed027dc2499"}],"evidence":[{"url":"https://git.kernel.org/stable/c/705a8b8cc5a44b206096abb1bfdc8bc43b3c75c7","label":"705a8b8cc5a4","date":"2026-10-21T10:26:42+02:00","lore":["https://lore.kernel.org/r/20240624095902.29375-1-schlameuss@linux.ibm.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7816e58967d0e6cadce05c8540b47ed027dc2499","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43819","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43819.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42317","title":"mm/huge_memory: avoid PMD-size page cache if needed","status":"backported","project":false,"upstream":[{"sha":"d659b715e94ac039803d7601505d3473393fc0be","url":"https://git.kernel.org/stable/c/d659b715e94ac039803d7601505d3473393fc0be"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2011c0ebaf710194900f31e64e2ab7295037dbab","label":"2011c0ebaf71","date":"2026-10-21T10:27:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d659b715e94ac039803d7601505d3473393fc0be","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/d659b715e94ac039803d7601505d3473393fc0be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42239","title":"bpf: Fail bpf_timer_cancel when callback is being cancelled","status":"backported","project":false,"upstream":[{"sha":"d4523831f07a267a943f0dde844bf8ead7495f13","url":"https://git.kernel.org/stable/c/d4523831f07a267a943f0dde844bf8ead7495f13"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9369830518688ecd5b08ffc08ab3302ce2b5d0f7","label":"936983051868","date":"2024-07-18T13:21:14+02:00","lore":["https://lore.kernel.org/r/20240709185440.1104957-2-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d4523831f07a267a943f0dde844bf8ead7495f13","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42239","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42239.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42162","title":"gve: Account for stopped queues when reading NIC stats","status":"backported","project":false,"upstream":[{"sha":"af9bcf910b1f86244f39e15e701b2dc564b469a6","url":"https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/acf609843a848e2c22ccce98eef109330403380d","label":"acf609843a84","date":"2026-10-21T10:27:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"af9bcf910b1f86244f39e15e701b2dc564b469a6","lines":107,"reason":"","source":"https://github.com/torvalds/linux/commit/af9bcf910b1f86244f39e15e701b2dc564b469a6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42162","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42162.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42158","title":"s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings","status":"unfixed","project":false,"upstream":[{"sha":"22e6824622e8a8889df0f8fc4ed5aea0e702a694","url":"https://git.kernel.org/stable/c/22e6824622e8a8889df0f8fc4ed5aea0e702a694"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"22e6824622e8a8889df0f8fc4ed5aea0e702a694","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/22e6824622e8a8889df0f8fc4ed5aea0e702a694.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42158","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42158.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42123","title":"drm/amdgpu: fix double free err_addr pointer warnings","status":"backported","project":false,"upstream":[{"sha":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","url":"https://git.kernel.org/stable/c/506c245f3f1cd989cb89811a7f06e04ff8813a0d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1eb6c4a0d83d1f348d718f813706105eff8cfc74","label":"1eb6c4a0d83d","date":"2026-10-21T10:27:24+02:00","lore":[]}],"submission_lore":[],"basis":"The repeated UMC polling loop affected upstream is absent from these targets, so clearing the pointer has no observable effect.","review":{"id":"CVE-2024-42123","series":"6.6.y","upstream":["506c245f3f1cd989cb89811a7f06e04ff8813a0d"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The repeated UMC polling loop affected upstream is absent from these targets, so clearing the pointer has no observable effect.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42118","title":"drm/amd/display: Do not return negative stream id for array","status":"not-applicable","project":false,"upstream":[{"sha":"3ac31c9a707dd1c7c890b95333182f955e9dcb57","url":"https://git.kernel.org/stable/c/3ac31c9a707dd1c7c890b95333182f955e9dcb57"}],"evidence":[],"submission_lore":[],"basis":"The resource_stream_to_stream_idx() consumer and topology logger are absent from both targets.","review":{"id":"CVE-2024-42118","series":"6.6.y","upstream":["3ac31c9a707dd1c7c890b95333182f955e9dcb57"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The resource_stream_to_stream_idx() consumer and topology logger are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"3ac31c9a707dd1c7c890b95333182f955e9dcb57","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/3ac31c9a707dd1c7c890b95333182f955e9dcb57.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41932","title":"sched: fix warning in sched_setaffinity","status":"backported","project":false,"upstream":[{"sha":"70ee7947a29029736a1a06c73a48ff37674a851b","url":"https://git.kernel.org/stable/c/70ee7947a29029736a1a06c73a48ff37674a851b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d35130036d327b6c175d95db9ea8d64e1abd4a1b","label":"d35130036d32","date":"2026-10-21T10:27:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2024-41932","series":"6.6.y","upstream":["70ee7947a29029736a1a06c73a48ff37674a851b"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"applicable","applicability":"affected","reason":"__sched_setaffinity retains WARN_ON_ONCE for empty cpumask","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/sched/core.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/sched/core.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n8302"},{"label":"Upstream fix 70ee7947a290","url":"https://git.kernel.org/stable/c/70ee7947a29029736a1a06c73a48ff37674a851b"}]},"size":{"status":"within-limit","patches":[{"sha":"70ee7947a29029736a1a06c73a48ff37674a851b","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/70ee7947a29029736a1a06c73a48ff37674a851b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41085","title":"cxl/mem: Fix no cxl_nvd during pmem region auto-assembling","status":"backported","project":true,"upstream":[{"sha":"84ec985944ef34a34a1605b93ce401aa8737af96","url":"https://git.kernel.org/stable/c/84ec985944ef34a34a1605b93ce401aa8737af96"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bc262c6d32b6c1715e64220e2cbfa64a225cd266","label":"bc262c6d32b6","date":"2026-10-03T12:31:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"84ec985944ef34a34a1605b93ce401aa8737af96","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41082","title":"nvme-fabrics: use reserved tag for reg read/write command","status":"backported","project":true,"upstream":[{"sha":"7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa","url":"https://git.kernel.org/stable/c/7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cc91c461cf3902993364ea85d8814ba7786c95b1","label":"cc91c461cf39","date":"2026-10-03T12:31:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41082","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41082.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41045","title":"bpf: Defer work in bpf_timer_cancel_and_free","status":"backported","project":true,"upstream":[{"sha":"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69","url":"https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5eaa11c500ed07f505f86cec07d5593a71927e26","label":"5eaa11c500ed","date":"2026-10-03T12:31:16+02:00","lore":["https://lore.kernel.org/r/20240709185440.1104957-3-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41045","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41045.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41023","title":"sched/deadline: Fix task_struct reference leak","status":"backported","project":false,"upstream":[{"sha":"b58652db66c910c2245f5bee7deca41c12d707b9","url":"https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f8005214946fd1d9fefdeff19c6ce46d60de2cef","label":"f8005214946f","date":"2026-10-21T10:27:23+02:00","lore":["https://lore.kernel.org/r/20240620125618.11419-1-wander@redhat.com"]}],"submission_lore":[],"basis":"The leaking path is part of dl_server support, which is absent from both target scheduler trees. Backporting the isolated put_task_struct change would have no call site; importing dl_server is out of this small-fix tranche.","review":{"id":"CVE-2024-41023","series":"6.6.y","upstream":["b58652db66c910c2245f5bee7deca41c12d707b9"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The leaking path is part of dl_server support, which is absent from both target scheduler trees. Backporting the isolated put_task_struct change would have no call site; importing dl_server is out of this small-fix tranche.","source":"Historical applicability review, September 2026"},"size":{"status":"unknown","patches":[{"sha":"b58652db66c910c2245f5bee7deca41c12d707b9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41023","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41023.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40999","title":"net: ena: Add validation for completion descriptors consistency","status":"backported","project":true,"upstream":[{"sha":"b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7","url":"https://git.kernel.org/stable/c/b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/edb9a302cc9386142beffe5d9bbe4bfd36999eee","label":"edb9a302cc93","date":"2026-10-21T10:26:39+02:00","lore":["https://lore.kernel.org/r/20240512134637.25299-4-darinzon@amazon.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40979","title":"wifi: ath12k: fix kernel crash during resume","status":"backported","project":true,"upstream":[{"sha":"303c017821d88ebad887814114d4e5966d320b28","url":"https://git.kernel.org/stable/c/303c017821d88ebad887814114d4e5966d320b28"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7e323cb55705398123ae087d4870c44e0424e7c0","label":"7e323cb55705","date":"2026-10-03T12:31:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"303c017821d88ebad887814114d4e5966d320b28","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40979","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40979.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40975","title":"platform/x86: x86-android-tablets: Unregister devices in reverse order","status":"backported","project":false,"upstream":[{"sha":"3de0f2627ef849735f155c1818247f58404dddfe","url":"https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/36ff963c133a25ed1166a25c3ba8b357ea010fda","label":"36ff963c133a","date":"2024-12-09T10:31:42+01:00","lore":["https://lore.kernel.org/r/20240406125058.13624-1-hdegoede@redhat.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3de0f2627ef849735f155c1818247f58404dddfe","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40969","title":"f2fs: don't set RO when shutting down f2fs","status":"backported","project":false,"upstream":[{"sha":"3bdb7f161697e2d5123b89fe1778ef17a44858e7","url":"https://git.kernel.org/stable/c/3bdb7f161697e2d5123b89fe1778ef17a44858e7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1036d3ea7a32cb7cee00885c73a1f2ba7fbc499a","label":"1036d3ea7a32","date":"2024-06-27T13:49:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3bdb7f161697e2d5123b89fe1778ef17a44858e7","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/3bdb7f161697e2d5123b89fe1778ef17a44858e7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40969","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40969.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40965","title":"i2c: lpi2c: Avoid calling clk_get_rate during transfer","status":"backported","project":false,"upstream":[{"sha":"4268254a39484fc11ba991ae148bacbe75d9cc0a","url":"https://git.kernel.org/stable/c/4268254a39484fc11ba991ae148bacbe75d9cc0a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d038693e08adf9c162c6377800495e4f5a2df045","label":"d038693e08ad","date":"2024-12-09T10:31:40+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4268254a39484fc11ba991ae148bacbe75d9cc0a","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/4268254a39484fc11ba991ae148bacbe75d9cc0a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40965","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40965.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40918","title":"parisc: Try to fix random segmentation faults in package builds","status":"backported","project":false,"upstream":[{"sha":"72d95924ee35c8cd16ef52f912483ee938a34d49","url":"https://git.kernel.org/stable/c/72d95924ee35c8cd16ef52f912483ee938a34d49"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5bf196f1936bf93df31112fbdfb78c03537c07b0","label":"5bf196f1936b","date":"2024-06-21T14:38:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"72d95924ee35c8cd16ef52f912483ee938a34d49","lines":655,"reason":"","source":"https://github.com/torvalds/linux/commit/72d95924ee35c8cd16ef52f912483ee938a34d49.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-39508","title":"io_uring/io-wq: Use set_bit() and test_bit() at worker->flags","status":"backported","project":false,"upstream":[{"sha":"8a565304927fbd28c9f028c492b5c1714002cbab","url":"https://git.kernel.org/stable/c/8a565304927fbd28c9f028c492b5c1714002cbab"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ab702c3483db9046bab9f40306f1a28b22dbbdc0","label":"ab702c3483db","date":"2024-06-21T14:38:30+02:00","lore":["https://lore.kernel.org/r/20240507170002.2269003-1-leitao@debian.org"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8a565304927fbd28c9f028c492b5c1714002cbab","lines":137,"reason":"","source":"https://github.com/torvalds/linux/commit/8a565304927fbd28c9f028c492b5c1714002cbab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-39508","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-39508.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-39478","title":"crypto: starfive - Do not free stack buffer","status":"backported","project":true,"upstream":[{"sha":"d7f01649f4eaf1878472d3d3f480ae1e50d98f6c","url":"https://git.kernel.org/stable/c/d7f01649f4eaf1878472d3d3f480ae1e50d98f6c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bfd861dadd3a45de257b3d328bf49b64a6f9c5f1","label":"bfd861dadd3a","date":"2026-09-02T14:29:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d7f01649f4eaf1878472d3d3f480ae1e50d98f6c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-39478","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-39478.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-38608","title":"net/mlx5e: Fix netif state handling","status":"backported","project":true,"upstream":[{"sha":"3d5918477f94e4c2f064567875c475468e264644","url":"https://git.kernel.org/stable/c/3d5918477f94e4c2f064567875c475468e264644"}],"evidence":[{"url":"https://git.kernel.org/stable/c/70eca80d98a44f47cd1633d0c20bda8ae546b4d1","label":"70eca80d98a4","date":"2026-10-21T10:26:39+02:00","lore":["https://lore.kernel.org/r/20240509112951.590184-2-tariqt@nvidia.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3d5918477f94e4c2f064567875c475468e264644","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-38608","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-38608.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-38595","title":"net/mlx5: Fix peer devlink set for SF representor devlink port","status":"not-applicable","project":false,"upstream":[{"sha":"3c453e8cc672de1f9c662948dba43176bc68d7f0","url":"https://git.kernel.org/stable/c/3c453e8cc672de1f9c662948dba43176bc68d7f0"}],"evidence":[],"submission_lore":[],"basis":"The older SF probe does not contain the peer-devlink assignment-after-registration flow fixed upstream.","review":{"id":"CVE-2024-38595","series":"6.6.y","upstream":["3c453e8cc672de1f9c662948dba43176bc68d7f0"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The older SF probe does not contain the peer-devlink assignment-after-registration flow fixed upstream.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"3c453e8cc672de1f9c662948dba43176bc68d7f0","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/3c453e8cc672de1f9c662948dba43176bc68d7f0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-38595","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-38595.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36951","title":"drm/amdkfd: range check cp bad op exception interrupts","status":"backported","project":false,"upstream":[{"sha":"0cac183b98d8a8c692c98e8dba37df15a9e9210d","url":"https://git.kernel.org/stable/c/0cac183b98d8a8c692c98e8dba37df15a9e9210d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/41dc6791596656dd41100b85647ed489e1d5c2f2","label":"41dc67915966","date":"2024-05-17T12:02:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0cac183b98d8a8c692c98e8dba37df15a9e9210d","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/0cac183b98d8a8c692c98e8dba37df15a9e9210d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36951","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36951.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36949","title":"amd/amdkfd: sync all devices to wait all processes being evicted","status":"backported","project":false,"upstream":[{"sha":"d06af584be5a769d124b7302b32a033e9559761d","url":"https://git.kernel.org/stable/c/d06af584be5a769d124b7302b32a033e9559761d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b6f6626528fe724b512c34f3fb5946c36a135f58","label":"b6f6626528fe","date":"2024-05-17T12:02:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d06af584be5a769d124b7302b32a033e9559761d","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/d06af584be5a769d124b7302b32a033e9559761d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36024","title":"drm/amd/display: Disable idle reallow as part of command/gpint execution","status":"not-applicable","project":false,"upstream":[{"sha":"6226a5aa77370329e01ee8abe50a95e60618ce97","url":"https://git.kernel.org/stable/c/6226a5aa77370329e01ee8abe50a95e60618ce97"}],"evidence":[],"submission_lore":[],"basis":"The DCN35 wake, execute, and idle-reallow paths fixed upstream are absent from both targets.","review":{"id":"CVE-2024-36024","series":"6.6.y","upstream":["6226a5aa77370329e01ee8abe50a95e60618ce97"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The DCN35 wake, execute, and idle-reallow paths fixed upstream are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"6226a5aa77370329e01ee8abe50a95e60618ce97","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/6226a5aa77370329e01ee8abe50a95e60618ce97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36024","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36024.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35961","title":"net/mlx5: Register devlink first under devlink lock","status":"backported","project":false,"upstream":[{"sha":"c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8","url":"https://git.kernel.org/stable/c/c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8c91c60858473731bcdaf04fda99fcbcf84420d4","label":"8c91c6085847","date":"2024-04-17T11:19:30+02:00","lore":["https://lore.kernel.org/r/20240409190820.227554-3-tariqt@nvidia.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8","lines":106,"reason":"","source":"https://github.com/torvalds/linux/commit/c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35942","title":"pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain","status":"backported","project":false,"upstream":[{"sha":"697624ee8ad557ab5417f985d2c804241a7ad30d","url":"https://git.kernel.org/stable/c/697624ee8ad557ab5417f985d2c804241a7ad30d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9d3f959b426635c4da50dfc7b1306afd84d23e7c","label":"9d3f959b4266","date":"2024-04-13T13:07:30+02:00","lore":["https://lore.kernel.org/r/20240203165307.7806-5-aford173@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"697624ee8ad557ab5417f985d2c804241a7ad30d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35942","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35942.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35931","title":"drm/amdgpu: Skip do PCI error slot reset during RAS recovery","status":"unfixed","project":false,"upstream":[{"sha":"601429cca96b4af3be44172c3b64e4228515dbe1","url":"https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"601429cca96b4af3be44172c3b64e4228515dbe1","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/601429cca96b4af3be44172c3b64e4228515dbe1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35931","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35931.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35887","title":"ax25: fix use-after-free bugs caused by ax25_ds_del_timer","status":"backported","project":false,"upstream":[{"sha":"fd819ad3ecf6f3c232a06b27423ce9ed8c20da89","url":"https://git.kernel.org/stable/c/fd819ad3ecf6f3c232a06b27423ce9ed8c20da89"}],"evidence":[{"url":"https://git.kernel.org/stable/c/74204bf9050f7627aead9875fe4e07ba125cb19b","label":"74204bf9050f","date":"2024-04-10T16:35:53+02:00","lore":["https://lore.kernel.org/r/20240329015023.9223-1-duoming@zju.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fd819ad3ecf6f3c232a06b27423ce9ed8c20da89","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35887","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35887.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35843","title":"iommu/vt-d: Use device rbtree in iopf reporting path","status":"not-applicable","project":false,"upstream":[{"sha":"def054b01a867822254e1dda13d587f5c7a99e2a","url":"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"}],"evidence":[],"submission_lore":[],"basis":"The targets use a referenced pci_dev lookup and release it with pci_dev_put; the later raw-rbtree UAF path is absent.","review":{"id":"CVE-2024-35843","series":"6.6.y","upstream":["def054b01a867822254e1dda13d587f5c7a99e2a"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The targets use a referenced pci_dev lookup and release it with pci_dev_put; the later raw-rbtree UAF path is absent.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"def054b01a867822254e1dda13d587f5c7a99e2a","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/def054b01a867822254e1dda13d587f5c7a99e2a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35843","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35843.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35808","title":"md/dm-raid: don't call md_reap_sync_thread() directly","status":"not-applicable","project":false,"upstream":[{"sha":"cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","url":"https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0"}],"evidence":[],"submission_lore":[],"basis":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","review":{"id":"CVE-2024-35808","series":"6.6.y","upstream":["cd32b27a66db8776d8b8e82ec7d7dde97a8693b0"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35799","title":"drm/amd/display: Prevent crash when disable stream","status":"backported","project":false,"upstream":[{"sha":"72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c","url":"https://git.kernel.org/stable/c/72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4356a2c3f296503c8b420ae8adece053960a9f06","label":"4356a2c3f296","date":"2024-04-10T16:35:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35794","title":"dm-raid: really frozen sync_thread during suspend","status":"not-applicable","project":false,"upstream":[{"sha":"16c4770c75b1223998adbeb7286f9a15c65fba73","url":"https://git.kernel.org/stable/c/16c4770c75b1223998adbeb7286f9a15c65fba73"}],"evidence":[],"submission_lore":[],"basis":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","review":{"id":"CVE-2024-35794","series":"6.6.y","upstream":["16c4770c75b1223998adbeb7286f9a15c65fba73"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"16c4770c75b1223998adbeb7286f9a15c65fba73","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/16c4770c75b1223998adbeb7286f9a15c65fba73.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35794","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35794.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27079","title":"iommu/vt-d: Fix NULL domain on device release","status":"unfixed","project":false,"upstream":[{"sha":"81e921fd321614c2ad8ac333b041aae1da7a1c6d","url":"https://git.kernel.org/stable/c/81e921fd321614c2ad8ac333b041aae1da7a1c6d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"81e921fd321614c2ad8ac333b041aae1da7a1c6d","lines":121,"reason":"","source":"https://github.com/torvalds/linux/commit/81e921fd321614c2ad8ac333b041aae1da7a1c6d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27012","title":"netfilter: nf_tables: restore set elements when delete set fails","status":"unfixed","project":false,"upstream":[{"sha":"e79b47a8615d42c68aaeb68971593333667382ed","url":"https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"e79b47a8615d42c68aaeb68971593333667382ed","lines":201,"reason":"","source":"https://github.com/torvalds/linux/commit/e79b47a8615d42c68aaeb68971593333667382ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27012","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27012.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27010","title":"net/sched: Fix mirred deadlock on device recursion","status":"backported","project":true,"upstream":[{"sha":"0f022d32c3eca477fbf79a205243a6123ed0fe11","url":"https://git.kernel.org/stable/c/0f022d32c3eca477fbf79a205243a6123ed0fe11"}],"evidence":[{"url":"https://git.kernel.org/stable/c/524323f52cbfbac4fe3f8a33a8cc405fafba0d33","label":"524323f52cbf","date":"2026-09-02T14:29:17+02:00","lore":["https://lore.kernel.org/netdev/20240314111713.5979-1-renmingshuai@huawei.com/","https://lore.kernel.org/r/20240415210728.36949-1-victor@mojatatu.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0f022d32c3eca477fbf79a205243a6123ed0fe11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26962","title":"dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape","status":"unfixed","project":false,"upstream":[{"sha":"41425f96d7aa59bc865f60f5dda3d7697b555677","url":"https://git.kernel.org/stable/c/41425f96d7aa59bc865f60f5dda3d7697b555677"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"41425f96d7aa59bc865f60f5dda3d7697b555677","lines":217,"reason":"","source":"https://github.com/torvalds/linux/commit/41425f96d7aa59bc865f60f5dda3d7697b555677.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26962","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26962.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26948","title":"drm/amd/display: Add a dc_state NULL check in dc_state_release","status":"backported","project":true,"upstream":[{"sha":"334b56cea5d9df5989be6cf1a5898114fa70ad98","url":"https://git.kernel.org/stable/c/334b56cea5d9df5989be6cf1a5898114fa70ad98"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3218df42ff3b187f055edb8a38498b316bae0ecd","label":"3218df42ff3b","date":"2026-10-03T12:31:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"334b56cea5d9df5989be6cf1a5898114fa70ad98","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26948","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26948.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26944","title":"btrfs: zoned: fix use-after-free in do_zone_finish()","status":"unfixed","project":false,"upstream":[{"sha":"1ec17ef59168a1a6f1105f5dc517f783839a5302","url":"https://git.kernel.org/stable/c/1ec17ef59168a1a6f1105f5dc517f783839a5302"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1ec17ef59168a1a6f1105f5dc517f783839a5302","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/1ec17ef59168a1a6f1105f5dc517f783839a5302.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26914","title":"drm/amd/display: fix incorrect mpc_combine array size","status":"not-applicable","project":false,"upstream":[{"sha":"39079fe8e660851abbafa90cd55cbf029210661f","url":"https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"}],"evidence":[],"submission_lore":[],"basis":"The pipe_slice_table and mpc_combines array fixed upstream are absent from both targets.","review":{"id":"CVE-2024-26914","series":"6.6.y","upstream":["39079fe8e660851abbafa90cd55cbf029210661f"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The pipe_slice_table and mpc_combines array fixed upstream are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"39079fe8e660851abbafa90cd55cbf029210661f","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/39079fe8e660851abbafa90cd55cbf029210661f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26913","title":"drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue","status":"not-applicable","project":false,"upstream":[{"sha":"faf51b201bc42adf500945732abb6220c707d6f3","url":"https://git.kernel.org/stable/c/faf51b201bc42adf500945732abb6220c707d6f3"}],"evidence":[],"submission_lore":[],"basis":"The DML2/DCN35 translation path is absent from both targets.","review":{"id":"CVE-2024-26913","series":"6.6.y","upstream":["faf51b201bc42adf500945732abb6220c707d6f3"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The DML2/DCN35 translation path is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"faf51b201bc42adf500945732abb6220c707d6f3","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/faf51b201bc42adf500945732abb6220c707d6f3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26913","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26913.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26836","title":"platform/x86: think-lmi: Fix password opcode ordering for workstations","status":"backported","project":false,"upstream":[{"sha":"6f7d0f5fd8e440c3446560100ac4ff9a55eec340","url":"https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2deb10a99671afda30f834e95e5b992a805bba6a","label":"2deb10a99671","date":"2024-10-10T11:58:08+02:00","lore":["https://lore.kernel.org/r/20240209152359.528919-1-mpearson-lenovo@squebb.ca"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f7d0f5fd8e440c3446560100ac4ff9a55eec340","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/6f7d0f5fd8e440c3446560100ac4ff9a55eec340.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26836","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26836.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26768","title":"LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]","status":"backported","project":false,"upstream":[{"sha":"4551b30525cf3d2f026b92401ffe241eb04dfebe","url":"https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280","label":"88e189bd16e5","date":"2024-03-01T13:34:55+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4551b30525cf3d2f026b92401ffe241eb04dfebe","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/4551b30525cf3d2f026b92401ffe241eb04dfebe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26758","title":"md: Don't ignore suspended array in md_check_recovery()","status":"not-applicable","project":false,"upstream":[{"sha":"1baae052cccd08daf9a9d64c3f959d8cdb689757","url":"https://git.kernel.org/stable/c/1baae052cccd08daf9a9d64c3f959d8cdb689757"}],"evidence":[],"submission_lore":[],"basis":"The upstream change is for v6.7+ and fixes the f52f5c71 recovery flow, which is absent from both targets.","review":{"id":"CVE-2024-26758","series":"6.6.y","upstream":["1baae052cccd08daf9a9d64c3f959d8cdb689757"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The upstream change is for v6.7+ and fixes the f52f5c71 recovery flow, which is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"1baae052cccd08daf9a9d64c3f959d8cdb689757","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/1baae052cccd08daf9a9d64c3f959d8cdb689757.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26758","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26758.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26757","title":"md: Don't ignore read-only array in md_check_recovery()","status":"not-applicable","project":false,"upstream":[{"sha":"55a48ad2db64737f7ffc0407634218cc6e4c513b","url":"https://git.kernel.org/stable/c/55a48ad2db64737f7ffc0407634218cc6e4c513b"}],"evidence":[],"submission_lore":[],"basis":"The upstream change is for v6.7+ and fixes the f52f5c71 recovery flow, which is absent from both targets.","review":{"id":"CVE-2024-26757","series":"6.6.y","upstream":["55a48ad2db64737f7ffc0407634218cc6e4c513b"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The upstream change is for v6.7+ and fixes the f52f5c71 recovery flow, which is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"55a48ad2db64737f7ffc0407634218cc6e4c513b","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/55a48ad2db64737f7ffc0407634218cc6e4c513b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26757","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26757.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26756","title":"md: Don't register sync_thread for reshape directly","status":"not-applicable","project":false,"upstream":[{"sha":"ad39c08186f8a0f221337985036ba86731d6aafe","url":"https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe"}],"evidence":[],"submission_lore":[],"basis":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","review":{"id":"CVE-2024-26756","series":"6.6.y","upstream":["ad39c08186f8a0f221337985036ba86731d6aafe"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The upstream change is for v6.7+ and fixes the f52f5c71 reshape flow, which is absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"ad39c08186f8a0f221337985036ba86731d6aafe","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/ad39c08186f8a0f221337985036ba86731d6aafe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26756","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26756.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26691","title":"KVM: arm64: Fix circular locking dependency","status":"backported","project":false,"upstream":[{"sha":"10c02aad111df02088d1a81792a709f6a7eca6cc","url":"https://git.kernel.org/stable/c/10c02aad111df02088d1a81792a709f6a7eca6cc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3d16cebf01127f459dcfeb79ed77bd68b124c228","label":"3d16cebf0112","date":"2024-02-23T09:25:13+01:00","lore":["https://lore.kernel.org/r/20240124091027.1477174-2-sebastianene@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"10c02aad111df02088d1a81792a709f6a7eca6cc","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/10c02aad111df02088d1a81792a709f6a7eca6cc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26691","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26691.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26672","title":"drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'","status":"not-applicable","project":false,"upstream":[{"sha":"4f32504a2f85a7b40fe149436881381f48e9c0c0","url":"https://git.kernel.org/stable/c/4f32504a2f85a7b40fe149436881381f48e9c0c0"}],"evidence":[],"submission_lore":[],"basis":"The amdgpu_mca_smu_get_mca_entry() path and its mca_funcs getter are absent from both targets.","review":{"id":"CVE-2024-26672","series":"6.6.y","upstream":["4f32504a2f85a7b40fe149436881381f48e9c0c0"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"not-applicable","applicability":"unaffected","reason":"The amdgpu_mca_smu_get_mca_entry() path and its mca_funcs getter are absent from both targets.","source":"Historical applicability review, September 2026"},"size":{"status":"within-limit","patches":[{"sha":"4f32504a2f85a7b40fe149436881381f48e9c0c0","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/4f32504a2f85a7b40fe149436881381f48e9c0c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26672","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26672.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26662","title":"drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'","status":"backported","project":false,"upstream":[{"sha":"e96fddb32931d007db12b1fce9b5e8e4c080401b","url":"https://git.kernel.org/stable/c/e96fddb32931d007db12b1fce9b5e8e4c080401b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2e150ccea13129eb048679114808eb9770443e4d","label":"2e150ccea131","date":"2024-02-16T19:10:51+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e96fddb32931d007db12b1fce9b5e8e4c080401b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26662","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26662.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26661","title":"drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'","status":"backported","project":false,"upstream":[{"sha":"66951d98d9bf45ba25acf37fe0747253fafdf298","url":"https://git.kernel.org/stable/c/66951d98d9bf45ba25acf37fe0747253fafdf298"},{"sha":"17ba9cde11c2bfebbd70867b0a2ac4a22e573379","url":"https://git.kernel.org/stable/c/17ba9cde11c2bfebbd70867b0a2ac4a22e573379"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"66951d98d9bf45ba25acf37fe0747253fafdf298","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/66951d98d9bf45ba25acf37fe0747253fafdf298.patch"},{"sha":"17ba9cde11c2bfebbd70867b0a2ac4a22e573379","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/17ba9cde11c2bfebbd70867b0a2ac4a22e573379.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54280","title":"cifs: fix potential race when tree connecting ipc","status":"backported","project":false,"upstream":[{"sha":"ee20d7c6100752eaf2409d783f4f1449c29ea33d","url":"https://git.kernel.org/stable/c/ee20d7c6100752eaf2409d783f4f1449c29ea33d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ee20d7c6100752eaf2409d783f4f1449c29ea33d","lines":81,"reason":"","source":"https://github.com/torvalds/linux/commit/ee20d7c6100752eaf2409d783f4f1449c29ea33d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54280","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54280.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54263","title":"drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP","status":"backported","project":false,"upstream":[{"sha":"ea293f823a8805735d9e00124df81a8f448ed1ae","url":"https://git.kernel.org/stable/c/ea293f823a8805735d9e00124df81a8f448ed1ae"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ea293f823a8805735d9e00124df81a8f448ed1ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54263","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54263.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54233","title":"ASoC: SOF: avoid a NULL dereference with unsupported widgets","status":"backported","project":false,"upstream":[{"sha":"e3720f92e0237921da537e47a0b24e27899203f8","url":"https://git.kernel.org/stable/c/e3720f92e0237921da537e47a0b24e27899203f8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e3720f92e0237921da537e47a0b24e27899203f8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54233","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54233.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54227","title":"blk-mq: fix tags leak when shrink nr_hw_queues","status":"backported","project":false,"upstream":[{"sha":"e1dd7bc93029024af5688253b0c05181d6e01f8e","url":"https://git.kernel.org/stable/c/e1dd7bc93029024af5688253b0c05181d6e01f8e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e1dd7bc93029024af5688253b0c05181d6e01f8e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54227","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54227.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54141","title":"wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018","status":"backported","project":false,"upstream":[{"sha":"ce282d8de71f07f0056ea319541141152c65f552","url":"https://git.kernel.org/stable/c/ce282d8de71f07f0056ea319541141152c65f552"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ce282d8de71f07f0056ea319541141152c65f552","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54141","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54141.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54030","title":"io_uring/net: don't overflow multishot recv","status":"backported","project":false,"upstream":[{"sha":"b2e74db55dd93d6db22a813c9a775b5dbf87c560","url":"https://git.kernel.org/stable/c/b2e74db55dd93d6db22a813c9a775b5dbf87c560"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b2e74db55dd93d6db22a813c9a775b5dbf87c560","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b2e74db55dd93d6db22a813c9a775b5dbf87c560.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54030","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54030.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53999","title":"net/mlx5e: TC, Fix internal port memory leak","status":"backported","project":false,"upstream":[{"sha":"ac5da544a3c2047cbfd715acd9cec8380d7fe5c6","url":"https://git.kernel.org/stable/c/ac5da544a3c2047cbfd715acd9cec8380d7fe5c6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ac5da544a3c2047cbfd715acd9cec8380d7fe5c6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53857","title":"bpf: bpf_sk_storage: Fix invalid wait context lockdep report","status":"backported","project":false,"upstream":[{"sha":"a96a44aba556c42b432929d37d60158aca21ad4c","url":"https://git.kernel.org/stable/c/a96a44aba556c42b432929d37d60158aca21ad4c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a96a44aba556c42b432929d37d60158aca21ad4c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53857","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53857.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53851","title":"drm/msm/dp: Drop aux devices together with DP controller","status":"backported","project":false,"upstream":[{"sha":"a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d","url":"https://git.kernel.org/stable/c/a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53851","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53851.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53762","title":"Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync","status":"backported","project":false,"upstream":[{"sha":"94d9ba9f9888b748d4abd2aa1547af56ae85f772","url":"https://git.kernel.org/stable/c/94d9ba9f9888b748d4abd2aa1547af56ae85f772"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"94d9ba9f9888b748d4abd2aa1547af56ae85f772","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53627","title":"scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list","status":"backported","project":false,"upstream":[{"sha":"71fb36b5ff113a7674710b9d6063241eada84ff7","url":"https://git.kernel.org/stable/c/71fb36b5ff113a7674710b9d6063241eada84ff7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"71fb36b5ff113a7674710b9d6063241eada84ff7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53627","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53627.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53574","title":"wifi: rtw88: delete timer and free skb queue when unloading","status":"backported","project":false,"upstream":[{"sha":"634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216","url":"https://git.kernel.org/stable/c/634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53574","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53574.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53538","title":"btrfs: insert tree mod log move in push_node_left","status":"backported","project":false,"upstream":[{"sha":"5cead5422a0e3d13b0bcee986c0f5c4ebb94100b","url":"https://git.kernel.org/stable/c/5cead5422a0e3d13b0bcee986c0f5c4ebb94100b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5cead5422a0e3d13b0bcee986c0f5c4ebb94100b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53529","title":"wifi: rtw88: Fix memory leak in rtw88_usb","status":"backported","project":false,"upstream":[{"sha":"59a3a312009723e3e5082899655fdcc420e2b47a","url":"https://git.kernel.org/stable/c/59a3a312009723e3e5082899655fdcc420e2b47a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"59a3a312009723e3e5082899655fdcc420e2b47a","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/59a3a312009723e3e5082899655fdcc420e2b47a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53529","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53529.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53460","title":"wifi: rtw88: fix memory leak in rtw_usb_probe()","status":"backported","project":false,"upstream":[{"sha":"48181d285623198c33bb9698992502687b258efa","url":"https://git.kernel.org/stable/c/48181d285623198c33bb9698992502687b258efa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"48181d285623198c33bb9698992502687b258efa","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/48181d285623198c33bb9698992502687b258efa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53460","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53460.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53429","title":"btrfs: don't check PageError in __extent_writepage","status":"backported","project":false,"upstream":[{"sha":"3e92499e3b004baffb479d61e191b41b604ece9a","url":"https://git.kernel.org/stable/c/3e92499e3b004baffb479d61e191b41b604ece9a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3e92499e3b004baffb479d61e191b41b604ece9a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53429","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53429.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53367","title":"accel/habanalabs: fix mem leak in capture user mappings","status":"backported","project":false,"upstream":[{"sha":"314a7ffd7c196b27eedd50cb7553029e17789b55","url":"https://git.kernel.org/stable/c/314a7ffd7c196b27eedd50cb7553029e17789b55"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"314a7ffd7c196b27eedd50cb7553029e17789b55","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/314a7ffd7c196b27eedd50cb7553029e17789b55.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53367","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53367.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53353","title":"accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()","status":"backported","project":false,"upstream":[{"sha":"2e8e9a895c4589f124a37fc84d123b5114406e94","url":"https://git.kernel.org/stable/c/2e8e9a895c4589f124a37fc84d123b5114406e94"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2e8e9a895c4589f124a37fc84d123b5114406e94","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53353","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53353.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53336","title":"media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings","status":"backported","project":false,"upstream":[{"sha":"284be5693163343e1cf17c03917eecd1d6681bcf","url":"https://git.kernel.org/stable/c/284be5693163343e1cf17c03917eecd1d6681bcf"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"284be5693163343e1cf17c03917eecd1d6681bcf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53336","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53336.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53231","title":"erofs: Fix detection of atomic context","status":"backported","project":false,"upstream":[{"sha":"12d0a24afd9ea58e581ea64d64e066f2027b28d9","url":"https://git.kernel.org/stable/c/12d0a24afd9ea58e581ea64d64e066f2027b28d9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"12d0a24afd9ea58e581ea64d64e066f2027b28d9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53231","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53231.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53218","title":"rxrpc: Make it so that a waiting process can be aborted","status":"backported","project":false,"upstream":[{"sha":"0eb362d254814ce04848730bf32e75b8ee1a4d6c","url":"https://git.kernel.org/stable/c/0eb362d254814ce04848730bf32e75b8ee1a4d6c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0eb362d254814ce04848730bf32e75b8ee1a4d6c","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/0eb362d254814ce04848730bf32e75b8ee1a4d6c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53218","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53218.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52920","title":"bpf: support non-r10 register spill/fill to/from stack in precision tracking","status":"backported","project":false,"upstream":[{"sha":"41f6f64e6999a837048b1bd13a2f8742964eca6b","url":"https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e4da60feca4d35e1a9b03dc0affa3354f9ff45e4","label":"e4da60feca4d","date":"2026-05-17T17:13:36+02:00","lore":["https://lore.kernel.org/r/20231205184248.1502704-2-andrii@kernel.org"]},{"url":"https://git.kernel.org/stable/c/199f0452873741fa4b8d4d88958e929030b2f92b","label":"199f04528737","date":"2025-01-09T13:32:06+01:00","lore":["https://lore.kernel.org/stable/MEYP282MB2312C3C8801476C4F262D6E1C6162@MEYP282MB2312.AUSP282.PROD.OUTLOOK.COM/"]},{"url":"https://git.kernel.org/stable/c/ecc2aeeaa08a355d84d3ca9c3d2512399a194f29","label":"ecc2aeeaa08a","date":"2024-12-09T10:31:42+01:00","lore":["https://lore.kernel.org/r/20231205184248.1502704-2-andrii@kernel.org"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"41f6f64e6999a837048b1bd13a2f8742964eca6b","lines":496,"reason":"","source":"https://github.com/torvalds/linux/commit/41f6f64e6999a837048b1bd13a2f8742964eca6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52888","title":"media: mediatek: vcodec: Only free buffer VA that is not NULL","status":"backported","project":false,"upstream":[{"sha":"eb005c801ec70ff4307727bd3bd6e8280169ef32","url":"https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5c217253c76c94f76d1df31d0bbdcb88dc07be91","label":"5c217253c76c","date":"2024-07-11T12:49:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"eb005c801ec70ff4307727bd3bd6e8280169ef32","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52888","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52888.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52797","title":"drivers: perf: Check find_first_bit() return value","status":"backported","project":false,"upstream":[{"sha":"c6e316ac05532febb0c966fa9b55f5258ed037be","url":"https://git.kernel.org/stable/c/c6e316ac05532febb0c966fa9b55f5258ed037be"}],"evidence":[{"url":"https://git.kernel.org/stable/c/45a0de41ec383c8b7c6d442734ba3852dd2fc4a7","label":"45a0de41ec38","date":"2023-11-28T17:19:54Z","lore":["https://lore.kernel.org/r/20231109082128.40777-1-alexghiti@rivosinc.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6e316ac05532febb0c966fa9b55f5258ed037be","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/c6e316ac05532febb0c966fa9b55f5258ed037be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52676","title":"bpf: Guard stack limits against 32bit overflow","status":"backported","project":false,"upstream":[{"sha":"1d38a9ee81570c4bd61f557832dead4d6f816760","url":"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2","label":"ad140fc856f0","date":"2024-01-25T15:35:24-08:00","lore":["https://lore.kernel.org/bpf/20231207041150.229139-4-andreimatei1@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1d38a9ee81570c4bd61f557832dead4d6f816760","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52676","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52676.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52671","title":"drm/amd/display: Fix hang/underflow when transitioning to ODM4:1","status":"backported","project":false,"upstream":[{"sha":"e7b2b108cdeab76a7e7324459e50b0c1214c0386","url":"https://git.kernel.org/stable/c/e7b2b108cdeab76a7e7324459e50b0c1214c0386"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ae62f1dde66a6f0eee98defc4c7a346bd5acd239","label":"ae62f1dde66a","date":"2024-04-03T15:28:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e7b2b108cdeab76a7e7324459e50b0c1214c0386","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52671","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52671.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52648","title":"drm/vmwgfx: Unmap the surface before resetting it on a plane state","status":"backported","project":false,"upstream":[{"sha":"27571c64f1855881753e6f33c3186573afbab7ba","url":"https://git.kernel.org/stable/c/27571c64f1855881753e6f33c3186573afbab7ba"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0a23f95af7f28dae7c0f7c82578ca5e1a239d461","label":"0a23f95af7f2","date":"2024-04-03T15:28:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"27571c64f1855881753e6f33c3186573afbab7ba","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/27571c64f1855881753e6f33c3186573afbab7ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52648","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52648.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52629","title":"sh: push-switch: Reorder cleanup operations to avoid use-after-free bug","status":"backported","project":false,"upstream":[{"sha":"246f80a0b17f8f582b2c0996db02998239057c65","url":"https://git.kernel.org/stable/c/246f80a0b17f8f582b2c0996db02998239057c65"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"246f80a0b17f8f582b2c0996db02998239057c65","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52629","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52629.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52625","title":"drm/amd/display: Refactor DMCUB enter/exit idle interface","status":"unfixed","project":false,"upstream":[{"sha":"8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa","url":"https://git.kernel.org/stable/c/8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa","lines":118,"reason":"","source":"https://github.com/torvalds/linux/commit/8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52625","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52625.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52624","title":"drm/amd/display: Wake DMCUB before executing GPINT commands","status":"unfixed","project":false,"upstream":[{"sha":"e5ffd1263dd5b44929c676171802e7b6af483f21","url":"https://git.kernel.org/stable/c/e5ffd1263dd5b44929c676171802e7b6af483f21"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"e5ffd1263dd5b44929c676171802e7b6af483f21","lines":213,"reason":"","source":"https://github.com/torvalds/linux/commit/e5ffd1263dd5b44929c676171802e7b6af483f21.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52624","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52624.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52590","title":"ocfs2: Avoid touching renamed directory if parent does not change","status":"backported","project":true,"upstream":[{"sha":"9d618d19b29c2943527e3a43da0a35aea91062fc","url":"https://git.kernel.org/stable/c/9d618d19b29c2943527e3a43da0a35aea91062fc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1743d5a678048735d6d0e88cdede3b88d8234725","label":"1743d5a67804","date":"2026-10-21T10:26:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9d618d19b29c2943527e3a43da0a35aea91062fc","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52590","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52590.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2021-47645","title":"media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com","status":"not-applicable","project":false,"upstream":[{"sha":"e3b86f4e558cea9eed71d894df2f19b10d60a207","url":"https://git.kernel.org/stable/c/e3b86f4e558cea9eed71d894df2f19b10d60a207"},{"sha":"8dce4b265a5357731058f69645840dabc718c687","url":"https://git.kernel.org/stable/c/8dce4b265a5357731058f69645840dabc718c687"}],"evidence":[],"submission_lore":[],"basis":"The relocated Zoran driver already uses the corrected even buffer index and checks for a NULL buffer in zoran_reap_stat_com. Both effective fix changes are present. The separate 2019 driver-removal commit is not required for this restored driver implementation.","review":{"id":"CVE-2021-47645","series":"6.6.y","upstream":["e3b86f4e558cea9eed71d894df2f19b10d60a207","8dce4b265a5357731058f69645840dabc718c687"],"checked_sha":"79643295eba17affbd16ca97f3ef04c90266b28c","checked_version":"6.6.157","kind":"already-fixed","applicability":"fixed","reason":"The relocated Zoran driver already uses the corrected even buffer index and checks for a NULL buffer in zoran_reap_stat_com. Both effective fix changes are present. The separate 2019 driver-removal commit is not required for this restored driver implementation.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/media/pci/zoran/zoran_device.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/media/pci/zoran/zoran_device.c?id=79643295eba17affbd16ca97f3ef04c90266b28c#n794"},{"label":"Upstream fix 8dce4b265a53","url":"https://git.kernel.org/stable/c/8dce4b265a5357731058f69645840dabc718c687"},{"label":"Upstream fix e3b86f4e558c","url":"https://git.kernel.org/stable/c/e3b86f4e558cea9eed71d894df2f19b10d60a207"}]},"size":{"status":"over-limit","patches":[{"sha":"e3b86f4e558cea9eed71d894df2f19b10d60a207","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/e3b86f4e558cea9eed71d894df2f19b10d60a207.patch"},{"sha":"8dce4b265a5357731058f69645840dabc718c687","lines":11302,"reason":"","source":"https://github.com/torvalds/linux/commit/8dce4b265a5357731058f69645840dabc718c687.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2021-47645","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2021/CVE-2021-47645.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"}],"counts":{"backported":81,"queued":1,"unfixed":331,"unknown":5,"not-applicable":166},"triage_counts":{"over-limit":78,"within-limit":253,"size-unknown":0,"already-fixed":2,"applicable":29,"ineffective-fix":1,"needs-review":1,"no-op":11,"not-applicable":47}},{"series":"6.12.y","ref":"FETCH_HEAD","sha":"85d82e0d7c2dfd3e75d34f35b7ebbf41f45c9c4e","committed_at":"2026-10-21T10:31:09+02:00","version":"6.12.114","records":[{"id":"CVE-2026-100073","title":"ext4: fix transaction overflow during writeback","status":"not-applicable","project":false,"upstream":[{"sha":"46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","url":"https://git.kernel.org/stable/c/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-100073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-100073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-100072","title":"ACPI: platform: Use acpi_bus_get_primary_device()","status":"backported","project":false,"upstream":[{"sha":"a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","url":"https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/527a497fb2ef77a95170eefe2007e2c4c957bd2c","label":"527a497fb2ef","date":"2026-10-21T10:31:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-100072","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-100072.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99215","title":"power: supply: core: prevent unregistering a power supply while a callback runs","status":"unfixed","project":false,"upstream":[{"sha":"5b4bd13e0552926648a46c2c9a12a24dfaee3715","url":"https://git.kernel.org/stable/c/5b4bd13e0552926648a46c2c9a12a24dfaee3715"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5b4bd13e0552926648a46c2c9a12a24dfaee3715","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/5b4bd13e0552926648a46c2c9a12a24dfaee3715.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99215","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99215.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99211","title":"netlink: reset skb headers before unicast and multicast filtering","status":"queued","project":false,"upstream":[{"sha":"8bf659bd54e1f00e34cf5244b1d289c506fa47c0","url":"https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.12/netlink-reset-skb-headers-before-unicast-and-multica.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8bf659bd54e1f00e34cf5244b1d289c506fa47c0","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/8bf659bd54e1f00e34cf5244b1d289c506fa47c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99209","title":"drm/xe: skip eviction of a BO with no resource","status":"unfixed","project":false,"upstream":[{"sha":"448e76cbdc6652ccd3ba337b7a6e1f028859f2ed","url":"https://git.kernel.org/stable/c/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"448e76cbdc6652ccd3ba337b7a6e1f028859f2ed","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99209","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99209.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99208","title":"drm/xe/oa: Zero OA buffer at allocation","status":"unfixed","project":false,"upstream":[{"sha":"fd8662823caa114a63f07222d2aa448f6ac5e864","url":"https://git.kernel.org/stable/c/fd8662823caa114a63f07222d2aa448f6ac5e864"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd8662823caa114a63f07222d2aa448f6ac5e864","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/fd8662823caa114a63f07222d2aa448f6ac5e864.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99208","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99208.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99191","title":"calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()","status":"queued","project":false,"upstream":[{"sha":"8070ed578b6b9134e045627fb745c887a806d46e","url":"https://git.kernel.org/stable/c/8070ed578b6b9134e045627fb745c887a806d46e"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.12/calipso-keep-big-tcp-payload_len-in-calipso_skbuff_s.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":[]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8070ed578b6b9134e045627fb745c887a806d46e","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/8070ed578b6b9134e045627fb745c887a806d46e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99191","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99191.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99189","title":"gpio: mxc: fix race between chained IRQ handler install and probe completion","status":"unfixed","project":false,"upstream":[{"sha":"38d44f78f041ffe60c8e2443b99434a199e7541d","url":"https://git.kernel.org/stable/c/38d44f78f041ffe60c8e2443b99434a199e7541d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"38d44f78f041ffe60c8e2443b99434a199e7541d","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/38d44f78f041ffe60c8e2443b99434a199e7541d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99189","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99189.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99183","title":"accel/rocket: search every core slot when looking up a scheduler","status":"not-applicable","project":false,"upstream":[{"sha":"89c2c777df17eb0201c8e22afabbf3691f2a28fe","url":"https://git.kernel.org/stable/c/89c2c777df17eb0201c8e22afabbf3691f2a28fe"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"89c2c777df17eb0201c8e22afabbf3691f2a28fe","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/89c2c777df17eb0201c8e22afabbf3691f2a28fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99183","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99183.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99178","title":"x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context","status":"queued","project":false,"upstream":[{"sha":"81d99abe2bd81379abfb595e403bbbee6fbfc624","url":"https://git.kernel.org/stable/c/81d99abe2bd81379abfb595e403bbbee6fbfc624"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.12/x86-kvm-don-t-consume-async-pf-flags-on-a-kernel-pf-in-nmi-context.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/all/20211126123145.2772-1-jiangshanlai@gmail.com/","https://lore.kernel.org/all/ed71d0967113a35f670a9625a058b8e6e0b2f104.1583547991.git.luto@kernel.org/"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"81d99abe2bd81379abfb595e403bbbee6fbfc624","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/81d99abe2bd81379abfb595e403bbbee6fbfc624.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99178","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99178.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99172","title":"ipc: drop the mqueue mount with kern_unmount() on setup failure","status":"unfixed","project":false,"upstream":[{"sha":"f0e48172a59e517e613b73f73cc35f24fd123aeb","url":"https://git.kernel.org/stable/c/f0e48172a59e517e613b73f73cc35f24fd123aeb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0e48172a59e517e613b73f73cc35f24fd123aeb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f0e48172a59e517e613b73f73cc35f24fd123aeb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99172","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99172.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99146","title":"drm/i915/dmc: Add sanity check for DMC load address","status":"unfixed","project":false,"upstream":[{"sha":"7dedc5bb11f95e96fe80757c924d8d9aa7327759","url":"https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7dedc5bb11f95e96fe80757c924d8d9aa7327759","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/7dedc5bb11f95e96fe80757c924d8d9aa7327759.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99146","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99146.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99125","title":"s390/pai: Handle multiple PMU stop callback invocations","status":"unknown","project":false,"upstream":[{"sha":"f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40","url":"https://git.kernel.org/stable/c/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99122","title":"vsock/vmci: validate packet source for connected sockets","status":"unfixed","project":false,"upstream":[{"sha":"ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7","url":"https://git.kernel.org/stable/c/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99122","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99122.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99109","title":"smb: client: reject SetEA requests that do not fit the request buffer","status":"unfixed","project":false,"upstream":[{"sha":"4aa2c106aef4bf3dfd97c30842db0767b26e8428","url":"https://git.kernel.org/stable/c/4aa2c106aef4bf3dfd97c30842db0767b26e8428"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4aa2c106aef4bf3dfd97c30842db0767b26e8428","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/4aa2c106aef4bf3dfd97c30842db0767b26e8428.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99109","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99109.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99101","title":"ntfs: move attribute payload before shrinking its record","status":"unknown","project":false,"upstream":[{"sha":"0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","url":"https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99090","title":"drm/amdgpu: serialize vblank counter reads against GPU reset","status":"backported","project":false,"upstream":[{"sha":"1a6023edfbb5673f55fab6348f135fb3b1428ea5","url":"https://git.kernel.org/stable/c/1a6023edfbb5673f55fab6348f135fb3b1428ea5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/11b6193c8841a052b7907006ffb1e02468b1448e","label":"11b6193c8841","date":"2026-10-15T11:56:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a6023edfbb5673f55fab6348f135fb3b1428ea5","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/1a6023edfbb5673f55fab6348f135fb3b1428ea5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99090","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99090.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99087","title":"dm-integrity: fix NULL pointer dereference when the 'R' flag is used","status":"unfixed","project":false,"upstream":[{"sha":"7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84","url":"https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99087","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99087.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99086","title":"dm-integrity: validate the superblock on resume","status":"unfixed","project":false,"upstream":[{"sha":"fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2","url":"https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2","lines":80,"reason":"","source":"https://github.com/torvalds/linux/commit/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99086","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99086.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99076","title":"ipv6: udp: Create exceptions before socket matching","status":"unfixed","project":false,"upstream":[{"sha":"ac76cab50e899a7346408b8d3c3a4192c2eefb9f","url":"https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac76cab50e899a7346408b8d3c3a4192c2eefb9f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/ac76cab50e899a7346408b8d3c3a4192c2eefb9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99076","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99076.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99026","title":"net: team: free skb when broadcast has no txable port","status":"unfixed","project":false,"upstream":[{"sha":"489114c9ecae44e523361a4b3e610ee5ebd9189c","url":"https://git.kernel.org/stable/c/489114c9ecae44e523361a4b3e610ee5ebd9189c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"489114c9ecae44e523361a4b3e610ee5ebd9189c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/489114c9ecae44e523361a4b3e610ee5ebd9189c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99021","title":"regulator: of: fill in supply names in of_regulator_bulk_get_all()","status":"unfixed","project":false,"upstream":[{"sha":"e2151c29cec73f6cc70abf1c7cbc7b9b202489f5","url":"https://git.kernel.org/stable/c/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e2151c29cec73f6cc70abf1c7cbc7b9b202489f5","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99021","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99021.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98999","title":"drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin","status":"unfixed","project":false,"upstream":[{"sha":"cf238c067eaae1cbfb00738e29219b9568d2313e","url":"https://git.kernel.org/stable/c/cf238c067eaae1cbfb00738e29219b9568d2313e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf238c067eaae1cbfb00738e29219b9568d2313e","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/cf238c067eaae1cbfb00738e29219b9568d2313e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98996","title":"fs: don't silently unmount busy mounts","status":"unfixed","project":false,"upstream":[{"sha":"6857e209015f95be7a8f19a9cd5dac345b9b9859","url":"https://git.kernel.org/stable/c/6857e209015f95be7a8f19a9cd5dac345b9b9859"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"6857e209015f95be7a8f19a9cd5dac345b9b9859","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/6857e209015f95be7a8f19a9cd5dac345b9b9859.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98996","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98996.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98989","title":"namespace: check a recursive bind mount for mount namespace loops","status":"unfixed","project":false,"upstream":[{"sha":"c640a01a78e42302879006ed7b7d5a9a943ba815","url":"https://git.kernel.org/stable/c/c640a01a78e42302879006ed7b7d5a9a943ba815"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c640a01a78e42302879006ed7b7d5a9a943ba815","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c640a01a78e42302879006ed7b7d5a9a943ba815.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98983","title":"unshare: don't drop active namespace references that were never taken","status":"unfixed","project":false,"upstream":[{"sha":"0b6f31a3c0b16066f812e94b52a704174a6f23cd","url":"https://git.kernel.org/stable/c/0b6f31a3c0b16066f812e94b52a704174a6f23cd"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0b6f31a3c0b16066f812e94b52a704174a6f23cd","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/0b6f31a3c0b16066f812e94b52a704174a6f23cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98983","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98983.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98980","title":"namei: don't reveal overmounted entries in refwalk","status":"backported","project":false,"upstream":[{"sha":"8189ab688f5a2c745dc90b63374da02f213d6994","url":"https://git.kernel.org/stable/c/8189ab688f5a2c745dc90b63374da02f213d6994"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e2b10181d913b4efa3a8dc67a532f859aa5f95e0","label":"e2b10181d913","date":"2026-10-15T11:56:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8189ab688f5a2c745dc90b63374da02f213d6994","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/8189ab688f5a2c745dc90b63374da02f213d6994.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98980","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98980.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98978","title":"namespace: never expire a locked mount","status":"unfixed","project":false,"upstream":[{"sha":"f78ddcc872248c7aa1d7e904928441a0be4c6d5d","url":"https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f78ddcc872248c7aa1d7e904928441a0be4c6d5d","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/f78ddcc872248c7aa1d7e904928441a0be4c6d5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98978","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98978.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98975","title":"xfs: stop exchanging reflink flags when exchanging mappings","status":"backported","project":false,"upstream":[{"sha":"d84d6c1a7f1e2de9e601703a326a4c1b7b421943","url":"https://git.kernel.org/stable/c/d84d6c1a7f1e2de9e601703a326a4c1b7b421943"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1fa2f3a7ef7ee0f2503a4b0afe24bc8c9d0820be","label":"1fa2f3a7ef7e","date":"2026-10-21T10:30:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d84d6c1a7f1e2de9e601703a326a4c1b7b421943","lines":160,"reason":"","source":"https://github.com/torvalds/linux/commit/d84d6c1a7f1e2de9e601703a326a4c1b7b421943.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98972","title":"cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()","status":"unfixed","project":false,"upstream":[{"sha":"e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469","url":"https://git.kernel.org/stable/c/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98972","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98972.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98966","title":"bonding: fix the program leak when XDP is replaced","status":"unfixed","project":false,"upstream":[{"sha":"184b5ddf82d45d6f75cc83719a2e453392512bd2","url":"https://git.kernel.org/stable/c/184b5ddf82d45d6f75cc83719a2e453392512bd2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"184b5ddf82d45d6f75cc83719a2e453392512bd2","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/184b5ddf82d45d6f75cc83719a2e453392512bd2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98966","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98966.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98960","title":"btrfs: don't stash io_uring encoded data across -EAGAIN","status":"not-applicable","project":false,"upstream":[{"sha":"51562a8cb11628d3a5e105b4c347ec5473e5745f","url":"https://git.kernel.org/stable/c/51562a8cb11628d3a5e105b4c347ec5473e5745f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"51562a8cb11628d3a5e105b4c347ec5473e5745f","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/51562a8cb11628d3a5e105b4c347ec5473e5745f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98960","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98960.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98959","title":"btrfs: fix xattr replace when multiple xattrs are packed in the same item","status":"backported","project":false,"upstream":[{"sha":"858bee1c77857aabcc2327cd32dd8266332de332","url":"https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5877d7138cc4359d26fd7b010eedfd1b3162348f","label":"5877d7138cc4","date":"2026-10-15T11:56:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"858bee1c77857aabcc2327cd32dd8266332de332","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/858bee1c77857aabcc2327cd32dd8266332de332.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98959","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98959.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98958","title":"wifi: mt76: account non-AQL frames per peer rather than per link","status":"unfixed","project":false,"upstream":[{"sha":"752770d7a58c821c17909c3ca67f9f14ab146a40","url":"https://git.kernel.org/stable/c/752770d7a58c821c17909c3ca67f9f14ab146a40"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"752770d7a58c821c17909c3ca67f9f14ab146a40","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/752770d7a58c821c17909c3ca67f9f14ab146a40.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98958","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98958.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98957","title":"wifi: mt76: mt7915: disable rx napi when removing device","status":"backported","project":false,"upstream":[{"sha":"916c484d29d82f45c281da2786fcd6a1284430ce","url":"https://git.kernel.org/stable/c/916c484d29d82f45c281da2786fcd6a1284430ce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0281dac1e213329b053fb02e612de7f1477a52d7","label":"0281dac1e213","date":"2026-10-15T11:56:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"916c484d29d82f45c281da2786fcd6a1284430ce","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/916c484d29d82f45c281da2786fcd6a1284430ce.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98957","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98957.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98954","title":"net: always dissect GSO packets in __virtio_net_hdr_to_skb()","status":"unfixed","project":false,"upstream":[{"sha":"44378d02c5aaae24b60a75fbbb539b4aa4db503d","url":"https://git.kernel.org/stable/c/44378d02c5aaae24b60a75fbbb539b4aa4db503d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"44378d02c5aaae24b60a75fbbb539b4aa4db503d","lines":139,"reason":"","source":"https://github.com/torvalds/linux/commit/44378d02c5aaae24b60a75fbbb539b4aa4db503d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98954","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98954.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98951","title":"riscv: ptrace: Zero-initialize regset buffers before copyin","status":"unfixed","project":false,"upstream":[{"sha":"59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97","url":"https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98951","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98951.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98947","title":"vsock: Fix memory leak in vmci_transport_recv_dgram_cb()","status":"backported","project":false,"upstream":[{"sha":"7c24a4e87e219072e5e106f6791146cbf3b056b3","url":"https://git.kernel.org/stable/c/7c24a4e87e219072e5e106f6791146cbf3b056b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0f8e2b2045355a0ee2008125e573435504b13cee","label":"0f8e2b204535","date":"2026-10-15T11:56:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c24a4e87e219072e5e106f6791146cbf3b056b3","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7c24a4e87e219072e5e106f6791146cbf3b056b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98946","title":"drm/vc4: Disable the V3D interrupt across runtime suspend","status":"unfixed","project":false,"upstream":[{"sha":"6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f","url":"https://git.kernel.org/stable/c/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f","lines":67,"reason":"","source":"https://github.com/torvalds/linux/commit/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98946","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98946.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98938","title":"rust: irq: pass RegistrationInner as cookie to request_irq","status":"not-applicable","project":false,"upstream":[{"sha":"9a7931e847f338a687e96cde9f37e0cff83ddd84","url":"https://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"9a7931e847f338a687e96cde9f37e0cff83ddd84","lines":185,"reason":"","source":"https://github.com/torvalds/linux/commit/9a7931e847f338a687e96cde9f37e0cff83ddd84.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98937","title":"perf/core: Check kernel access when kernel callchains are requested","status":"backported","project":false,"upstream":[{"sha":"a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f","url":"https://git.kernel.org/stable/c/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/132bee76097be421ab3012130b5b506324cf2be1","label":"132bee76097b","date":"2026-10-15T11:56:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98937","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98937.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98932","title":"EDAC/altera: Fix use-after-free in error paths","status":"unfixed","project":false,"upstream":[{"sha":"eef3b67f9c6782127163b631c9043011a68016e2","url":"https://git.kernel.org/stable/c/eef3b67f9c6782127163b631c9043011a68016e2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"eef3b67f9c6782127163b631c9043011a68016e2","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/eef3b67f9c6782127163b631c9043011a68016e2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98930","title":"KVM: s390: Fix IRQ injection with SIGP Stop and Store Status","status":"backported","project":false,"upstream":[{"sha":"d343407b728a80b74be3c24b59f15e60289ea527","url":"https://git.kernel.org/stable/c/d343407b728a80b74be3c24b59f15e60289ea527"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3bd77c59576b1d447fd56cc689ae9523a334b924","label":"3bd77c59576b","date":"2026-10-03T12:35:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d343407b728a80b74be3c24b59f15e60289ea527","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/d343407b728a80b74be3c24b59f15e60289ea527.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98930","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98930.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98929","title":"macsec: initialize SecY before registering the netdevice","status":"unfixed","project":false,"upstream":[{"sha":"c2de369c5c5b8599ca10fd5ca8d11fcd845c1331","url":"https://git.kernel.org/stable/c/c2de369c5c5b8599ca10fd5ca8d11fcd845c1331"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c2de369c5c5b8599ca10fd5ca8d11fcd845c1331","lines":141,"reason":"","source":"https://github.com/torvalds/linux/commit/c2de369c5c5b8599ca10fd5ca8d11fcd845c1331.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98926","title":"drm/amd/display: Remove sink usage from DPMS","status":"unfixed","project":false,"upstream":[{"sha":"8fa813b7fd1eccbed13e126166cf764f1f11a7d3","url":"https://git.kernel.org/stable/c/8fa813b7fd1eccbed13e126166cf764f1f11a7d3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8fa813b7fd1eccbed13e126166cf764f1f11a7d3","lines":384,"reason":"","source":"https://github.com/torvalds/linux/commit/8fa813b7fd1eccbed13e126166cf764f1f11a7d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98926","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98926.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98924","title":"fs: avoid repeated scans in evict_inodes()","status":"unfixed","project":false,"upstream":[{"sha":"7459c021874246c196f397686e100702f059b9e7","url":"https://git.kernel.org/stable/c/7459c021874246c196f397686e100702f059b9e7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7459c021874246c196f397686e100702f059b9e7","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/7459c021874246c196f397686e100702f059b9e7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98924","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98924.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98920","title":"netfs: Fix missing alloc tagging of direct mempool allocations","status":"unfixed","project":false,"upstream":[{"sha":"b78b728e21c32ec4c330b299f657fb1eb02dffc2","url":"https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b78b728e21c32ec4c330b299f657fb1eb02dffc2","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/b78b728e21c32ec4c330b299f657fb1eb02dffc2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98917","title":"parisc: Increase kernel stack size to 32kb","status":"unfixed","project":false,"upstream":[{"sha":"94b7e3a7e871ae27d4935c76959dfc61829f27f9","url":"https://git.kernel.org/stable/c/94b7e3a7e871ae27d4935c76959dfc61829f27f9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"94b7e3a7e871ae27d4935c76959dfc61829f27f9","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/94b7e3a7e871ae27d4935c76959dfc61829f27f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98917","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98917.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98916","title":"wifi: nl80211: check link is beaconing for color change","status":"backported","project":false,"upstream":[{"sha":"55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4","url":"https://git.kernel.org/stable/c/55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dc4713539da73d2d2c03d064b22b0e6ab38bd361","label":"dc4713539da7","date":"2026-10-21T10:30:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98916","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98916.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98914","title":"drm/amdgpu: cap ATOM command table nesting depth","status":"unfixed","project":false,"upstream":[{"sha":"27ef1795bc4e47cae838e0a3ced531c549f9b23d","url":"https://git.kernel.org/stable/c/27ef1795bc4e47cae838e0a3ced531c549f9b23d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"27ef1795bc4e47cae838e0a3ced531c549f9b23d","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/27ef1795bc4e47cae838e0a3ced531c549f9b23d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98906","title":"net: lan966x: restore RX state on reload failure","status":"backported","project":false,"upstream":[{"sha":"aa97f11a76e545ed73cc455bcdd1ece4b480b507","url":"https://git.kernel.org/stable/c/aa97f11a76e545ed73cc455bcdd1ece4b480b507"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3883898ddc26308497dbba8068951ab5eddbd111","label":"3883898ddc26","date":"2026-09-21T15:01:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa97f11a76e545ed73cc455bcdd1ece4b480b507","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/aa97f11a76e545ed73cc455bcdd1ece4b480b507.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98904","title":"mailbox: imx: Use devm_pm_runtime_enable()","status":"backported","project":false,"upstream":[{"sha":"1f602619e408b6e9655ee76656a2a5ab6e89c5e4","url":"https://git.kernel.org/stable/c/1f602619e408b6e9655ee76656a2a5ab6e89c5e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b30a047744ea4344bb6f854b0a052cf276349128","label":"b30a047744ea","date":"2026-09-21T15:01:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1f602619e408b6e9655ee76656a2a5ab6e89c5e4","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/1f602619e408b6e9655ee76656a2a5ab6e89c5e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98904","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98904.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98903","title":"mailbox: imx: Add a channel shutdown field","status":"backported","project":false,"upstream":[{"sha":"5ccea7eacb7786c358833634f45700365f6c1d99","url":"https://git.kernel.org/stable/c/5ccea7eacb7786c358833634f45700365f6c1d99"}],"evidence":[{"url":"https://git.kernel.org/stable/c/02273054b2e94e53065ea5644265bb9d8f7ee2a7","label":"02273054b2e9","date":"2026-09-21T15:01:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5ccea7eacb7786c358833634f45700365f6c1d99","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/5ccea7eacb7786c358833634f45700365f6c1d99.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98903","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98903.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98901","title":"ksmbd: fix lease break and ack state handling","status":"backported","project":false,"upstream":[{"sha":"5015191096db311759fef98769270336cd8b1324","url":"https://git.kernel.org/stable/c/5015191096db311759fef98769270336cd8b1324"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3251ea36df5eef58aa207fbee48849d89b922ea6","label":"3251ea36df5e","date":"2026-09-21T15:01:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"5015191096db311759fef98769270336cd8b1324","lines":184,"reason":"","source":"https://github.com/torvalds/linux/commit/5015191096db311759fef98769270336cd8b1324.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98897","title":"ksmbd: don't hold ci->m_lock while waiting for a lease break ack","status":"unfixed","project":false,"upstream":[{"sha":"27a9bc968d4ae809a3f5ca2f2b136856ee613cb4","url":"https://git.kernel.org/stable/c/27a9bc968d4ae809a3f5ca2f2b136856ee613cb4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"27a9bc968d4ae809a3f5ca2f2b136856ee613cb4","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/27a9bc968d4ae809a3f5ca2f2b136856ee613cb4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98897","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98897.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98880","title":"ntfs3: handle set_blocksize failures","status":"backported","project":false,"upstream":[{"sha":"24f7d1824b7581ae3daf9d443c5dfeabd89df6d8","url":"https://git.kernel.org/stable/c/24f7d1824b7581ae3daf9d443c5dfeabd89df6d8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c5b8a7ec9a0a71518915c82b8552be1ccbb88288","label":"c5b8a7ec9a0a","date":"2026-09-21T15:01:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"24f7d1824b7581ae3daf9d443c5dfeabd89df6d8","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/24f7d1824b7581ae3daf9d443c5dfeabd89df6d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98880","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98880.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98875","title":"drm/nouveau/gsp: add SEC2 to GA100 chip table","status":"unfixed","project":false,"upstream":[{"sha":"604d0efb17cc0dd197e089134736ac2698d5fca7","url":"https://git.kernel.org/stable/c/604d0efb17cc0dd197e089134736ac2698d5fca7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"604d0efb17cc0dd197e089134736ac2698d5fca7","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/604d0efb17cc0dd197e089134736ac2698d5fca7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98875","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98875.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98869","title":"bpf: Infer zext_dst based on static register liveness analysis","status":"not-applicable","project":false,"upstream":[{"sha":"7ce090afbf725e25fff29caacce1eaf8459b1117","url":"https://git.kernel.org/stable/c/7ce090afbf725e25fff29caacce1eaf8459b1117"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"7ce090afbf725e25fff29caacce1eaf8459b1117","lines":429,"reason":"","source":"https://github.com/torvalds/linux/commit/7ce090afbf725e25fff29caacce1eaf8459b1117.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98869","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98869.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98863","title":"KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails","status":"unfixed","project":false,"upstream":[{"sha":"10180a277549339020b08000206092c07e0bff5a","url":"https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"10180a277549339020b08000206092c07e0bff5a","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/10180a277549339020b08000206092c07e0bff5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98863","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98863.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98859","title":"HID: multitouch: stop the release timer from being rearmed on remove","status":"backported","project":false,"upstream":[{"sha":"5acb2dace582f061aab5e14c399ac9480315f44b","url":"https://git.kernel.org/stable/c/5acb2dace582f061aab5e14c399ac9480315f44b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1f1bd9a3117f082eb891c0986c4f0e04cd974c9a","label":"1f1bd9a3117f","date":"2026-10-15T11:56:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5acb2dace582f061aab5e14c399ac9480315f44b","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/5acb2dace582f061aab5e14c399ac9480315f44b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98859","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98859.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98853","title":"net: gso: limit recursive IP-in-IP segmentation","status":"unfixed","project":false,"upstream":[{"sha":"006c8b834aed8b02bd8fb9fb05e9e7ead37d1763","url":"https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"006c8b834aed8b02bd8fb9fb05e9e7ead37d1763","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98853","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98853.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98852","title":"net: extend IPv6 exthdr detection of tunneled packets","status":"backported","project":false,"upstream":[{"sha":"5f0764cb1c81a9712bce605d38efe6d844a70b29","url":"https://git.kernel.org/stable/c/5f0764cb1c81a9712bce605d38efe6d844a70b29"}],"evidence":[{"url":"https://git.kernel.org/stable/c/44ba9dc568c878b699d05e7cf699572dc9df4b59","label":"44ba9dc568c8","date":"2026-10-15T11:56:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"5f0764cb1c81a9712bce605d38efe6d844a70b29","lines":67,"reason":"","source":"https://github.com/torvalds/linux/commit/5f0764cb1c81a9712bce605d38efe6d844a70b29.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98852","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98852.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98843","title":"netfs: zero gaps in read-gaps folio to avoid writing back stale data","status":"unfixed","project":false,"upstream":[{"sha":"8db55c5cd831a786a1a2a2d391aa80354535a353","url":"https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8db55c5cd831a786a1a2a2d391aa80354535a353","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/8db55c5cd831a786a1a2a2d391aa80354535a353.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98843","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98843.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98839","title":"vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()","status":"unfixed","project":false,"upstream":[{"sha":"39495ef5d6f8019e62d65807f217a7ca8232727a","url":"https://git.kernel.org/stable/c/39495ef5d6f8019e62d65807f217a7ca8232727a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"39495ef5d6f8019e62d65807f217a7ca8232727a","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/39495ef5d6f8019e62d65807f217a7ca8232727a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98839","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98839.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98834","title":"mtd: core: avoid double-free of OTP NVMEM device","status":"unfixed","project":false,"upstream":[{"sha":"26300879cd8e4612dce66bb8f6ff7cd35fcf3e59","url":"https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"26300879cd8e4612dce66bb8f6ff7cd35fcf3e59","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98829","title":"wifi: mac80211: drop oversized fragments to avoid extra_len overflow","status":"unfixed","project":false,"upstream":[{"sha":"5e4f3509793b4db2c0835340224743db680e861f","url":"https://git.kernel.org/stable/c/5e4f3509793b4db2c0835340224743db680e861f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5e4f3509793b4db2c0835340224743db680e861f","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/5e4f3509793b4db2c0835340224743db680e861f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98829","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98829.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98828","title":"wifi: ath9k: reject short WMI command responses","status":"backported","project":false,"upstream":[{"sha":"93ce8ea70451e800601bc9444aa33043de15d67b","url":"https://git.kernel.org/stable/c/93ce8ea70451e800601bc9444aa33043de15d67b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/03ef61d05aa26022327f971b790f07e6bf6e35d6","label":"03ef61d05aa2","date":"2026-10-15T11:56:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"93ce8ea70451e800601bc9444aa33043de15d67b","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/93ce8ea70451e800601bc9444aa33043de15d67b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98828","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98828.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98827","title":"wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE","status":"backported","project":false,"upstream":[{"sha":"aeaca27c1db3106967ffbb2b517d98c835f6d500","url":"https://git.kernel.org/stable/c/aeaca27c1db3106967ffbb2b517d98c835f6d500"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c18882768a0fe253c70986c5fe66d9241570fbc4","label":"c18882768a0f","date":"2026-10-15T11:56:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aeaca27c1db3106967ffbb2b517d98c835f6d500","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/aeaca27c1db3106967ffbb2b517d98c835f6d500.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98827","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98827.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98826","title":"rtc: ac100: Fix clock provider use-after-free on probe failure","status":"backported","project":false,"upstream":[{"sha":"fcf0b58e976e83adf246b014518e49c662b96f5e","url":"https://git.kernel.org/stable/c/fcf0b58e976e83adf246b014518e49c662b96f5e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/12bcd20d76703ee2baf52224d287b7fea096b12f","label":"12bcd20d7670","date":"2026-10-15T11:56:14+02:00","lore":["https://lore.kernel.org/linux-rtc/20260905184936.155E11F00A3A@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fcf0b58e976e83adf246b014518e49c662b96f5e","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/fcf0b58e976e83adf246b014518e49c662b96f5e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98824","title":"wifi: mac80211: validate TX status rate metadata","status":"unfixed","project":false,"upstream":[{"sha":"6bdcdb31318c10e6369cff8e5b32c37397e98091","url":"https://git.kernel.org/stable/c/6bdcdb31318c10e6369cff8e5b32c37397e98091"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"6bdcdb31318c10e6369cff8e5b32c37397e98091","lines":165,"reason":"","source":"https://github.com/torvalds/linux/commit/6bdcdb31318c10e6369cff8e5b32c37397e98091.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98824","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98824.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98822","title":"wifi: mac80211: prevent AP VLAN tx from other interfaces","status":"backported","project":false,"upstream":[{"sha":"7f93ca31f7fd9b42e7d692f59514436d448ac908","url":"https://git.kernel.org/stable/c/7f93ca31f7fd9b42e7d692f59514436d448ac908"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fd875e24e8f2b202e3636b3ef8e6060874eca0e5","label":"fd875e24e8f2","date":"2026-10-15T11:56:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f93ca31f7fd9b42e7d692f59514436d448ac908","lines":80,"reason":"","source":"https://github.com/torvalds/linux/commit/7f93ca31f7fd9b42e7d692f59514436d448ac908.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98822","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98822.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98820","title":"blk-mq: set RQF_USE_SCHED when the operation is known","status":"unfixed","project":false,"upstream":[{"sha":"ab6c756f28c741d704a7c3e04814bfc3adf6f818","url":"https://git.kernel.org/stable/c/ab6c756f28c741d704a7c3e04814bfc3adf6f818"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ab6c756f28c741d704a7c3e04814bfc3adf6f818","lines":134,"reason":"","source":"https://github.com/torvalds/linux/commit/ab6c756f28c741d704a7c3e04814bfc3adf6f818.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98820","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98820.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98818","title":"mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()","status":"not-applicable","project":false,"upstream":[{"sha":"af2fb3ee6679b517e2fdbd3ba16ec276a8b74312","url":"https://git.kernel.org/stable/c/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"af2fb3ee6679b517e2fdbd3ba16ec276a8b74312","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98818","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98818.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98816","title":"bpf: Fix overflow of jump offset in constant blinding","status":"unfixed","project":false,"upstream":[{"sha":"ad139384ecddb6f3e7e3c3c12765aafae0e39670","url":"https://git.kernel.org/stable/c/ad139384ecddb6f3e7e3c3c12765aafae0e39670"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad139384ecddb6f3e7e3c3c12765aafae0e39670","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/ad139384ecddb6f3e7e3c3c12765aafae0e39670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98816","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98816.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98815","title":"nvme: fix cdev lifetime","status":"unfixed","project":false,"upstream":[{"sha":"9952f3882ecba709092379b71e02b09762b26f96","url":"https://git.kernel.org/stable/c/9952f3882ecba709092379b71e02b09762b26f96"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9952f3882ecba709092379b71e02b09762b26f96","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/9952f3882ecba709092379b71e02b09762b26f96.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98815","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98815.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98814","title":"nvme: fix command effects log lifetime for multipath heads","status":"unfixed","project":false,"upstream":[{"sha":"72ece656abd4de8645a421fb482d7a11e6533a45","url":"https://git.kernel.org/stable/c/72ece656abd4de8645a421fb482d7a11e6533a45"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"72ece656abd4de8645a421fb482d7a11e6533a45","lines":126,"reason":"","source":"https://github.com/torvalds/linux/commit/72ece656abd4de8645a421fb482d7a11e6533a45.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98814","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98814.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98813","title":"bpf: Hold map BTF for the memory allocator destructor record","status":"unfixed","project":false,"upstream":[{"sha":"ab39974240a0cff765f3bb9cce81d8001ffdb144","url":"https://git.kernel.org/stable/c/ab39974240a0cff765f3bb9cce81d8001ffdb144"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ab39974240a0cff765f3bb9cce81d8001ffdb144","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/ab39974240a0cff765f3bb9cce81d8001ffdb144.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98813","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98813.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98810","title":"wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()","status":"unfixed","project":false,"upstream":[{"sha":"6f63e919fe1e335b8abcb3a28bfd4804a98d875a","url":"https://git.kernel.org/stable/c/6f63e919fe1e335b8abcb3a28bfd4804a98d875a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f63e919fe1e335b8abcb3a28bfd4804a98d875a","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/6f63e919fe1e335b8abcb3a28bfd4804a98d875a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98810","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98810.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98808","title":"net: systemport: Fix buffer overflow in bcm_sysport_get_stats()","status":"backported","project":false,"upstream":[{"sha":"eb7b84af0ec5c71b4920e999611b466b3784496c","url":"https://git.kernel.org/stable/c/eb7b84af0ec5c71b4920e999611b466b3784496c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/29d1d35ad5ad379a904263ea1cd4ba1d71cd965f","label":"29d1d35ad5ad","date":"2026-10-15T11:56:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb7b84af0ec5c71b4920e999611b466b3784496c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/eb7b84af0ec5c71b4920e999611b466b3784496c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98807","title":"net/mlx5: Fix slab-out-of-bounds when handling team device events","status":"backported","project":false,"upstream":[{"sha":"04c824940d52871c49866a4ac67b504146f7cf35","url":"https://git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35"}],"evidence":[{"url":"https://git.kernel.org/stable/c/16ca0e79f31ea810346a79dda545ba344ede1d47","label":"16ca0e79f31e","date":"2026-10-15T11:56:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"04c824940d52871c49866a4ac67b504146f7cf35","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/04c824940d52871c49866a4ac67b504146f7cf35.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98807.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98806","title":"octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled","status":"not-applicable","project":false,"upstream":[{"sha":"056994563935e049093f100efaad7e63ad113814","url":"https://git.kernel.org/stable/c/056994563935e049093f100efaad7e63ad113814"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"056994563935e049093f100efaad7e63ad113814","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/056994563935e049093f100efaad7e63ad113814.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98803","title":"net: stmmac: fix rx Scatter-Gather support","status":"unfixed","project":false,"upstream":[{"sha":"88095728511e0df9c89528944f5a1762ad298983","url":"https://git.kernel.org/stable/c/88095728511e0df9c89528944f5a1762ad298983"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"88095728511e0df9c89528944f5a1762ad298983","lines":180,"reason":"","source":"https://github.com/torvalds/linux/commit/88095728511e0df9c89528944f5a1762ad298983.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98803","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98803.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98802","title":"seg6: ensure packet data is writable before modifying SRH and IPv6 DA","status":"unfixed","project":false,"upstream":[{"sha":"8ae3f4067ba4ae3a15581392f6dac422e3d3def0","url":"https://git.kernel.org/stable/c/8ae3f4067ba4ae3a15581392f6dac422e3d3def0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8ae3f4067ba4ae3a15581392f6dac422e3d3def0","lines":292,"reason":"","source":"https://github.com/torvalds/linux/commit/8ae3f4067ba4ae3a15581392f6dac422e3d3def0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98802","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98802.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98801","title":"net: restrict SO_RESERVE_MEM to TCP sockets and cap max value","status":"backported","project":false,"upstream":[{"sha":"37e02c42a00be692c06343e11779aadc45f45971","url":"https://git.kernel.org/stable/c/37e02c42a00be692c06343e11779aadc45f45971"}],"evidence":[{"url":"https://git.kernel.org/stable/c/492e04f9a00f3cc88a1f6899417b10f3019a624e","label":"492e04f9a00f","date":"2026-10-15T11:56:15+02:00","lore":["https://lore.kernel.org/netdev/5a88421d-10ef-4fca-9acb-85a27a3c1173@huawei.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"37e02c42a00be692c06343e11779aadc45f45971","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/37e02c42a00be692c06343e11779aadc45f45971.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98801","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98801.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98800","title":"bpf: Wait for an RCU tasks grace period before freeing trampoline progs","status":"unfixed","project":false,"upstream":[{"sha":"0fb5751a6e411b1b466c06e50021818d9391df98","url":"https://git.kernel.org/stable/c/0fb5751a6e411b1b466c06e50021818d9391df98"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fb5751a6e411b1b466c06e50021818d9391df98","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/0fb5751a6e411b1b466c06e50021818d9391df98.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98800","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98800.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98799","title":"bpf: Skip detached progs in trampoline images that are still in use","status":"unfixed","project":false,"upstream":[{"sha":"17637e1a581a22466ac3620a91e099683ff9cc6f","url":"https://git.kernel.org/stable/c/17637e1a581a22466ac3620a91e099683ff9cc6f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"17637e1a581a22466ac3620a91e099683ff9cc6f","lines":955,"reason":"","source":"https://github.com/torvalds/linux/commit/17637e1a581a22466ac3620a91e099683ff9cc6f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98797","title":"net: cap skb->queue_mapping when the tx queue is picked","status":"backported","project":false,"upstream":[{"sha":"ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d","url":"https://git.kernel.org/stable/c/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c6ec35c8267c84c2094cb485db20c06384fc2bcc","label":"c6ec35c8267c","date":"2026-10-15T11:56:16+02:00","lore":["https://lore.kernel.org/netdev/179008581937.2160803.7117814290574262942@kernel.org/","https://lore.kernel.org/netdev/179033713973.2160803.4914570693994398206@kernel.org/","https://lore.kernel.org/netdev/20260925180407.63647514@kernel.org/","https://lore.kernel.org/netdev/CANn89i+k-mZKDQVtvws_MEXeuMTAdaCcOXFZE-RfhcGTu90sjA@mail.gmail.com/","https://lore.kernel.org/netdev/CANn89iLwYx8nCVf0pCEk_MmEiyC6kQaMwCQT9WkQVeeNzNQHqQ@mail.gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98796","title":"net: ethernet: mtk_eth_soc: allocate dummy netdev sooner","status":"backported","project":false,"upstream":[{"sha":"6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b","url":"https://git.kernel.org/stable/c/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/42001839e425b2564b7297be579073a13a8fddf6","label":"42001839e425","date":"2026-10-15T11:56:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98796","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98796.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98795","title":"net: sparx5: skip ptp deinit if init was skipped","status":"unfixed","project":false,"upstream":[{"sha":"0d2c49915bc3aea4521cda5e4d42f24f63b94585","url":"https://git.kernel.org/stable/c/0d2c49915bc3aea4521cda5e4d42f24f63b94585"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0d2c49915bc3aea4521cda5e4d42f24f63b94585","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/0d2c49915bc3aea4521cda5e4d42f24f63b94585.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98795","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98795.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98792","title":"netfilter: flowtable: generalize pending status bit","status":"backported","project":false,"upstream":[{"sha":"7c549fb7eecd01fdba7c0d12c01da876ef8a3214","url":"https://git.kernel.org/stable/c/7c549fb7eecd01fdba7c0d12c01da876ef8a3214"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4d52b72f3aa68ad0536444e36530bda75070194c","label":"4d52b72f3aa6","date":"2026-10-15T11:56:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c549fb7eecd01fdba7c0d12c01da876ef8a3214","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/7c549fb7eecd01fdba7c0d12c01da876ef8a3214.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98792","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98792.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98789","title":"bpf: Fix objects stuck in free_by_rcu_ttrace","status":"unfixed","project":false,"upstream":[{"sha":"fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043","url":"https://git.kernel.org/stable/c/fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98789","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98789.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98788","title":"futex: Fix private hash use-after-free on resize","status":"not-applicable","project":false,"upstream":[{"sha":"f35e3b5784221654f9cdbd6222275a7fa203f6c3","url":"https://git.kernel.org/stable/c/f35e3b5784221654f9cdbd6222275a7fa203f6c3"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"f35e3b5784221654f9cdbd6222275a7fa203f6c3","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/f35e3b5784221654f9cdbd6222275a7fa203f6c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98788","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98788.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98786","title":"drm/amd/display: guard dc_sink dereferences in MST mode validation","status":"unfixed","project":false,"upstream":[{"sha":"217f64f348c90cba62164e7ff38e0ccf78a5ca09","url":"https://git.kernel.org/stable/c/217f64f348c90cba62164e7ff38e0ccf78a5ca09"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"217f64f348c90cba62164e7ff38e0ccf78a5ca09","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/217f64f348c90cba62164e7ff38e0ccf78a5ca09.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98786","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98786.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98758","title":"usb: typec: ucsi: glink: fix use-after-free of ucsi on remove","status":"backported","project":false,"upstream":[{"sha":"63b269ec537dc0fd26d0bd64872c26860d108c9d","url":"https://git.kernel.org/stable/c/63b269ec537dc0fd26d0bd64872c26860d108c9d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/432b58cd959e594909a581b4974396cdbc9d4ca1","label":"432b58cd959e","date":"2026-10-15T11:56:20+02:00","lore":["https://lore.kernel.org/r/20260227190430.889-1-nathan.c.rebello@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"63b269ec537dc0fd26d0bd64872c26860d108c9d","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/63b269ec537dc0fd26d0bd64872c26860d108c9d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98758","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98758.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98747","title":"serial: core: fix NULL pointer dereference in serial_core_unregister_port()","status":"unfixed","project":false,"upstream":[{"sha":"499485a67fbacf4d9afbdb43522388c64f853428","url":"https://git.kernel.org/stable/c/499485a67fbacf4d9afbdb43522388c64f853428"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"499485a67fbacf4d9afbdb43522388c64f853428","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/499485a67fbacf4d9afbdb43522388c64f853428.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98747","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98747.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98740","title":"EDAC/altera: Drop __init from ECC setup paths for re-probe safety","status":"unfixed","project":false,"upstream":[{"sha":"b62a264163ca51bee04785c581344751812395df","url":"https://git.kernel.org/stable/c/b62a264163ca51bee04785c581344751812395df"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b62a264163ca51bee04785c581344751812395df","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/b62a264163ca51bee04785c581344751812395df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98740","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98740.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98738","title":"Bluetooth: Serialize SMP remote OOB data access","status":"backported","project":false,"upstream":[{"sha":"81a2345f1984f0b36d3226571bc196316a01b648","url":"https://git.kernel.org/stable/c/81a2345f1984f0b36d3226571bc196316a01b648"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1e11412a1b9854a89d044576d616675b16141d87","label":"1e11412a1b98","date":"2026-10-15T11:56:29+02:00","lore":["https://lore.kernel.org/r/00660cd3-7d71-13a4-f617-229e6defb701@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"81a2345f1984f0b36d3226571bc196316a01b648","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/81a2345f1984f0b36d3226571bc196316a01b648.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98738","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98738.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98737","title":"Bluetooth: hci_sync: Fix inquiry cache use-after-free","status":"backported","project":false,"upstream":[{"sha":"8ed67535fdff40ca652bcd4ac7da68d11d01bd34","url":"https://git.kernel.org/stable/c/8ed67535fdff40ca652bcd4ac7da68d11d01bd34"}],"evidence":[{"url":"https://git.kernel.org/stable/c/52edf1c0e59dea37b8368c4a2559dca96b2fdfea","label":"52edf1c0e59d","date":"2026-10-15T11:56:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ed67535fdff40ca652bcd4ac7da68d11d01bd34","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/8ed67535fdff40ca652bcd4ac7da68d11d01bd34.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98737","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98737.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98734","title":"Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown","status":"backported","project":false,"upstream":[{"sha":"848a7a91c7f03675d3bd8db6f7721cbf9cb50e21","url":"https://git.kernel.org/stable/c/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21"}],"evidence":[{"url":"https://git.kernel.org/stable/c/101825c09ad6b7daa6cf4c9e6b1720b13de15596","label":"101825c09ad6","date":"2026-10-15T11:56:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"848a7a91c7f03675d3bd8db6f7721cbf9cb50e21","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98734","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98734.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98720","title":"KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified","status":"backported","project":false,"upstream":[{"sha":"2abb25273c82061dd4670690c81c319c03740bf6","url":"https://git.kernel.org/stable/c/2abb25273c82061dd4670690c81c319c03740bf6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2db11598b59f16ddb6420693f9a4ac4efc3d4789","label":"2db11598b59f","date":"2026-10-15T11:56:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2abb25273c82061dd4670690c81c319c03740bf6","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/2abb25273c82061dd4670690c81c319c03740bf6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98720","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98720.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98715","title":"KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN","status":"unfixed","project":false,"upstream":[{"sha":"60d93c27859fb3ec5b5a689e24de303f166477d0","url":"https://git.kernel.org/stable/c/60d93c27859fb3ec5b5a689e24de303f166477d0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"60d93c27859fb3ec5b5a689e24de303f166477d0","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/60d93c27859fb3ec5b5a689e24de303f166477d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98715","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98715.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98714","title":"KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded","status":"unfixed","project":false,"upstream":[{"sha":"e27fc915c8f575ab5630e27d97465c2077d4b9d1","url":"https://git.kernel.org/stable/c/e27fc915c8f575ab5630e27d97465c2077d4b9d1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e27fc915c8f575ab5630e27d97465c2077d4b9d1","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/e27fc915c8f575ab5630e27d97465c2077d4b9d1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98714","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98714.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98692","title":"thunderbolt: Make the DP tunnel activation callback mandatory","status":"not-applicable","project":false,"upstream":[{"sha":"12f5d8b85a66a0ac08d082517d92ce136f8c0d42","url":"https://git.kernel.org/stable/c/12f5d8b85a66a0ac08d082517d92ce136f8c0d42"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"12f5d8b85a66a0ac08d082517d92ce136f8c0d42","lines":243,"reason":"","source":"https://github.com/torvalds/linux/commit/12f5d8b85a66a0ac08d082517d92ce136f8c0d42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98692","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98692.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98685","title":"smb: client: discard post-EOF pagecache when extending a file via clone range","status":"unfixed","project":false,"upstream":[{"sha":"4721587f96cb8de8164f3fd203093a0875560999","url":"https://git.kernel.org/stable/c/4721587f96cb8de8164f3fd203093a0875560999"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4721587f96cb8de8164f3fd203093a0875560999","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/4721587f96cb8de8164f3fd203093a0875560999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98685","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98685.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98684","title":"smb: client: flush and commit data before querying allocated ranges","status":"unfixed","project":false,"upstream":[{"sha":"aa994489bd835547c191827acc460192e147032d","url":"https://git.kernel.org/stable/c/aa994489bd835547c191827acc460192e147032d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa994489bd835547c191827acc460192e147032d","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/aa994489bd835547c191827acc460192e147032d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98684","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98684.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98683","title":"smb: client: flush dirty data before zeroing a range","status":"unfixed","project":false,"upstream":[{"sha":"8f8d32c1044f70e46e87550e039a15ff20a4b21c","url":"https://git.kernel.org/stable/c/8f8d32c1044f70e46e87550e039a15ff20a4b21c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f8d32c1044f70e46e87550e039a15ff20a4b21c","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/8f8d32c1044f70e46e87550e039a15ff20a4b21c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98683","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98683.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98682","title":"smb: client: drain and invalidate before server-side copy/clone","status":"unfixed","project":false,"upstream":[{"sha":"c9b1194e8ec99d95db25db45edd2fbf690f043ab","url":"https://git.kernel.org/stable/c/c9b1194e8ec99d95db25db45edd2fbf690f043ab"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c9b1194e8ec99d95db25db45edd2fbf690f043ab","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/c9b1194e8ec99d95db25db45edd2fbf690f043ab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98682","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98682.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98674","title":"iio: adc: adi-axi-adc: Initialize state mutex","status":"unfixed","project":false,"upstream":[{"sha":"549b71ce050637dd32678371ad76c445a2f8c9aa","url":"https://git.kernel.org/stable/c/549b71ce050637dd32678371ad76c445a2f8c9aa"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"549b71ce050637dd32678371ad76c445a2f8c9aa","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/549b71ce050637dd32678371ad76c445a2f8c9aa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98674","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98674.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98665","title":"iio: health: max30102: fix NULL dereference in interrupt handler","status":"backported","project":false,"upstream":[{"sha":"f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d","url":"https://git.kernel.org/stable/c/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/eeb23ba97bd8016e815ef70300b8d34a0a316b90","label":"eeb23ba97bd8","date":"2026-10-15T11:56:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98665","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98665.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98661","title":"iio: light: rohm-bu27034: Fix infinite delay on error","status":"backported","project":false,"upstream":[{"sha":"8065a6c02f629187131f3136bedb26f9080e3cca","url":"https://git.kernel.org/stable/c/8065a6c02f629187131f3136bedb26f9080e3cca"}],"evidence":[{"url":"https://git.kernel.org/stable/c/050482f958521d80603e88d5c3a59872528ec13c","label":"050482f95852","date":"2026-10-15T11:56:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8065a6c02f629187131f3136bedb26f9080e3cca","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/8065a6c02f629187131f3136bedb26f9080e3cca.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98652","title":"KVM: s390: Add missing srcu in kvm_s390_set_irq_state()","status":"unknown","project":false,"upstream":[{"sha":"f3a557067d57ce6ae98d485c8009b223e16f5f36","url":"https://git.kernel.org/stable/c/f3a557067d57ce6ae98d485c8009b223e16f5f36"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"f3a557067d57ce6ae98d485c8009b223e16f5f36","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/f3a557067d57ce6ae98d485c8009b223e16f5f36.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98652","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98652.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98642","title":"bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk","status":"backported","project":false,"upstream":[{"sha":"1c21452d02eec2f008e2c5535820f85adbd7587a","url":"https://git.kernel.org/stable/c/1c21452d02eec2f008e2c5535820f85adbd7587a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a0e150a118025a05c8662c536ba2a865da86419c","label":"a0e150a11802","date":"2026-10-03T12:35:20+02:00","lore":["https://lore.kernel.org/r/20260905021139.4116529-1-pulehui@huaweicloud.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c21452d02eec2f008e2c5535820f85adbd7587a","lines":94,"reason":"","source":"https://github.com/torvalds/linux/commit/1c21452d02eec2f008e2c5535820f85adbd7587a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98642","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98642.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98634","title":"scsi: sd_zbc: Reject disks with too many zones","status":"backported","project":false,"upstream":[{"sha":"b6ec0f79745967c751c85df373062c8d15e45fc4","url":"https://git.kernel.org/stable/c/b6ec0f79745967c751c85df373062c8d15e45fc4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d8791ae55d85dfaeafa20ea48365482a0cc5a107","label":"d8791ae55d85","date":"2026-10-03T12:35:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b6ec0f79745967c751c85df373062c8d15e45fc4","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/b6ec0f79745967c751c85df373062c8d15e45fc4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98628","title":"bpf: Make post-verification instruction rewrites killable","status":"unfixed","project":false,"upstream":[{"sha":"261b61d3735b042ae25634f795c4540be0fc140c","url":"https://git.kernel.org/stable/c/261b61d3735b042ae25634f795c4540be0fc140c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"261b61d3735b042ae25634f795c4540be0fc140c","lines":113,"reason":"","source":"https://github.com/torvalds/linux/commit/261b61d3735b042ae25634f795c4540be0fc140c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98628","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98628.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98620","title":"net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure","status":"backported","project":false,"upstream":[{"sha":"310d1ac61a4d5a2ca8356a3a48d263acf54503ce","url":"https://git.kernel.org/stable/c/310d1ac61a4d5a2ca8356a3a48d263acf54503ce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ab3bde3b3e56331b4f53a1f6cf4e5e9d1c14c1a0","label":"ab3bde3b3e56","date":"2026-10-03T12:35:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"310d1ac61a4d5a2ca8356a3a48d263acf54503ce","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/310d1ac61a4d5a2ca8356a3a48d263acf54503ce.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98620","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98620.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98617","title":"eth: fbnic: use the Rx queue napi pointer to find the napi vector","status":"not-applicable","project":false,"upstream":[{"sha":"b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e","url":"https://git.kernel.org/stable/c/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98617","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98617.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98616","title":"eth: fbnic: reset num_napi when the napi vectors are freed","status":"unfixed","project":false,"upstream":[{"sha":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","url":"https://git.kernel.org/stable/c/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98616","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98616.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98599","title":"bpf: Reject non-negative offsets in stack_slot_obj_get_spi()","status":"unfixed","project":false,"upstream":[{"sha":"79a9172f3ab4ad8392c5e5c8944b9b7710ade620","url":"https://git.kernel.org/stable/c/79a9172f3ab4ad8392c5e5c8944b9b7710ade620"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"79a9172f3ab4ad8392c5e5c8944b9b7710ade620","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/79a9172f3ab4ad8392c5e5c8944b9b7710ade620.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98599","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98599.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98598","title":"ipv6: Prevent rt6_insert_exception() for dying fib6_info.","status":"unfixed","project":false,"upstream":[{"sha":"0346ec2f080b40d95ed05b853bb9226289e75212","url":"https://git.kernel.org/stable/c/0346ec2f080b40d95ed05b853bb9226289e75212"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0346ec2f080b40d95ed05b853bb9226289e75212","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/0346ec2f080b40d95ed05b853bb9226289e75212.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98598","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98598.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98589","title":"bpf: Reject pkt arguments in mutating subprogs","status":"unfixed","project":false,"upstream":[{"sha":"a6c1edfbe240e4377038a0e1d233ad81fde9a21b","url":"https://git.kernel.org/stable/c/a6c1edfbe240e4377038a0e1d233ad81fde9a21b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6c1edfbe240e4377038a0e1d233ad81fde9a21b","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/a6c1edfbe240e4377038a0e1d233ad81fde9a21b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98589","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98589.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98570","title":"net: ipv6: keep room for the mac header in dst_dev_overhead()","status":"unfixed","project":false,"upstream":[{"sha":"87cd6b717e4069dca34e0866e57eaeb44d3b173e","url":"https://git.kernel.org/stable/c/87cd6b717e4069dca34e0866e57eaeb44d3b173e"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"87cd6b717e4069dca34e0866e57eaeb44d3b173e","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/87cd6b717e4069dca34e0866e57eaeb44d3b173e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98570","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98570.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98565","title":"net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621","status":"backported","project":false,"upstream":[{"sha":"c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4","url":"https://git.kernel.org/stable/c/c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e9a5298532780ecdd05c3220f3e1e3067b3537c3","label":"e9a529853278","date":"2026-10-03T12:35:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98565","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98565.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98562","title":"net: libwx: fix races in Tx timestamp handling","status":"not-applicable","project":false,"upstream":[{"sha":"3173cba1170131816972ed2b6185cb970ba8b747","url":"https://git.kernel.org/stable/c/3173cba1170131816972ed2b6185cb970ba8b747"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"3173cba1170131816972ed2b6185cb970ba8b747","lines":295,"reason":"","source":"https://github.com/torvalds/linux/commit/3173cba1170131816972ed2b6185cb970ba8b747.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98562","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98562.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98558","title":"net: flush skb_defer_nodes in dev_cpu_dead()","status":"unfixed","project":false,"upstream":[{"sha":"06e3f54e8b22040ada01a28343badf1990b4dd7d","url":"https://git.kernel.org/stable/c/06e3f54e8b22040ada01a28343badf1990b4dd7d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"06e3f54e8b22040ada01a28343badf1990b4dd7d","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/06e3f54e8b22040ada01a28343badf1990b4dd7d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98558","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98558.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98556","title":"gve: DQO: reject TSO packets with an out of range MSS","status":"unfixed","project":false,"upstream":[{"sha":"296c83b5ccc808c080865eb20fd7a477b0355bb7","url":"https://git.kernel.org/stable/c/296c83b5ccc808c080865eb20fd7a477b0355bb7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"296c83b5ccc808c080865eb20fd7a477b0355bb7","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/296c83b5ccc808c080865eb20fd7a477b0355bb7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98556","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98556.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98551","title":"perf/core: Fill branch entries with a single assignment","status":"unfixed","project":false,"upstream":[{"sha":"24b620729e53d978b3e425f55bc66efd3bab1f59","url":"https://git.kernel.org/stable/c/24b620729e53d978b3e425f55bc66efd3bab1f59"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"24b620729e53d978b3e425f55bc66efd3bab1f59","lines":163,"reason":"","source":"https://github.com/torvalds/linux/commit/24b620729e53d978b3e425f55bc66efd3bab1f59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98551","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98551.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98539","title":"fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga","status":"backported","project":false,"upstream":[{"sha":"1abd643f3783ea8f8e273c18697ff0413aa92dc7","url":"https://git.kernel.org/stable/c/1abd643f3783ea8f8e273c18697ff0413aa92dc7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6fda7121cb6a8ea6fbd77d0f787f04b8e8b5358e","label":"6fda7121cb6a","date":"2026-10-03T12:35:31+02:00","lore":["https://lore.kernel.org/6a9beced.a5e650b3.26d8a.000b.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1abd643f3783ea8f8e273c18697ff0413aa92dc7","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/1abd643f3783ea8f8e273c18697ff0413aa92dc7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98539","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98539.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98525","title":"mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()","status":"backported","project":false,"upstream":[{"sha":"26cc0e69cce062cd3aa6fae33074684669c35a71","url":"https://git.kernel.org/stable/c/26cc0e69cce062cd3aa6fae33074684669c35a71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/09299addab11857e92eca55cd8ef3350b927c90c","label":"09299addab11","date":"2026-10-03T12:35:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"26cc0e69cce062cd3aa6fae33074684669c35a71","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/26cc0e69cce062cd3aa6fae33074684669c35a71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98525","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98525.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98509","title":"drm/virtio: fix memory leak of fence event on execbuffer failure","status":"backported","project":false,"upstream":[{"sha":"b74aad23d99b279bb34d135795f39a6d8ecdc075","url":"https://git.kernel.org/stable/c/b74aad23d99b279bb34d135795f39a6d8ecdc075"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4e333e2336138f4659b1d7a0371c499f80428612","label":"4e333e233613","date":"2026-10-03T12:35:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b74aad23d99b279bb34d135795f39a6d8ecdc075","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/b74aad23d99b279bb34d135795f39a6d8ecdc075.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98509","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98509.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98508","title":"drm/virtio: fix NULL pointer dereference on fence allocation failure","status":"backported","project":false,"upstream":[{"sha":"846b3c64fe3e77d9db20a7e3e62dbbb637c773e1","url":"https://git.kernel.org/stable/c/846b3c64fe3e77d9db20a7e3e62dbbb637c773e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a8b83ed4a4b1d04c756f53e375e86d3881f66e72","label":"a8b83ed4a4b1","date":"2026-10-03T12:35:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"846b3c64fe3e77d9db20a7e3e62dbbb637c773e1","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/846b3c64fe3e77d9db20a7e3e62dbbb637c773e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98508","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98508.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98506","title":"mm/hugetlb: do not dissolve gigantic pages without runtime support","status":"backported","project":false,"upstream":[{"sha":"a363c62a653cc8b3e21da9545fa4e028ef50f9c3","url":"https://git.kernel.org/stable/c/a363c62a653cc8b3e21da9545fa4e028ef50f9c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ddc1055b557506a6ea8930dfbd8d1555d6a3f01e","label":"ddc1055b5575","date":"2026-10-03T12:35:57+02:00","lore":["https://lore.kernel.org/20260823044118.1097121-2-xialonglong2025@163.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a363c62a653cc8b3e21da9545fa4e028ef50f9c3","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/a363c62a653cc8b3e21da9545fa4e028ef50f9c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98506","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98506.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98505","title":"mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()","status":"backported","project":false,"upstream":[{"sha":"39c0ceedd54557bdc1542de08d22b2ed33e534e4","url":"https://git.kernel.org/stable/c/39c0ceedd54557bdc1542de08d22b2ed33e534e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/00457981327c80bcc56e07d4714fe189337a19fa","label":"00457981327c","date":"2026-10-03T12:35:57+02:00","lore":["https://lore.kernel.org/20260830160545.98969-1-sj@kernel.org","https://lore.kernel.org/20260907170358.100168-1-sj@kernel.org"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"39c0ceedd54557bdc1542de08d22b2ed33e534e4","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/39c0ceedd54557bdc1542de08d22b2ed33e534e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98505","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98505.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98503","title":"packet: use ubuf_info completion for TX_RING packets","status":"backported","project":false,"upstream":[{"sha":"9518405613863d0bf0700927a21367f5942cf058","url":"https://git.kernel.org/stable/c/9518405613863d0bf0700927a21367f5942cf058"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e67c455d79fbf709a94965f09a2be6bf4f4ba5fd","label":"e67c455d79fb","date":"2026-10-03T12:35:57+02:00","lore":["https://lore.kernel.org/netdev/20260909085542.3370986-1-doebel@amazon.de/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"9518405613863d0bf0700927a21367f5942cf058","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/9518405613863d0bf0700927a21367f5942cf058.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98503","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98503.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98473","title":"s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config","status":"backported","project":false,"upstream":[{"sha":"65e05ec252a9b79e75930d3c4dd42d8877db04c5","url":"https://git.kernel.org/stable/c/65e05ec252a9b79e75930d3c4dd42d8877db04c5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/da69d3ac53490724eba0ade9deb4e539a6ae9034","label":"da69d3ac5349","date":"2026-10-03T12:35:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"65e05ec252a9b79e75930d3c4dd42d8877db04c5","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/65e05ec252a9b79e75930d3c4dd42d8877db04c5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98473","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98473.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98471","title":"KVM: SEV: Do cache maintenance on the source VM during intra-host migration","status":"unfixed","project":false,"upstream":[{"sha":"93de2a6a4b91b72607136dd656edf03fb399d27f","url":"https://git.kernel.org/stable/c/93de2a6a4b91b72607136dd656edf03fb399d27f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"93de2a6a4b91b72607136dd656edf03fb399d27f","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/93de2a6a4b91b72607136dd656edf03fb399d27f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98471","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98471.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98466","title":"KVM: arm64: Transfer the hyp stack pages out of the host stage-2","status":"unfixed","project":false,"upstream":[{"sha":"3a8c562892b96f35bba1e00d5e455a15963bbb92","url":"https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a8c562892b96f35bba1e00d5e455a15963bbb92","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/3a8c562892b96f35bba1e00d5e455a15963bbb92.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98466","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98466.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98458","title":"Bluetooth: ISO: release unused CIS holds after channel attach","status":"backported","project":false,"upstream":[{"sha":"0fcd4dad555c96e0bd3a1b8c569f989be85c7341","url":"https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e0e8b70207eaf27aee0a05ec5bf2d1b6bcb004d1","label":"e0e8b70207ea","date":"2026-10-15T11:56:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fcd4dad555c96e0bd3a1b8c569f989be85c7341","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/0fcd4dad555c96e0bd3a1b8c569f989be85c7341.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98458","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98458.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98452","title":"smb: client: clean up failed cached directory opens","status":"backported","project":false,"upstream":[{"sha":"d2ff5fb93ea83034025850266b5eed391f96b825","url":"https://git.kernel.org/stable/c/d2ff5fb93ea83034025850266b5eed391f96b825"}],"evidence":[{"url":"https://git.kernel.org/stable/c/48958ddda3d7eee3600261e2d90671f63e055dc4","label":"48958ddda3d7","date":"2026-10-03T12:35:36+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2ff5fb93ea83034025850266b5eed391f96b825","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/d2ff5fb93ea83034025850266b5eed391f96b825.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98452","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98452.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98449","title":"smb: client: delete compound mids on send failure before unlock","status":"unfixed","project":false,"upstream":[{"sha":"8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9","url":"https://git.kernel.org/stable/c/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98444","title":"xfs: drop dquot flush lock when we can't find a buffer to flush","status":"unfixed","project":false,"upstream":[{"sha":"ffb48dccce1960a9ea24463a2f3c21d124d6b672","url":"https://git.kernel.org/stable/c/ffb48dccce1960a9ea24463a2f3c21d124d6b672"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ffb48dccce1960a9ea24463a2f3c21d124d6b672","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/ffb48dccce1960a9ea24463a2f3c21d124d6b672.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98444","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98444.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98439","title":"smb/server: cancel async requests when closing connection","status":"unfixed","project":false,"upstream":[{"sha":"4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851","url":"https://git.kernel.org/stable/c/4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98439","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98439.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98436","title":"accel/amdxdna: Disable device buffer exporting","status":"not-applicable","project":false,"upstream":[{"sha":"9480dd7ec3fcadd4217503e4bb32c16e19e4b21f","url":"https://git.kernel.org/stable/c/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"9480dd7ec3fcadd4217503e4bb32c16e19e4b21f","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98436","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98436.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98435","title":"EDAC/altera: Use parent device for devres in altr_portb_setup()","status":"backported","project":false,"upstream":[{"sha":"9868f5c077dfe0b606331f2e782484f91a5789a5","url":"https://git.kernel.org/stable/c/9868f5c077dfe0b606331f2e782484f91a5789a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8325ecf3f16d764a0e0ba42c95b63f08e38710a8","label":"8325ecf3f16d","date":"2026-10-03T12:35:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9868f5c077dfe0b606331f2e782484f91a5789a5","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/9868f5c077dfe0b606331f2e782484f91a5789a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98435","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98435.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98431","title":"RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency","status":"unfixed","project":false,"upstream":[{"sha":"a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","url":"https://git.kernel.org/stable/c/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98431","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98431.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98427","title":"net/sched: codel: bound the dropping loop per dequeue call","status":"unfixed","project":false,"upstream":[{"sha":"7f4a5ec6258fd7c92633ec4b0493fc51166d9398","url":"https://git.kernel.org/stable/c/7f4a5ec6258fd7c92633ec4b0493fc51166d9398"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f4a5ec6258fd7c92633ec4b0493fc51166d9398","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7f4a5ec6258fd7c92633ec4b0493fc51166d9398.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98427","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98427.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98425","title":"wifi: mac80211: don't warn when an IBSS has no channel to scan","status":"backported","project":false,"upstream":[{"sha":"a7491b7efbd9136b120a12ed72af9c12121dd134","url":"https://git.kernel.org/stable/c/a7491b7efbd9136b120a12ed72af9c12121dd134"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bb91c15953705445778c170a2523f12351c4d928","label":"bb91c1595370","date":"2026-10-03T12:35:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a7491b7efbd9136b120a12ed72af9c12121dd134","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/a7491b7efbd9136b120a12ed72af9c12121dd134.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98425","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98425.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98424","title":"wifi: cfg80211: undo netns switch if renaming the wiphy fails","status":"unfixed","project":false,"upstream":[{"sha":"a41bd1938a9bfe226d444172a7e20e4bd5097960","url":"https://git.kernel.org/stable/c/a41bd1938a9bfe226d444172a7e20e4bd5097960"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"a41bd1938a9bfe226d444172a7e20e4bd5097960","lines":117,"reason":"","source":"https://github.com/torvalds/linux/commit/a41bd1938a9bfe226d444172a7e20e4bd5097960.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98420","title":"ksmbd: follow SMB2 session expiration semantics","status":"unfixed","project":false,"upstream":[{"sha":"d7fd1f98607f2cd358e583f9548bdf0173090a86","url":"https://git.kernel.org/stable/c/d7fd1f98607f2cd358e583f9548bdf0173090a86"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d7fd1f98607f2cd358e583f9548bdf0173090a86","lines":441,"reason":"","source":"https://github.com/torvalds/linux/commit/d7fd1f98607f2cd358e583f9548bdf0173090a86.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98420","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98420.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98408","title":"watchdog: rzv2h: Avoid division by zero","status":"unfixed","project":false,"upstream":[{"sha":"6274281c41efa8dd1aa5234c59ad904ff89d7af4","url":"https://git.kernel.org/stable/c/6274281c41efa8dd1aa5234c59ad904ff89d7af4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6274281c41efa8dd1aa5234c59ad904ff89d7af4","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/6274281c41efa8dd1aa5234c59ad904ff89d7af4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98408","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98408.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98403","title":"s390/boot: Avoid IPL parameter append past command line","status":"backported","project":false,"upstream":[{"sha":"d76181dfabdaa720703167393704efacba343442","url":"https://git.kernel.org/stable/c/d76181dfabdaa720703167393704efacba343442"}],"evidence":[{"url":"https://git.kernel.org/stable/c/af9866021a00ab9eeacf0c33ee73f3d134b4ed70","label":"af9866021a00","date":"2026-10-03T12:34:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d76181dfabdaa720703167393704efacba343442","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/d76181dfabdaa720703167393704efacba343442.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98403","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98403.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98401","title":"net: iptunnel: fix stale transport header during tunnel decapsulation","status":"backported","project":false,"upstream":[{"sha":"28a57fb2c5df4deb42a06e52fd36c14b37aa0034","url":"https://git.kernel.org/stable/c/28a57fb2c5df4deb42a06e52fd36c14b37aa0034"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8c3d4dfcecf7670c1d752f1ae74b21b2af5feac1","label":"8c3d4dfcecf7","date":"2026-09-21T15:01:59+02:00","lore":["https://lore.kernel.org/all/69de2bee.a00a0220.475f0.0041.GAE@google.com/T/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"28a57fb2c5df4deb42a06e52fd36c14b37aa0034","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/28a57fb2c5df4deb42a06e52fd36c14b37aa0034.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98401","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98401.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98400","title":"s390/ipl: Fix NULL deref in kdump without re-IPL parm block","status":"backported","project":false,"upstream":[{"sha":"7f918871112e8e7c581e99eb8e545af4e59c8367","url":"https://git.kernel.org/stable/c/7f918871112e8e7c581e99eb8e545af4e59c8367"}],"evidence":[{"url":"https://git.kernel.org/stable/c/92d0829eae257544b6b0faccb6e7079c45e22d48","label":"92d0829eae25","date":"2026-09-21T15:02:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f918871112e8e7c581e99eb8e545af4e59c8367","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7f918871112e8e7c581e99eb8e545af4e59c8367.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98400.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98399","title":"s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block","status":"backported","project":false,"upstream":[{"sha":"37f61b71cbc0caefc01022a19ee56fc2510e2e6e","url":"https://git.kernel.org/stable/c/37f61b71cbc0caefc01022a19ee56fc2510e2e6e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aed56fa3108b7095e6a048e134981506c056a6cb","label":"aed56fa3108b","date":"2026-09-21T15:02:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"37f61b71cbc0caefc01022a19ee56fc2510e2e6e","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/37f61b71cbc0caefc01022a19ee56fc2510e2e6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98399","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98399.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98394","title":"af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.","status":"backported","project":false,"upstream":[{"sha":"6e5ee08eb5858d175da6768d75d163817b6a9d4a","url":"https://git.kernel.org/stable/c/6e5ee08eb5858d175da6768d75d163817b6a9d4a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3d3c7a3df66b2ca3d2cd1a2a0c37eb701feba713","label":"3d3c7a3df66b","date":"2026-09-21T15:02:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6e5ee08eb5858d175da6768d75d163817b6a9d4a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/6e5ee08eb5858d175da6768d75d163817b6a9d4a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98394","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98394.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98393","title":"net: ipv4: Fix UDP length overflow with PMTU discover and big MTU","status":"unfixed","project":false,"upstream":[{"sha":"b83641e0ab8b20eefcc4cdc5a059f897375291a2","url":"https://git.kernel.org/stable/c/b83641e0ab8b20eefcc4cdc5a059f897375291a2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b83641e0ab8b20eefcc4cdc5a059f897375291a2","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b83641e0ab8b20eefcc4cdc5a059f897375291a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98393","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98393.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98387","title":"s390/crypto: Fix skcipher_walk return code handling in aes_s390","status":"backported","project":false,"upstream":[{"sha":"15fa028589c3a2545f0bff355eff06d5844196bf","url":"https://git.kernel.org/stable/c/15fa028589c3a2545f0bff355eff06d5844196bf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/89b58645646d1dac34162cc2597f42266bfbf930","label":"89b58645646d","date":"2026-09-21T15:02:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"15fa028589c3a2545f0bff355eff06d5844196bf","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/15fa028589c3a2545f0bff355eff06d5844196bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98387","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98387.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98376","title":"bpf: Use array_map_meta_equal for percpu array inner map replacement","status":"unfixed","project":false,"upstream":[{"sha":"593980175389a05793f6060aa20e626330960395","url":"https://git.kernel.org/stable/c/593980175389a05793f6060aa20e626330960395"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"593980175389a05793f6060aa20e626330960395","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/593980175389a05793f6060aa20e626330960395.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98376","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98376.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98365","title":"RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access","status":"backported","project":false,"upstream":[{"sha":"d10e2a08799e858d3e71ea4169bcd018f216d444","url":"https://git.kernel.org/stable/c/d10e2a08799e858d3e71ea4169bcd018f216d444"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5d9426a74fc8cb8f375fcdc19b465a030f9b8cab","label":"5d9426a74fc8","date":"2026-10-03T12:35:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d10e2a08799e858d3e71ea4169bcd018f216d444","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d10e2a08799e858d3e71ea4169bcd018f216d444.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98365","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98365.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98364","title":"xfrm: hold net_device reference under RCU in bundle creation","status":"unfixed","project":false,"upstream":[{"sha":"9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","url":"https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98364","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98364.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98355","title":"RDMA/rtrs: guard against null kobj name","status":"unfixed","project":false,"upstream":[{"sha":"99c24a8968ebef0573825b5cb89d5985d51635b9","url":"https://git.kernel.org/stable/c/99c24a8968ebef0573825b5cb89d5985d51635b9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"99c24a8968ebef0573825b5cb89d5985d51635b9","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/99c24a8968ebef0573825b5cb89d5985d51635b9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98353","title":"RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables","status":"unfixed","project":false,"upstream":[{"sha":"00baeade709fb66da647e8327e8398bb532e30f7","url":"https://git.kernel.org/stable/c/00baeade709fb66da647e8327e8398bb532e30f7"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00baeade709fb66da647e8327e8398bb532e30f7","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/00baeade709fb66da647e8327e8398bb532e30f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98353","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98353.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98341","title":"wifi: cfg80211: don't free driver-owned scan requests","status":"unfixed","project":false,"upstream":[{"sha":"dab68a74e90b8e07f08ed9deaa5884857a3cfe89","url":"https://git.kernel.org/stable/c/dab68a74e90b8e07f08ed9deaa5884857a3cfe89"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"dab68a74e90b8e07f08ed9deaa5884857a3cfe89","lines":100,"reason":"","source":"https://github.com/torvalds/linux/commit/dab68a74e90b8e07f08ed9deaa5884857a3cfe89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98341","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98341.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98338","title":"wifi: cfg80211: ibss: ref BSS entry for joined event","status":"unfixed","project":false,"upstream":[{"sha":"708f9d43d6a2eb9c6b83fe62af628de9dffd9314","url":"https://git.kernel.org/stable/c/708f9d43d6a2eb9c6b83fe62af628de9dffd9314"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"708f9d43d6a2eb9c6b83fe62af628de9dffd9314","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/708f9d43d6a2eb9c6b83fe62af628de9dffd9314.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98338","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98338.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98337","title":"wifi: mac80211: don't start a ROC while scanning","status":"backported","project":false,"upstream":[{"sha":"733f0fde95392ed5f61a4e36aee661ea8d0e8581","url":"https://git.kernel.org/stable/c/733f0fde95392ed5f61a4e36aee661ea8d0e8581"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5dc8ec2f8d1d62914661577c23ec151f5c9734a4","label":"5dc8ec2f8d1d","date":"2026-10-03T12:35:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"733f0fde95392ed5f61a4e36aee661ea8d0e8581","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/733f0fde95392ed5f61a4e36aee661ea8d0e8581.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98335","title":"wifi: mac80211: abort chanswitch when leaving a mesh","status":"backported","project":false,"upstream":[{"sha":"ac7472a24bd433b81c06582835dd1d5547c10da9","url":"https://git.kernel.org/stable/c/ac7472a24bd433b81c06582835dd1d5547c10da9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bc544ef02327edf61c94d2b6bae9d14b217009b2","label":"bc544ef02327","date":"2026-10-03T12:35:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac7472a24bd433b81c06582835dd1d5547c10da9","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/ac7472a24bd433b81c06582835dd1d5547c10da9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98335","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98335.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98334","title":"wifi: mac80211: reset state when starting AP fails","status":"backported","project":false,"upstream":[{"sha":"3f28551d0241254a75626d868041c6340285088b","url":"https://git.kernel.org/stable/c/3f28551d0241254a75626d868041c6340285088b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d83da43e9b3b3b1bad99ac5a1065f1c63ad5fc32","label":"d83da43e9b3b","date":"2026-10-03T12:35:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f28551d0241254a75626d868041c6340285088b","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/3f28551d0241254a75626d868041c6340285088b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98333","title":"wifi: mac80211: reset the LED state when ifup fails","status":"unfixed","project":false,"upstream":[{"sha":"78183e8331958fda11cd2b6850bb424a9747c4b2","url":"https://git.kernel.org/stable/c/78183e8331958fda11cd2b6850bb424a9747c4b2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"78183e8331958fda11cd2b6850bb424a9747c4b2","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/78183e8331958fda11cd2b6850bb424a9747c4b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98332","title":"wifi: mac80211: only operate on TDLS peers in the TDLS code","status":"unfixed","project":false,"upstream":[{"sha":"6f0a100df8539ce90f37c14e1945f396ca2410bc","url":"https://git.kernel.org/stable/c/6f0a100df8539ce90f37c14e1945f396ca2410bc"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f0a100df8539ce90f37c14e1945f396ca2410bc","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/6f0a100df8539ce90f37c14e1945f396ca2410bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98332","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98332.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98330","title":"wifi: cfg80211: get the wiphy out of a dying network namespace","status":"unfixed","project":false,"upstream":[{"sha":"4635b1a1c1d693178a537446a6e09963f0fdae52","url":"https://git.kernel.org/stable/c/4635b1a1c1d693178a537446a6e09963f0fdae52"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4635b1a1c1d693178a537446a6e09963f0fdae52","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/4635b1a1c1d693178a537446a6e09963f0fdae52.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98330","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98330.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98329","title":"wifi: mac80211: don't allow injecting frames wider than the chanctx","status":"backported","project":false,"upstream":[{"sha":"e14bf37bb2b3853012ff160131d1c6233f7a9cc9","url":"https://git.kernel.org/stable/c/e14bf37bb2b3853012ff160131d1c6233f7a9cc9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a5c715eda066cba5ce3372759188ba8636dca629","label":"a5c715eda066","date":"2026-10-03T12:35:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e14bf37bb2b3853012ff160131d1c6233f7a9cc9","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/e14bf37bb2b3853012ff160131d1c6233f7a9cc9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98329","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98329.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98327","title":"wifi: mac80211: mesh: reset the CSA state when leaving","status":"backported","project":false,"upstream":[{"sha":"860134b3af77970e006feab7e5decb8c84771c7f","url":"https://git.kernel.org/stable/c/860134b3af77970e006feab7e5decb8c84771c7f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aba8dfb45864441199748c33ce3c1c8ca121c8bd","label":"aba8dfb45864","date":"2026-10-03T12:35:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"860134b3af77970e006feab7e5decb8c84771c7f","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/860134b3af77970e006feab7e5decb8c84771c7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98327","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98327.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98321","title":"netfilter: nf_nat: unregister and release hooks on error","status":"unfixed","project":false,"upstream":[{"sha":"cbdd39ce42530a193c56beb206a3356cb6d01016","url":"https://git.kernel.org/stable/c/cbdd39ce42530a193c56beb206a3356cb6d01016"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cbdd39ce42530a193c56beb206a3356cb6d01016","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/cbdd39ce42530a193c56beb206a3356cb6d01016.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98321","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98321.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98318","title":"smb: client: validate absolute native symlink targets before NT fixups","status":"not-applicable","project":false,"upstream":[{"sha":"23c240d9509e15f72e4112fc95f0160ab32ec430","url":"https://git.kernel.org/stable/c/23c240d9509e15f72e4112fc95f0160ab32ec430"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"23c240d9509e15f72e4112fc95f0160ab32ec430","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/23c240d9509e15f72e4112fc95f0160ab32ec430.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98318","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98318.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98317","title":"neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.","status":"unfixed","project":false,"upstream":[{"sha":"6d79b223ec44ada58ad37db42f539b60985a7722","url":"https://git.kernel.org/stable/c/6d79b223ec44ada58ad37db42f539b60985a7722"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6d79b223ec44ada58ad37db42f539b60985a7722","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/6d79b223ec44ada58ad37db42f539b60985a7722.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98313","title":"drm/msm/dp: skip PUSH_IDLE when the link was never enabled","status":"unfixed","project":false,"upstream":[{"sha":"e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","url":"https://git.kernel.org/stable/c/e249a6e2a130c08bb4d8b0a55cbe29754307e5c9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/e249a6e2a130c08bb4d8b0a55cbe29754307e5c9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98309","title":"drm/vc4: Use managed KMS polling to fix UAF on unbind","status":"backported","project":false,"upstream":[{"sha":"073a30d75f309812ed61af134f24ffef4107b13a","url":"https://git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cf0c4432bda37b02e7d430ff5017228ceb7caf0c","label":"cf0c4432bda3","date":"2026-10-03T12:35:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"073a30d75f309812ed61af134f24ffef4107b13a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/073a30d75f309812ed61af134f24ffef4107b13a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98309","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98309.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98307","title":"wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()","status":"backported","project":false,"upstream":[{"sha":"820b8cff81c796ba20573e04722ab62500713f97","url":"https://git.kernel.org/stable/c/820b8cff81c796ba20573e04722ab62500713f97"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c4108dce0838ec7d38d782f76f9c007cfe2fff45","label":"c4108dce0838","date":"2026-10-03T12:35:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"820b8cff81c796ba20573e04722ab62500713f97","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/820b8cff81c796ba20573e04722ab62500713f97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98307","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98307.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98304","title":"net: bcmgenet: restore the hardware filters on open","status":"unfixed","project":false,"upstream":[{"sha":"23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","url":"https://git.kernel.org/stable/c/23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98304","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98304.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98297","title":"Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained","status":"backported","project":false,"upstream":[{"sha":"6610c6fe4b8936c232048e6049bf77c70a6f759c","url":"https://git.kernel.org/stable/c/6610c6fe4b8936c232048e6049bf77c70a6f759c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ab0678a0701ac4de499428dc1b321659bb74d272","label":"ab0678a0701a","date":"2026-10-03T12:35:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"6610c6fe4b8936c232048e6049bf77c70a6f759c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98297.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98296","title":"Bluetooth: btintel_pcie: validate TX skb length in send_sync","status":"unfixed","project":false,"upstream":[{"sha":"4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","url":"https://git.kernel.org/stable/c/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98296","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98296.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98295","title":"Bluetooth: coredump: Quiesce dump work on unregister","status":"backported","project":false,"upstream":[{"sha":"d236517c264e41dc09833c708ef23bccb7a91219","url":"https://git.kernel.org/stable/c/d236517c264e41dc09833c708ef23bccb7a91219"}],"evidence":[{"url":"https://git.kernel.org/stable/c/24af375d7d8aa5f698e4dc41317102f44114351a","label":"24af375d7d8a","date":"2026-10-03T12:35:07+02:00","lore":["https://lore.kernel.org/r/20260322210849.68743-1-abysamross@gmail.com","https://lore.kernel.org/r/20260814231248.3096377-1-tristmd@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d236517c264e41dc09833c708ef23bccb7a91219","lines":128,"reason":"","source":"https://github.com/torvalds/linux/commit/d236517c264e41dc09833c708ef23bccb7a91219.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98295","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98295.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98294","title":"Bluetooth: hci_qca: Do not write to the serial port after it is closed","status":"unfixed","project":false,"upstream":[{"sha":"4e93c65f87825e1e012bce56615320aeb123815d","url":"https://git.kernel.org/stable/c/4e93c65f87825e1e012bce56615320aeb123815d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4e93c65f87825e1e012bce56615320aeb123815d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/4e93c65f87825e1e012bce56615320aeb123815d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98294","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98294.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98292","title":"Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access","status":"unfixed","project":false,"upstream":[{"sha":"8879e3e0a84a86954c855caceead4867e74a9a27","url":"https://git.kernel.org/stable/c/8879e3e0a84a86954c855caceead4867e74a9a27"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8879e3e0a84a86954c855caceead4867e74a9a27","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/8879e3e0a84a86954c855caceead4867e74a9a27.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98292","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98292.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98289","title":"af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().","status":"unfixed","project":false,"upstream":[{"sha":"4a4263dfeabad72f95e8ab6e15146861fa4144dd","url":"https://git.kernel.org/stable/c/4a4263dfeabad72f95e8ab6e15146861fa4144dd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4a4263dfeabad72f95e8ab6e15146861fa4144dd","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/4a4263dfeabad72f95e8ab6e15146861fa4144dd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98288","title":"net: stmmac: fix TSO header length truncation","status":"unfixed","project":false,"upstream":[{"sha":"15989abd74f16f44bf953d056b95f1d2fda9b0cd","url":"https://git.kernel.org/stable/c/15989abd74f16f44bf953d056b95f1d2fda9b0cd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"15989abd74f16f44bf953d056b95f1d2fda9b0cd","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/15989abd74f16f44bf953d056b95f1d2fda9b0cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98286","title":"drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown","status":"unfixed","project":false,"upstream":[{"sha":"c391a40f71886b28c082b47270f0e856fa3e1150","url":"https://git.kernel.org/stable/c/c391a40f71886b28c082b47270f0e856fa3e1150"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c391a40f71886b28c082b47270f0e856fa3e1150","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/c391a40f71886b28c082b47270f0e856fa3e1150.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98286","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98286.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98285","title":"net: bridge: vlan: fix bugs caused by switchdev deletion errors","status":"unfixed","project":false,"upstream":[{"sha":"2842ce397dd09882530b42f7fdb0c855767eb24e","url":"https://git.kernel.org/stable/c/2842ce397dd09882530b42f7fdb0c855767eb24e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2842ce397dd09882530b42f7fdb0c855767eb24e","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/2842ce397dd09882530b42f7fdb0c855767eb24e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98285","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98285.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98284","title":"netlink: do not free nlk->groups while lockless readers can use it","status":"unfixed","project":false,"upstream":[{"sha":"ceac0de741bfb47ca255eee075257b3bb31f0651","url":"https://git.kernel.org/stable/c/ceac0de741bfb47ca255eee075257b3bb31f0651"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ceac0de741bfb47ca255eee075257b3bb31f0651","lines":101,"reason":"","source":"https://github.com/torvalds/linux/commit/ceac0de741bfb47ca255eee075257b3bb31f0651.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98284","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98284.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98279","title":"btrfs: handle lack of space when cleaning up verity items","status":"unfixed","project":false,"upstream":[{"sha":"76bf149cd0298544631e756670b89c399c7acbca","url":"https://git.kernel.org/stable/c/76bf149cd0298544631e756670b89c399c7acbca"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"76bf149cd0298544631e756670b89c399c7acbca","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/76bf149cd0298544631e756670b89c399c7acbca.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98279","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98279.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98277","title":"eth: fbnic: ring the doorbell if a burst ends in a drop","status":"unfixed","project":false,"upstream":[{"sha":"490599ab23134962a6d18a024e84541d77bdb999","url":"https://git.kernel.org/stable/c/490599ab23134962a6d18a024e84541d77bdb999"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"490599ab23134962a6d18a024e84541d77bdb999","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/490599ab23134962a6d18a024e84541d77bdb999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98277","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98277.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98273","title":"x86/kprobes: Fix crash when probing CS CALL instructions","status":"unfixed","project":false,"upstream":[{"sha":"a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","url":"https://git.kernel.org/stable/c/a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98273","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98273.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98271","title":"net: skbuff: do not leave stale header offsets after pskb_carve()","status":"backported","project":false,"upstream":[{"sha":"a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","url":"https://git.kernel.org/stable/c/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309"}],"evidence":[{"url":"https://git.kernel.org/stable/c/75e4a3e62531738c124c8555a626426fca29d392","label":"75e4a3e62531","date":"2026-10-03T12:35:08+02:00","lore":["https://lore.kernel.org/netdev/6aa3e9d3.f2639fcc.29487d.0028.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98271","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98271.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98269","title":"btrfs: abort transaction on failure to update inode for hole punching and reflinking","status":"backported","project":false,"upstream":[{"sha":"97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","url":"https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6","label":"834a3b5c5f1e","date":"2026-10-03T12:35:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98269","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98269.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98266","title":"ALSA: core: Fix potential UAF after asynchronous card release","status":"backported","project":false,"upstream":[{"sha":"fd95e68df6fe66344161a1329cbe5e5805e7b704","url":"https://git.kernel.org/stable/c/fd95e68df6fe66344161a1329cbe5e5805e7b704"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5c0df40aa577e405c458e44e8d458dd78407f4af","label":"5c0df40aa577","date":"2026-10-03T12:35:09+02:00","lore":["https://lore.kernel.org/CA+0ovCgQUQNN=Z1tJTouiCsDaXR5M-3-SQEGk-cpPXQkM5Xh+w@mail.gmail.com","https://lore.kernel.org/CA+0ovChexj4TrZL_2iG_P0WBEbZc5+73GfB3DkciQi=R8pZOnA@mail.gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd95e68df6fe66344161a1329cbe5e5805e7b704","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/fd95e68df6fe66344161a1329cbe5e5805e7b704.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98266","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98266.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98254","title":"swiotlb: use the adjusted address for the highmem page lookup","status":"backported","project":false,"upstream":[{"sha":"b7d7914a9ae3097e63d113007e4fb44d33d515b1","url":"https://git.kernel.org/stable/c/b7d7914a9ae3097e63d113007e4fb44d33d515b1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6e53b4d6afbde626255805d438cabb1cac482445","label":"6e53b4d6afbd","date":"2026-10-03T12:35:54+02:00","lore":["https://lore.kernel.org/r/20260905084210.148255-1-donggeunyoo.kernel@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b7d7914a9ae3097e63d113007e4fb44d33d515b1","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/b7d7914a9ae3097e63d113007e4fb44d33d515b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98254","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98254.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98248","title":"arm64: percpu: Fix LSE operations on {8,16}-bit types","status":"backported","project":false,"upstream":[{"sha":"8cf2093f5372952a9ebc805c418d45df7112cd14","url":"https://git.kernel.org/stable/c/8cf2093f5372952a9ebc805c418d45df7112cd14"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d69ab4480e49bf925f4781afcc9f284affcb96b6","label":"d69ab4480e49","date":"2026-10-03T12:35:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8cf2093f5372952a9ebc805c418d45df7112cd14","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/8cf2093f5372952a9ebc805c418d45df7112cd14.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98248","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98248.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98229","title":"xfrm: save input state data before secpath resets","status":"backported","project":false,"upstream":[{"sha":"3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","url":"https://git.kernel.org/stable/c/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa"}],"evidence":[{"url":"https://git.kernel.org/stable/c/35de97850987b3d022ed17df5b2577242e746daf","label":"35de97850987","date":"2026-10-03T12:35:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98229","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98229.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98228","title":"mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ","status":"unfixed","project":false,"upstream":[{"sha":"bbc448c541ed90d52f9ec22f17394304e3bf170e","url":"https://git.kernel.org/stable/c/bbc448c541ed90d52f9ec22f17394304e3bf170e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"bbc448c541ed90d52f9ec22f17394304e3bf170e","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/bbc448c541ed90d52f9ec22f17394304e3bf170e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98228","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98228.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98222","title":"KEYS: encrypted: fix integer overflow of datablob_len","status":"backported","project":false,"upstream":[{"sha":"8697c431e297eb0d0ab13dda6bc172b48a34f05c","url":"https://git.kernel.org/stable/c/8697c431e297eb0d0ab13dda6bc172b48a34f05c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1e720f63dbafc093a8f5d519f05b67724993edd4","label":"1e720f63dbaf","date":"2026-10-03T12:35:12+02:00","lore":["https://lore.kernel.org/r/20260909153433.83117-1-cenzhang@linux.microsoft.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8697c431e297eb0d0ab13dda6bc172b48a34f05c","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/8697c431e297eb0d0ab13dda6bc172b48a34f05c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98222","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98222.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98212","title":"mmc: hsq: Fix use-after-free in retry work","status":"backported","project":false,"upstream":[{"sha":"5d132990475f02cfa1debe03d50b479432864ebd","url":"https://git.kernel.org/stable/c/5d132990475f02cfa1debe03d50b479432864ebd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/df2eb59fd9eb33663dc1053f5a4ed851e0aa1f67","label":"df2eb59fd9eb","date":"2026-10-03T12:35:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5d132990475f02cfa1debe03d50b479432864ebd","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/5d132990475f02cfa1debe03d50b479432864ebd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98212","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98212.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98211","title":"mmc: mmci: Fix use-after-free in busy-timeout work","status":"backported","project":false,"upstream":[{"sha":"2b19cf3e50cddaff07b657dae1a8f30f06032852","url":"https://git.kernel.org/stable/c/2b19cf3e50cddaff07b657dae1a8f30f06032852"}],"evidence":[{"url":"https://git.kernel.org/stable/c/af6fbf72e899932f330c4e5d0b84d985c922c633","label":"af6fbf72e899","date":"2026-10-03T12:35:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b19cf3e50cddaff07b657dae1a8f30f06032852","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/2b19cf3e50cddaff07b657dae1a8f30f06032852.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98182","title":"wifi: mac80211: refuse to make a monitor active when it has no queue","status":"backported","project":false,"upstream":[{"sha":"2b04d6556964ae9f89819b86a0a7801e39c3aae5","url":"https://git.kernel.org/stable/c/2b04d6556964ae9f89819b86a0a7801e39c3aae5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b7b7d46ec4fa127767931938b282c361c0519af6","label":"b7b7d46ec4fa","date":"2026-10-03T12:35:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b04d6556964ae9f89819b86a0a7801e39c3aae5","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/2b04d6556964ae9f89819b86a0a7801e39c3aae5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98182","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98182.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98180","title":"drm/msm: RCU-free the scheduler-containing ring and VM objects","status":"unfixed","project":false,"upstream":[{"sha":"01c8d1f385f788f1bbbbb7687c4386d614281218","url":"https://git.kernel.org/stable/c/01c8d1f385f788f1bbbbb7687c4386d614281218"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"01c8d1f385f788f1bbbbb7687c4386d614281218","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/01c8d1f385f788f1bbbbb7687c4386d614281218.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98180","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98180.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98179","title":"drm/amdgpu: fix rmmio iounmap skipped on device removal","status":"backported","project":false,"upstream":[{"sha":"5155002b03b24ba3ef91c5c313b8cf0171b24904","url":"https://git.kernel.org/stable/c/5155002b03b24ba3ef91c5c313b8cf0171b24904"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e81502d6791df9ecd003bfb2ca44f0d1f1b38439","label":"e81502d6791d","date":"2026-10-03T12:35:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5155002b03b24ba3ef91c5c313b8cf0171b24904","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/5155002b03b24ba3ef91c5c313b8cf0171b24904.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98179","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98179.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98177","title":"drm/amdkfd: Avoid integer underflow in EOP ring size calculation.","status":"unfixed","project":false,"upstream":[{"sha":"8ee521b8b189799e361d4233c5180ba56656d4d4","url":"https://git.kernel.org/stable/c/8ee521b8b189799e361d4233c5180ba56656d4d4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ee521b8b189799e361d4233c5180ba56656d4d4","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/8ee521b8b189799e361d4233c5180ba56656d4d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98177","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98177.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98176","title":"drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc","status":"unfixed","project":false,"upstream":[{"sha":"c883d0a132d430ef7ebb23fd94323be94d0fbdb8","url":"https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c883d0a132d430ef7ebb23fd94323be94d0fbdb8","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/c883d0a132d430ef7ebb23fd94323be94d0fbdb8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98176","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98176.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98175","title":"smb: client: cancel reconnect work in clean_demultiplex_info()","status":"backported","project":false,"upstream":[{"sha":"c65eae6f61d1778ff7a82e4aae4080e26f486af1","url":"https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e3f6a779433d13aafb5edab59e4f9313051e8a52","label":"e3f6a779433d","date":"2026-10-03T12:35:17+02:00","lore":["https://lore.kernel.org/r/6aa4a12d.f81106d8.2ab401.0023.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c65eae6f61d1778ff7a82e4aae4080e26f486af1","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/c65eae6f61d1778ff7a82e4aae4080e26f486af1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98175","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98175.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98174","title":"smb: client: fix rlist race and missing initialization","status":"backported","project":false,"upstream":[{"sha":"5f270f091256da1338c3631083e15d7f83cc05e1","url":"https://git.kernel.org/stable/c/5f270f091256da1338c3631083e15d7f83cc05e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5a8f82f9c5839389cf4036029dd75a9911049e83","label":"5a8f82f9c583","date":"2026-10-03T12:35:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"5f270f091256da1338c3631083e15d7f83cc05e1","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/5f270f091256da1338c3631083e15d7f83cc05e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98164","title":"KVM: x86/mmu: Check write tracking in all address spaces","status":"backported","project":false,"upstream":[{"sha":"0f38453cdb2e17566ccb7c0f3dabd5bd21caca26","url":"https://git.kernel.org/stable/c/0f38453cdb2e17566ccb7c0f3dabd5bd21caca26"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a","label":"d8636c8f9f95","date":"2026-09-02T14:30:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0f38453cdb2e17566ccb7c0f3dabd5bd21caca26","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98164","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98164.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98162","title":"smb/server: fix tree connection leak in smb2_tree_connect()","status":"unfixed","project":false,"upstream":[{"sha":"39f2032096715daae5f6fd0f587ca7a474b019df","url":"https://git.kernel.org/stable/c/39f2032096715daae5f6fd0f587ca7a474b019df"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"39f2032096715daae5f6fd0f587ca7a474b019df","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/39f2032096715daae5f6fd0f587ca7a474b019df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98162","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98162.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98161","title":"nvdimm: pmem: keep PREFLUSH before data writes","status":"backported","project":false,"upstream":[{"sha":"c644a2f8fef5618fcf453c591177700fd07dd024","url":"https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d34c30bc994328d9cf6749b2e9a32aabd08fd076","label":"d34c30bc9943","date":"2026-10-03T12:35:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c644a2f8fef5618fcf453c591177700fd07dd024","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/c644a2f8fef5618fcf453c591177700fd07dd024.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98156","title":"drm/virtio: use the DMA API for resource backing on Xen","status":"backported","project":false,"upstream":[{"sha":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","url":"https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3f130cc6826fabf50e01fe8e4ff3ed1fcae50d36","label":"3f130cc6826f","date":"2026-10-21T10:31:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98156.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98153","title":"nvme: fix racy access to FDP placement id array","status":"not-applicable","project":false,"upstream":[{"sha":"56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","url":"https://git.kernel.org/stable/c/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98153","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98153.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98148","title":"drm/gud: validate GUD_ROTATION_0 is present in supported rotations","status":"backported","project":false,"upstream":[{"sha":"cb732d027aa18e1fcf9d2797f47d20b179ebc59c","url":"https://git.kernel.org/stable/c/cb732d027aa18e1fcf9d2797f47d20b179ebc59c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/962cdf2eedb2708eb99c25ffb56c6d6981d41ed6","label":"962cdf2eedb2","date":"2026-10-21T10:31:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cb732d027aa18e1fcf9d2797f47d20b179ebc59c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/cb732d027aa18e1fcf9d2797f47d20b179ebc59c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98148","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98148.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98144","title":"accel/amdxdna: put the chained BO when its mapping fails","status":"not-applicable","project":false,"upstream":[{"sha":"7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","url":"https://git.kernel.org/stable/c/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98144","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98144.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98142","title":"drm/cirrus-qemu: Validate BAR0 size during probe","status":"backported","project":false,"upstream":[{"sha":"92312d333bf700798f92f30406c721bce87506f3","url":"https://git.kernel.org/stable/c/92312d333bf700798f92f30406c721bce87506f3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0b5084a1f070ad1fc34e11945644ae034bbc774c","label":"0b5084a1f070","date":"2026-09-21T15:01:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"92312d333bf700798f92f30406c721bce87506f3","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/92312d333bf700798f92f30406c721bce87506f3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98142","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98142.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98131","title":"net: stmmac: fix dma mapping leak in stmmac_tso_xmit()","status":"backported","project":false,"upstream":[{"sha":"a5d946466a95621fa2769720d59ea336003aa1a5","url":"https://git.kernel.org/stable/c/a5d946466a95621fa2769720d59ea336003aa1a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c5449b635362cb678d29d8f6ab54e65734d891ce","label":"c5449b635362","date":"2026-10-21T10:31:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"a5d946466a95621fa2769720d59ea336003aa1a5","lines":120,"reason":"","source":"https://github.com/torvalds/linux/commit/a5d946466a95621fa2769720d59ea336003aa1a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98131","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98131.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98127","title":"smb/client: validate new EOF for insert range","status":"backported","project":false,"upstream":[{"sha":"1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","url":"https://git.kernel.org/stable/c/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7c2c69045aa76ccaa7f16f1478eb312130ce4951","label":"7c2c69045aa7","date":"2026-09-21T15:02:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98127","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98127.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98126","title":"smb/client: validate new EOF for zero range","status":"backported","project":false,"upstream":[{"sha":"88972e35750792e717af287dc71f42a03b5cbce4","url":"https://git.kernel.org/stable/c/88972e35750792e717af287dc71f42a03b5cbce4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3673f057b64abfa957e8ae84448db69369a5091a","label":"3673f057b64a","date":"2026-09-21T15:02:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"88972e35750792e717af287dc71f42a03b5cbce4","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/88972e35750792e717af287dc71f42a03b5cbce4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98126","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98126.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98125","title":"smb/client: fix stale page cache in insert/collapse range","status":"unfixed","project":false,"upstream":[{"sha":"01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","url":"https://git.kernel.org/stable/c/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98124","title":"smb/client: invalidate fscache for fallocate range operations","status":"backported","project":false,"upstream":[{"sha":"448ba0ae65ca61064183564d2983c9aa59bd6ba7","url":"https://git.kernel.org/stable/c/448ba0ae65ca61064183564d2983c9aa59bd6ba7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dd8b1e808f5c19479e6ed47e2f88a1fd46f8b0e5","label":"dd8b1e808f5c","date":"2026-10-21T10:31:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"448ba0ae65ca61064183564d2983c9aa59bd6ba7","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/448ba0ae65ca61064183564d2983c9aa59bd6ba7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98124","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98124.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98119","title":"netfs: break unbuffered write when netfs_alloc_subrequest() fails","status":"unfixed","project":false,"upstream":[{"sha":"8fb45a934661419c04a44d4cfea1e0df7dcf2805","url":"https://git.kernel.org/stable/c/8fb45a934661419c04a44d4cfea1e0df7dcf2805"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8fb45a934661419c04a44d4cfea1e0df7dcf2805","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/8fb45a934661419c04a44d4cfea1e0df7dcf2805.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98119","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98119.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98118","title":"netfs: Fix readahead synchronisation issues by loading all folios upfront","status":"unfixed","project":false,"upstream":[{"sha":"fed0b33e6c584986ba70018ec9f9787a98216e64","url":"https://git.kernel.org/stable/c/fed0b33e6c584986ba70018ec9f9787a98216e64"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"fed0b33e6c584986ba70018ec9f9787a98216e64","lines":362,"reason":"","source":"https://github.com/torvalds/linux/commit/fed0b33e6c584986ba70018ec9f9787a98216e64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98115","title":"ksmbd: safely drain sessions during logoff","status":"unfixed","project":false,"upstream":[{"sha":"d12168084c8c1b6d883c8eca5853929ac5136a9e","url":"https://git.kernel.org/stable/c/d12168084c8c1b6d883c8eca5853929ac5136a9e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d12168084c8c1b6d883c8eca5853929ac5136a9e","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/d12168084c8c1b6d883c8eca5853929ac5136a9e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98114","title":"ksmbd: propagate DACL parsing errors","status":"backported","project":false,"upstream":[{"sha":"c61dc7b1b4a3234b4aa3965502908a292238805c","url":"https://git.kernel.org/stable/c/c61dc7b1b4a3234b4aa3965502908a292238805c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/461f10a5297e85b7c1cd21838922f2e57b934d2d","label":"461f10a5297e","date":"2026-09-21T15:02:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c61dc7b1b4a3234b4aa3965502908a292238805c","lines":147,"reason":"","source":"https://github.com/torvalds/linux/commit/c61dc7b1b4a3234b4aa3965502908a292238805c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98114","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98114.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98111","title":"Bluetooth: btintel: validate version TLV value lengths","status":"backported","project":false,"upstream":[{"sha":"a086c0892969bf8a0151b0f12bd14a68827c88b2","url":"https://git.kernel.org/stable/c/a086c0892969bf8a0151b0f12bd14a68827c88b2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/83499ac3ca62e43ed40f7574b13ed398a6891511","label":"83499ac3ca62","date":"2026-09-21T15:02:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a086c0892969bf8a0151b0f12bd14a68827c88b2","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/a086c0892969bf8a0151b0f12bd14a68827c88b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98111","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98111.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98107","title":"Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect","status":"backported","project":false,"upstream":[{"sha":"56c2b5831d39dc84aad2573dc3e197af1a872a05","url":"https://git.kernel.org/stable/c/56c2b5831d39dc84aad2573dc3e197af1a872a05"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ce0927eb3ee2939fab5ce3f9334bfd2fafb38481","label":"ce0927eb3ee2","date":"2026-09-21T15:02:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"56c2b5831d39dc84aad2573dc3e197af1a872a05","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/56c2b5831d39dc84aad2573dc3e197af1a872a05.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98107","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98107.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98106","title":"drm/pagemap: Prevent double migration of device pages","status":"not-applicable","project":false,"upstream":[{"sha":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","url":"https://git.kernel.org/stable/c/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","lines":204,"reason":"","source":"https://github.com/torvalds/linux/commit/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98106","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98106.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98103","title":"igmp: convert struct ip_sf_list to RCU","status":"backported","project":false,"upstream":[{"sha":"2987ee196c88dbde0463dc87d5fb209c684e34a2","url":"https://git.kernel.org/stable/c/2987ee196c88dbde0463dc87d5fb209c684e34a2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f5182dfad54277267a8cb0c004a9cd4cf35aeebb","label":"f5182dfad542","date":"2026-09-21T15:02:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2987ee196c88dbde0463dc87d5fb209c684e34a2","lines":490,"reason":"","source":"https://github.com/torvalds/linux/commit/2987ee196c88dbde0463dc87d5fb209c684e34a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98102","title":"ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()","status":"backported","project":false,"upstream":[{"sha":"93b49239840b91313adbd77b8b52993eff2d08c1","url":"https://git.kernel.org/stable/c/93b49239840b91313adbd77b8b52993eff2d08c1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4352737297b262e8367675c19a7dc6a9f53c97af","label":"4352737297b2","date":"2026-09-21T15:02:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"93b49239840b91313adbd77b8b52993eff2d08c1","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/93b49239840b91313adbd77b8b52993eff2d08c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98101","title":"ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()","status":"backported","project":false,"upstream":[{"sha":"c073d1b070f171d206b19c98d71739a97f15b3f1","url":"https://git.kernel.org/stable/c/c073d1b070f171d206b19c98d71739a97f15b3f1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dba00514bf668c26cb4900e9f0da84bf96bf065a","label":"dba00514bf66","date":"2026-10-03T12:34:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c073d1b070f171d206b19c98d71739a97f15b3f1","lines":147,"reason":"","source":"https://github.com/torvalds/linux/commit/c073d1b070f171d206b19c98d71739a97f15b3f1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98099","title":"ipv6: mcast: use rcu_assign_pointer() for __rcu list updates","status":"backported","project":false,"upstream":[{"sha":"0c8f56c583c3250408367880c98e4d6fbc929315","url":"https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315"}],"evidence":[{"url":"https://git.kernel.org/stable/c/49d7e1b456ba2f3ee08b3e264d999c09992cde8e","label":"49d7e1b456ba","date":"2026-10-21T10:31:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0c8f56c583c3250408367880c98e4d6fbc929315","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/0c8f56c583c3250408367880c98e4d6fbc929315.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98099","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98099.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98097","title":"tipc: Dont send random pad bytes in RESET/ACTIVATE messages","status":"backported","project":false,"upstream":[{"sha":"81c600c26302a27852ed8b19c5f2f647ea3555c9","url":"https://git.kernel.org/stable/c/81c600c26302a27852ed8b19c5f2f647ea3555c9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/48033a89356b8ae21a94db70c79bb6fcc91a23c2","label":"48033a89356b","date":"2026-09-21T15:02:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"81c600c26302a27852ed8b19c5f2f647ea3555c9","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/81c600c26302a27852ed8b19c5f2f647ea3555c9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98087","title":"sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate","status":"unfixed","project":false,"upstream":[{"sha":"dae5c0292080dd7b9c7d784268dcf443f1f3d15e","url":"https://git.kernel.org/stable/c/dae5c0292080dd7b9c7d784268dcf443f1f3d15e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"dae5c0292080dd7b9c7d784268dcf443f1f3d15e","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/dae5c0292080dd7b9c7d784268dcf443f1f3d15e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98087","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98087.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98085","title":"bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge","status":"backported","project":false,"upstream":[{"sha":"387b1baefbb776e3f48dc2261e77a49213f470f7","url":"https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/12c064bcfa56e3631be9f5336ee113b7f849959a","label":"12c064bcfa56","date":"2026-10-21T10:31:03+02:00","lore":["https://lore.kernel.org/bpf/20260901-bug-016-backtrack-ld-abs-v1-1-59368f1be435@gmail.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":{"id":"CVE-2026-98085","series":"6.12.y","upstream":["387b1baefbb776e3f48dc2261e77a49213f470f7"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"The newer scalar backtracker does not traverse the implicit parent-frame subprogram-exit edge for ld_abs/ld_ind; 6.1 is unaffected because its backtracker conservatively returns ENOTSUPP for these opcodes.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n3899"},{"label":"Upstream fix 387b1baefbb7","url":"https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7"}]},"size":{"status":"within-limit","patches":[{"sha":"387b1baefbb776e3f48dc2261e77a49213f470f7","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/387b1baefbb776e3f48dc2261e77a49213f470f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98084","title":"bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks","status":"backported","project":false,"upstream":[{"sha":"e3e4f66cc4b72333d0886ae2673c360248987889","url":"https://git.kernel.org/stable/c/e3e4f66cc4b72333d0886ae2673c360248987889"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cdc93c6370f792d0649df2a145ac0cdcd430e411","label":"cdc93c6370f7","date":"2026-10-21T10:31:03+02:00","lore":["https://lore.kernel.org/r/20260831-bug-015-backtrack-cb-args-precise-v1-1-68a8e2a821e0@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-98084","series":"6.12.y","upstream":["e3e4f66cc4b72333d0886ae2673c360248987889"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"Callback backtracking on BPF_EXIT clears outer-frame R1-R5 when calls_callback is set, losing caller precision.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n3899"},{"label":"Upstream fix e3e4f66cc4b7","url":"https://git.kernel.org/stable/c/e3e4f66cc4b72333d0886ae2673c360248987889"}]},"size":{"status":"within-limit","patches":[{"sha":"e3e4f66cc4b72333d0886ae2673c360248987889","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/e3e4f66cc4b72333d0886ae2673c360248987889.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98084","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98084.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98081","title":"btrfs: zoned: finish active block group cleanup if call_zone_finish() fails","status":"backported","project":false,"upstream":[{"sha":"a18a6b93a2843b9d103d3456bbd4b3f90282a379","url":"https://git.kernel.org/stable/c/a18a6b93a2843b9d103d3456bbd4b3f90282a379"}],"evidence":[{"url":"https://git.kernel.org/stable/c/36b9cdab44848f25879ca625275c92b007f84653","label":"36b9cdab4484","date":"2026-09-21T15:02:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a18a6b93a2843b9d103d3456bbd4b3f90282a379","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/a18a6b93a2843b9d103d3456bbd4b3f90282a379.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98081","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98081.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98079","title":"btrfs: zstd: fix lost wakeup when waiting for a workspace","status":"backported","project":false,"upstream":[{"sha":"2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","url":"https://git.kernel.org/stable/c/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/844603cf842ee67640d33f350e3fa60f3de7fad3","label":"844603cf842e","date":"2026-10-21T10:31:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98073","title":"net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().","status":"backported","project":false,"upstream":[{"sha":"debac3a20dec524a59625cf10fa2f18571127824","url":"https://git.kernel.org/stable/c/debac3a20dec524a59625cf10fa2f18571127824"}],"evidence":[{"url":"https://git.kernel.org/stable/c/119ac1716705af17fb74b3e33058a938a87eecd4","label":"119ac1716705","date":"2026-10-21T10:31:03+02:00","lore":["https://lore.kernel.org/all/6a96219e.04428c52.29b18.0001.GAE@google.com/T/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"debac3a20dec524a59625cf10fa2f18571127824","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/debac3a20dec524a59625cf10fa2f18571127824.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98067","title":"erofs: disable LZ4 rolling decompression for now","status":"backported","project":false,"upstream":[{"sha":"82e664cf1219c459c33aae931b222cf951af9cb7","url":"https://git.kernel.org/stable/c/82e664cf1219c459c33aae931b222cf951af9cb7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d923e53472b468a50a6cf41341531d5170c68371","label":"d923e53472b4","date":"2026-10-21T10:31:02+02:00","lore":["https://lore.kernel.org/r/BEZP281MB2102E57CD31862B8D958B33DD2AC2@BEZP281MB2102.DEUP281.PROD.OUTLOOK.COM"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"82e664cf1219c459c33aae931b222cf951af9cb7","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/82e664cf1219c459c33aae931b222cf951af9cb7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98067","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98067.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98058","title":"bpf: Mark syscall helpers as sleepable","status":"backported","project":false,"upstream":[{"sha":"d05524794240b52fdc3b6c1220dd05505715824d","url":"https://git.kernel.org/stable/c/d05524794240b52fdc3b6c1220dd05505715824d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d8cfe9f71d302970ae393616960f2b3021d2b3b0","label":"d8cfe9f71d30","date":"2026-10-21T10:31:02+02:00","lore":["https://lore.kernel.org/r/20260903144433.1716731-10-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d05524794240b52fdc3b6c1220dd05505715824d","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/d05524794240b52fdc3b6c1220dd05505715824d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98058","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98058.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98056","title":"nvme: remove stale namespaces by NSID range during scan","status":"backported","project":false,"upstream":[{"sha":"4ed7f3d7d435bf5b63da2814dc9270f5ba896011","url":"https://git.kernel.org/stable/c/4ed7f3d7d435bf5b63da2814dc9270f5ba896011"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c84ad7407fb16b92d9b7a649cc304a9cf3757897","label":"c84ad7407fb1","date":"2026-09-21T15:02:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4ed7f3d7d435bf5b63da2814dc9270f5ba896011","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/4ed7f3d7d435bf5b63da2814dc9270f5ba896011.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98056","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98056.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98049","title":"bpf: zero extend the result of an arena 32-bit cmpxchg","status":"backported","project":false,"upstream":[{"sha":"4814ed6406f3493bd554ad046da5f7fc04833571","url":"https://git.kernel.org/stable/c/4814ed6406f3493bd554ad046da5f7fc04833571"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1bb1be18263995b159cf5afad3a05500ba6d2a7b","label":"1bb1be182639","date":"2026-10-21T10:31:02+02:00","lore":["https://lore.kernel.org/r/20260903171542.1438050-1-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-98049","series":"6.12.y","upstream":["4814ed6406f3493bd554ad046da5f7fc04833571"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"The verifier cmpxchg predicate recognizes BPF_ATOMIC but not the arena-rewritten BPF_PROBE_ATOMIC, so the result can skip required zero extension.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n574"},{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n574"},{"label":"Upstream fix 4814ed6406f3","url":"https://git.kernel.org/stable/c/4814ed6406f3493bd554ad046da5f7fc04833571"}]},"size":{"status":"within-limit","patches":[{"sha":"4814ed6406f3493bd554ad046da5f7fc04833571","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/4814ed6406f3493bd554ad046da5f7fc04833571.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98049","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98049.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98044","title":"bpf: Reject legacy packet loads from callbacks","status":"backported","project":false,"upstream":[{"sha":"e7d28823c662128caae63f14e16bd394916c139b","url":"https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cebda2a2bb4183550eae9dcf888c16407b4fffda","label":"cebda2a2bb41","date":"2026-10-21T10:31:02+02:00","lore":["https://lore.kernel.org/bpf/20260903152147.C0E241F00A3A@smtp.kernel.org","https://lore.kernel.org/r/20260903214758.2727663-8-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"e7d28823c662128caae63f14e16bd394916c139b","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/e7d28823c662128caae63f14e16bd394916c139b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98043","title":"bpf: Don't infer non-NULL from a pointer with an unbounded offset","status":"backported","project":false,"upstream":[{"sha":"67b529f521a6676cdfc78b91b0217d7eaa84216b","url":"https://git.kernel.org/stable/c/67b529f521a6676cdfc78b91b0217d7eaa84216b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/019d845a08b8ccfe8eefaaf4bca6870f2b8c58ae","label":"019d845a08b8","date":"2026-10-21T10:31:02+02:00","lore":["https://lore.kernel.org/bpf/20260904083325.2083493-1-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"67b529f521a6676cdfc78b91b0217d7eaa84216b","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/67b529f521a6676cdfc78b91b0217d7eaa84216b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98041","title":"bpf: Don't predict JMP32 pointer vs zero comparisons","status":"backported","project":false,"upstream":[{"sha":"e51179a4e09846f8fd0f26a05068520de2b301bf","url":"https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d","label":"d16f0eafcaa6","date":"2026-09-21T15:02:11+02:00","lore":["https://lore.kernel.org/bpf/20260904083325.2083493-5-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e51179a4e09846f8fd0f26a05068520de2b301bf","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/e51179a4e09846f8fd0f26a05068520de2b301bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98041","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98041.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98034","title":"bpf: Mark NULL kptr stores precise","status":"backported","project":false,"upstream":[{"sha":"ecdc5043794c9184aa8e6c814603899479c46b35","url":"https://git.kernel.org/stable/c/ecdc5043794c9184aa8e6c814603899479c46b35"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b8b98d3d37908402ff63515fa4d7574235436ea8","label":"b8b98d3d3790","date":"2026-10-21T10:31:01+02:00","lore":["https://lore.kernel.org/r/20260904104203.345917-6-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ecdc5043794c9184aa8e6c814603899479c46b35","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/ecdc5043794c9184aa8e6c814603899479c46b35.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98034","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98034.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98033","title":"bpf: Preserve inner map identity in callback frames","status":"backported","project":false,"upstream":[{"sha":"b90c5d770dad910fb89e6c1b15052a8a1e8db752","url":"https://git.kernel.org/stable/c/b90c5d770dad910fb89e6c1b15052a8a1e8db752"}],"evidence":[{"url":"https://git.kernel.org/stable/c/166221c52d3ca332f8699a854efca8e2704bb137","label":"166221c52d3c","date":"2026-10-21T10:31:01+02:00","lore":["https://lore.kernel.org/r/20260904104203.345917-8-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b90c5d770dad910fb89e6c1b15052a8a1e8db752","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/b90c5d770dad910fb89e6c1b15052a8a1e8db752.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98033","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98033.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98026","title":"net: bridge: mcast: properly convert mglist to rcu","status":"backported","project":false,"upstream":[{"sha":"4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","url":"https://git.kernel.org/stable/c/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/98247c8264d2076f81fa114bdfa2c2271953ac7c","label":"98247c8264d2","date":"2026-09-21T15:02:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98021","title":"net: reject oversized tx_queue_len at netlink parse time","status":"backported","project":false,"upstream":[{"sha":"1aa9e143bf51405665a793d4cc925e1c4f0c5922","url":"https://git.kernel.org/stable/c/1aa9e143bf51405665a793d4cc925e1c4f0c5922"}],"evidence":[{"url":"https://git.kernel.org/stable/c/45ca9f59b6c7ea70e0a17054902b8a556913db34","label":"45ca9f59b6c7","date":"2026-09-21T15:02:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1aa9e143bf51405665a793d4cc925e1c4f0c5922","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/1aa9e143bf51405665a793d4cc925e1c4f0c5922.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98021","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98021.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98019","title":"bpf: mark a NULL call argument precise","status":"backported","project":false,"upstream":[{"sha":"1a3a10b030c96ea88868ccc060a16827c01eaa5a","url":"https://git.kernel.org/stable/c/1a3a10b030c96ea88868ccc060a16827c01eaa5a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/627089c278df58749f25686c6a3caf7e181b5951","label":"627089c278df","date":"2026-10-21T10:31:01+02:00","lore":["https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-1-0f5a360ff15d@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a3a10b030c96ea88868ccc060a16827c01eaa5a","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/1a3a10b030c96ea88868ccc060a16827c01eaa5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98019","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98019.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98003","title":"iommu/amd: Do not reallocate GA log buffers on resume","status":"backported","project":false,"upstream":[{"sha":"00a7dd64888d6dd72110b40e2824a088cf7b7386","url":"https://git.kernel.org/stable/c/00a7dd64888d6dd72110b40e2824a088cf7b7386"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ff85cdc2889e1c885eed218ee5bc0b59e0235b3f","label":"ff85cdc2889e","date":"2026-10-21T10:31:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00a7dd64888d6dd72110b40e2824a088cf7b7386","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/00a7dd64888d6dd72110b40e2824a088cf7b7386.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98003","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98003.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97997","title":"virtio_ring: fix stale descriptor flags after a failed packed add","status":"backported","project":false,"upstream":[{"sha":"75d276e5bb68778b2916f98a2bc30f142ebadc64","url":"https://git.kernel.org/stable/c/75d276e5bb68778b2916f98a2bc30f142ebadc64"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cfe8128ceb78374b0f9cebb608bb48e3928d784a","label":"cfe8128ceb78","date":"2026-10-21T10:31:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75d276e5bb68778b2916f98a2bc30f142ebadc64","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/75d276e5bb68778b2916f98a2bc30f142ebadc64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97997","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97997.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97994","title":"vhost/vdpa: reject VRING_NUM larger than device max","status":"backported","project":false,"upstream":[{"sha":"ccb1dc7c527f8c925925cf92afc76ae590dac311","url":"https://git.kernel.org/stable/c/ccb1dc7c527f8c925925cf92afc76ae590dac311"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1d09201d81b7d3e276860cc7b7dbf6c6cbe8e9b4","label":"1d09201d81b7","date":"2026-09-21T15:02:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ccb1dc7c527f8c925925cf92afc76ae590dac311","lines":81,"reason":"","source":"https://github.com/torvalds/linux/commit/ccb1dc7c527f8c925925cf92afc76ae590dac311.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97994","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97994.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97992","title":"vhost-vdpa: protect config_ctx from being freed under the config callback","status":"backported","project":false,"upstream":[{"sha":"62be4e3e5f5f947fbf765b914cebdc478f715d12","url":"https://git.kernel.org/stable/c/62be4e3e5f5f947fbf765b914cebdc478f715d12"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bf35c8948ab7a3eaf1f724fa1e870e3f73a1749b","label":"bf35c8948ab7","date":"2026-09-21T15:02:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"62be4e3e5f5f947fbf765b914cebdc478f715d12","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/62be4e3e5f5f947fbf765b914cebdc478f715d12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97992","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97992.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97990","title":"vdpa_sim_net: check TX pull result before RX copy","status":"backported","project":false,"upstream":[{"sha":"0d195797a80b77f2ec56718cd26d3ee65d0093e8","url":"https://git.kernel.org/stable/c/0d195797a80b77f2ec56718cd26d3ee65d0093e8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c001abcde865b74231da8f1412c3217dbf66781e","label":"c001abcde865","date":"2026-09-21T15:02:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0d195797a80b77f2ec56718cd26d3ee65d0093e8","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/0d195797a80b77f2ec56718cd26d3ee65d0093e8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97989","title":"vduse: validate virtqueue alignment","status":"backported","project":false,"upstream":[{"sha":"fa2c25b4add57888acfa89e398389e267bff3dcf","url":"https://git.kernel.org/stable/c/fa2c25b4add57888acfa89e398389e267bff3dcf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5d4bdca17d87c90b1d888f8846a781a18aa453c9","label":"5d4bdca17d87","date":"2026-10-21T10:31:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fa2c25b4add57888acfa89e398389e267bff3dcf","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/fa2c25b4add57888acfa89e398389e267bff3dcf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97988","title":"vhost: invalidate vring access on IOTLB transitions","status":"backported","project":false,"upstream":[{"sha":"e4f4761879a230aa59e569102a6ab9851847d833","url":"https://git.kernel.org/stable/c/e4f4761879a230aa59e569102a6ab9851847d833"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e8fe13c14d57cc7c6bd69c72c5fabaaf0d918f98","label":"e8fe13c14d57","date":"2026-10-21T10:31:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"e4f4761879a230aa59e569102a6ab9851847d833","lines":104,"reason":"","source":"https://github.com/torvalds/linux/commit/e4f4761879a230aa59e569102a6ab9851847d833.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97985","title":"af_unix: Update last skb marker in manage_oob().","status":"backported","project":false,"upstream":[{"sha":"94fd4debd2e3a69cf93e766c8b328a810c228119","url":"https://git.kernel.org/stable/c/94fd4debd2e3a69cf93e766c8b328a810c228119"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0630bfc773d85ac44da05b2c5a037dbbd39301ab","label":"0630bfc773d8","date":"2026-09-21T15:02:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"94fd4debd2e3a69cf93e766c8b328a810c228119","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/94fd4debd2e3a69cf93e766c8b328a810c228119.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97985","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97985.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97984","title":"net: ipv6: Fix UDP length overflow with PMTU discover and big MTU","status":"backported","project":false,"upstream":[{"sha":"0ae10b6be49b425827659b23bcce498f80eb7182","url":"https://git.kernel.org/stable/c/0ae10b6be49b425827659b23bcce498f80eb7182"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1d56a00ec91f2885c64ea5b8cea18cb746b91bbb","label":"1d56a00ec91f","date":"2026-09-21T15:02:17+02:00","lore":["https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0ae10b6be49b425827659b23bcce498f80eb7182","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0ae10b6be49b425827659b23bcce498f80eb7182.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97984","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97984.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97978","title":"eth: ice: don't dereference pointers from TP_printk()","status":"backported","project":false,"upstream":[{"sha":"b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","url":"https://git.kernel.org/stable/c/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ae230874e3ba27e975a9bb21a6ffd05d6a2ea318","label":"ae230874e3ba","date":"2026-09-21T15:02:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","lines":88,"reason":"","source":"https://github.com/torvalds/linux/commit/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97978","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97978.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97975","title":"Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()","status":"backported","project":false,"upstream":[{"sha":"9b851b09b392da68bd715601f10a5adb2d8d19b8","url":"https://git.kernel.org/stable/c/9b851b09b392da68bd715601f10a5adb2d8d19b8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/66cc55b69928b742d24b4c5b66d195ae96900e48","label":"66cc55b69928","date":"2026-10-21T10:31:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"9b851b09b392da68bd715601f10a5adb2d8d19b8","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/9b851b09b392da68bd715601f10a5adb2d8d19b8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97965","title":"vxlan: initialize _md in vxlan_xmit_one()","status":"backported","project":false,"upstream":[{"sha":"be83178bfc44588f6e3adb827ed874c683193466","url":"https://git.kernel.org/stable/c/be83178bfc44588f6e3adb827ed874c683193466"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0d13b5a413bffc8718b3821b78537ccc6596c233","label":"0d13b5a413bf","date":"2026-09-21T15:02:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"be83178bfc44588f6e3adb827ed874c683193466","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/be83178bfc44588f6e3adb827ed874c683193466.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97965","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97965.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97953","title":"net: stmmac: fix TX descriptor availability check for TSO traffic","status":"backported","project":false,"upstream":[{"sha":"5e38d732ec67a5b1f9a56e6c73add480c4b6030a","url":"https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ffa6d2481bc1c87f822ecd626561484e4ee24cef","label":"ffa6d2481bc1","date":"2026-09-21T15:02:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5e38d732ec67a5b1f9a56e6c73add480c4b6030a","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/5e38d732ec67a5b1f9a56e6c73add480c4b6030a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97953","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97953.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97950","title":"configfs: pin the symlink target's dirent instead of chasing ->ci_dentry","status":"backported","project":false,"upstream":[{"sha":"a7c1290eef60711c10289c056ad32ed1f2b47b12","url":"https://git.kernel.org/stable/c/a7c1290eef60711c10289c056ad32ed1f2b47b12"}],"evidence":[{"url":"https://git.kernel.org/stable/c/846ff40fd57a47e59a41f4e331ec3b34efaddc23","label":"846ff40fd57a","date":"2026-10-03T12:35:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a7c1290eef60711c10289c056ad32ed1f2b47b12","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/a7c1290eef60711c10289c056ad32ed1f2b47b12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97950","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97950.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97949","title":"configfs: unhash the dentry before dropping the item in rmdir","status":"backported","project":false,"upstream":[{"sha":"f06c2d26d1999d37e93299db0ecead04ca7d0b9f","url":"https://git.kernel.org/stable/c/f06c2d26d1999d37e93299db0ecead04ca7d0b9f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/446720051d44eebaa81b33969173160057b73a33","label":"446720051d44","date":"2026-10-03T12:35:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f06c2d26d1999d37e93299db0ecead04ca7d0b9f","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/f06c2d26d1999d37e93299db0ecead04ca7d0b9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97938","title":"reboot: fix cad_pid use-after-free race","status":"backported","project":false,"upstream":[{"sha":"5a88f78df753993469dab4d1831f8fb4256a9468","url":"https://git.kernel.org/stable/c/5a88f78df753993469dab4d1831f8fb4256a9468"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ae3e53fe3c1241855e3a88f74877738349948c78","label":"ae3e53fe3c12","date":"2026-10-03T12:35:49+02:00","lore":["https://lore.kernel.org/all/20260717210143.4734-1-blbllhy@gmail.com/","https://lore.kernel.org/all/al4ICz9biJKtdZc4@redhat.com/","https://lore.kernel.org/all/alz5ZYLE4kaq_v2P@redhat.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5a88f78df753993469dab4d1831f8fb4256a9468","lines":92,"reason":"","source":"https://github.com/torvalds/linux/commit/5a88f78df753993469dab4d1831f8fb4256a9468.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97933","title":"tracing: Take trace_array reference when opening a tracer options file","status":"backported","project":false,"upstream":[{"sha":"ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","url":"https://git.kernel.org/stable/c/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b2890064a12efbeb3b3c093e69e9010dd244c881","label":"b2890064a12e","date":"2026-10-03T12:35:49+02:00","lore":["https://lore.kernel.org/linux-trace-kernel/20260902121918.5a9e9d1b@gandalf.local.home/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97933","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97933.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97929","title":"ALSA: usbusx2y: validate URB actual_length in interrupt callback","status":"backported","project":false,"upstream":[{"sha":"8f5ef203abda9dd36b2af473c7b737d544f807bd","url":"https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c156584999bf15118f523ef6c6fedc5b21f46bd9","label":"c156584999bf","date":"2026-09-21T15:02:25+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f5ef203abda9dd36b2af473c7b737d544f807bd","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/8f5ef203abda9dd36b2af473c7b737d544f807bd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97918","title":"tracing: Undo the registration when enabling the histogram trigger fails","status":"backported","project":false,"upstream":[{"sha":"92383cef66791a0c63a2f27755cadbdb2fbf270b","url":"https://git.kernel.org/stable/c/92383cef66791a0c63a2f27755cadbdb2fbf270b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c7ee2d5733574d4694f7c0035e4381f54c1fca27","label":"c7ee2d573357","date":"2026-10-03T12:35:49+02:00","lore":["https://lore.kernel.org/linux-trace-kernel/20260907092944.3950E1F00A3D@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"92383cef66791a0c63a2f27755cadbdb2fbf270b","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/92383cef66791a0c63a2f27755cadbdb2fbf270b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97906","title":"bootconfig: Fix integer overflow in initrd size check","status":"backported","project":false,"upstream":[{"sha":"7812d6dab0698001e50e8c2f901e17da3eb6f429","url":"https://git.kernel.org/stable/c/7812d6dab0698001e50e8c2f901e17da3eb6f429"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4d45bc0f8cdf606d5409b5f64a8a6609f6520c03","label":"4d45bc0f8cdf","date":"2026-10-03T12:35:50+02:00","lore":["https://lore.kernel.org/all/178905333479.213925.1358412668943562406.stgit@devnote2/","https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7812d6dab0698001e50e8c2f901e17da3eb6f429","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7812d6dab0698001e50e8c2f901e17da3eb6f429.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97619","title":"io_uring/rw: end write accounting from ->ki_complete","status":"backported","project":false,"upstream":[{"sha":"796aa0547557e63338657ed1c487906f9fac4c73","url":"https://git.kernel.org/stable/c/796aa0547557e63338657ed1c487906f9fac4c73"}],"evidence":[{"url":"https://git.kernel.org/stable/c/696459029f3b65c070c91b729478475582f1dcdf","label":"696459029f3b","date":"2026-10-03T12:35:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"796aa0547557e63338657ed1c487906f9fac4c73","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/796aa0547557e63338657ed1c487906f9fac4c73.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97619","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97619.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97600","title":"ieee802154: cc2520: fix FIFOP work use-after-free","status":"backported","project":false,"upstream":[{"sha":"ff5891b266a7fc6a062710836be84f1cc19338b5","url":"https://git.kernel.org/stable/c/ff5891b266a7fc6a062710836be84f1cc19338b5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/56a9919d8494fb118eebf167bef0622528fbf2e7","label":"56a9919d8494","date":"2026-09-21T15:02:29+02:00","lore":["https://lore.kernel.org/20260812061714.175966-1-fanwu01@zju.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ff5891b266a7fc6a062710836be84f1cc19338b5","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/ff5891b266a7fc6a062710836be84f1cc19338b5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97600","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97600.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97566","title":"mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0","status":"backported","project":false,"upstream":[{"sha":"2ac7d6e620764f1fc79eb4edd3610a7a661981ca","url":"https://git.kernel.org/stable/c/2ac7d6e620764f1fc79eb4edd3610a7a661981ca"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bacf23e7c9876c9f4170166b3597cb22ea3ed39b","label":"bacf23e7c987","date":"2026-10-03T12:35:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2ac7d6e620764f1fc79eb4edd3610a7a661981ca","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97566","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97566.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97565","title":"smb: client: reject short READ responses in CIFSSMBRead()","status":"unfixed","project":false,"upstream":[{"sha":"e6142a8bfc230c7263eb8b0475249c958ce49367","url":"https://git.kernel.org/stable/c/e6142a8bfc230c7263eb8b0475249c958ce49367"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e6142a8bfc230c7263eb8b0475249c958ce49367","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/e6142a8bfc230c7263eb8b0475249c958ce49367.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97565","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97565.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97563","title":"smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()","status":"unfixed","project":false,"upstream":[{"sha":"5be5bdda5863eacc964b609ba927764f253431b3","url":"https://git.kernel.org/stable/c/5be5bdda5863eacc964b609ba927764f253431b3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5be5bdda5863eacc964b609ba927764f253431b3","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/5be5bdda5863eacc964b609ba927764f253431b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97563","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97563.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97562","title":"smb: client: pin DFS superblock in iterator callback","status":"backported","project":false,"upstream":[{"sha":"d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","url":"https://git.kernel.org/stable/c/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ea43a15cea36dc5ddd832be5bddeac7dd804cbcf","label":"ea43a15cea36","date":"2026-09-21T15:02:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97562","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97562.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97538","title":"hwmon: (asus_rog_ryujin) Validate HID report lengths","status":"backported","project":false,"upstream":[{"sha":"8042312e73c50de82634ce63eae7cf219464b481","url":"https://git.kernel.org/stable/c/8042312e73c50de82634ce63eae7cf219464b481"}],"evidence":[{"url":"https://git.kernel.org/stable/c/995f22b2881835b518b3f99240d00781c9df0235","label":"995f22b28818","date":"2026-10-21T10:31:00+02:00","lore":["https://lore.kernel.org/linux-hwmon/20260812104617.858D01F000E9@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8042312e73c50de82634ce63eae7cf219464b481","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/8042312e73c50de82634ce63eae7cf219464b481.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97526","title":"s390/pai: Support CPU hotplug for PMU PAI","status":"unfixed","project":false,"upstream":[{"sha":"9ecc4d033879f7761f2df07e20cd2fbec00fd90b","url":"https://git.kernel.org/stable/c/9ecc4d033879f7761f2df07e20cd2fbec00fd90b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"9ecc4d033879f7761f2df07e20cd2fbec00fd90b","lines":292,"reason":"","source":"https://github.com/torvalds/linux/commit/9ecc4d033879f7761f2df07e20cd2fbec00fd90b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97526","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97526.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97515","title":"i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845","status":"backported","project":false,"upstream":[{"sha":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","url":"https://git.kernel.org/stable/c/1effa3adfe53cb2bb28bf5640a676b791d5ab405"}],"evidence":[{"url":"https://git.kernel.org/stable/c/335f72b1f9bbcf0f4cc5a505443b15f1af563b4f","label":"335f72b1f9bb","date":"2026-10-21T10:31:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/1effa3adfe53cb2bb28bf5640a676b791d5ab405.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97515","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97515.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97499","title":"coresight: perf: Retrieve path and source from event data","status":"unfixed","project":false,"upstream":[{"sha":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","url":"https://git.kernel.org/stable/c/f37bc31447c0ddafedb25e3c4a4f4e2284034247"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","lines":229,"reason":"","source":"https://github.com/torvalds/linux/commit/f37bc31447c0ddafedb25e3c4a4f4e2284034247.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97496","title":"drm/amdkfd: Fix OOB memory exposure in get_wave_state()","status":"backported","project":false,"upstream":[{"sha":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","url":"https://git.kernel.org/stable/c/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d9183d974ddd5f09d029beaf359275ac20d4d5fe","label":"d9183d974ddd","date":"2026-09-21T15:01:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97496","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97496.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97424","title":"drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq","status":"backported","project":false,"upstream":[{"sha":"e3829992dd9fa0a82511af4f01733fc854cd15a5","url":"https://git.kernel.org/stable/c/e3829992dd9fa0a82511af4f01733fc854cd15a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5b761927dbb170df4716d9c0ef85e178a1856e64","label":"5b761927dbb1","date":"2026-10-21T10:30:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"e3829992dd9fa0a82511af4f01733fc854cd15a5","lines":131,"reason":"","source":"https://github.com/torvalds/linux/commit/e3829992dd9fa0a82511af4f01733fc854cd15a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93799","title":"wifi: iwlwifi: mvm: validate sta_id in BA window status notif","status":"backported","project":false,"upstream":[{"sha":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","url":"https://git.kernel.org/stable/c/6aa77efaea9efea92e3090c35ad348fd759a3cf3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bb08fbbbd5568d33069485ecb0a1657f115a4e9f","label":"bb08fbbbd556","date":"2026-09-21T15:01:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/6aa77efaea9efea92e3090c35ad348fd759a3cf3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93796","title":"wifi: iwlwifi: pcie: null RX pointers after free","status":"backported","project":false,"upstream":[{"sha":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","url":"https://git.kernel.org/stable/c/2c79d7a7b583050c9f58041465cb46fe3483ab5d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6ec5bf430cf7466cb412e47f2761594092781fac","label":"6ec5bf430cf7","date":"2026-09-21T15:01:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93796","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93796.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93276","title":"phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator","status":"unfixed","project":false,"upstream":[{"sha":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","url":"https://git.kernel.org/stable/c/49c9b71b45081e5e5eeb507a2d6edb80d332dc59"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/49c9b71b45081e5e5eeb507a2d6edb80d332dc59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93276","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93276.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93270","title":"bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn","status":"unfixed","project":false,"upstream":[{"sha":"7a0855e73757ee9cf25ba635a1c735018ecba742","url":"https://git.kernel.org/stable/c/7a0855e73757ee9cf25ba635a1c735018ecba742"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7a0855e73757ee9cf25ba635a1c735018ecba742","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/7a0855e73757ee9cf25ba635a1c735018ecba742.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93270","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93270.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93244","title":"drm/sysfb: simpledrm: Improve stride validation","status":"backported","project":false,"upstream":[{"sha":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","url":"https://git.kernel.org/stable/c/df6533f11688aa30be3bb883c7637f4ffdbb7cbd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b09d27caf49ff584dbafdba3bb95487a75cb8824","label":"b09d27caf49f","date":"2026-10-03T12:35:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93244","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93244.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93238","title":"s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap","status":"backported","project":false,"upstream":[{"sha":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","url":"https://git.kernel.org/stable/c/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f73db632524320d2b93bc8534be8ea875053502d","label":"f73db6325243","date":"2026-09-14T13:31:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93238","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93238.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93237","title":"LoongArch: Add DIRECT_MAP_PHYSMEM_END definition","status":"unfixed","project":false,"upstream":[{"sha":"2677f97a67fdbc62a82ce1faa67791f54451d36f","url":"https://git.kernel.org/stable/c/2677f97a67fdbc62a82ce1faa67791f54451d36f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2677f97a67fdbc62a82ce1faa67791f54451d36f","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/2677f97a67fdbc62a82ce1faa67791f54451d36f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93235","title":"f2fs: fix to zero post-EOF data when extending file size","status":"backported","project":false,"upstream":[{"sha":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","url":"https://git.kernel.org/stable/c/5eced87b7d19dbc76ebdddaf322046f9ac582fcb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/32c7f11a24268ba8d3bb50ea7f54d33f698cd253","label":"32c7f11a2426","date":"2026-09-14T13:31:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/5eced87b7d19dbc76ebdddaf322046f9ac582fcb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93235","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93235.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93221","title":"nfsd: convert nfsd_net boolean flags to unsigned long flags word","status":"backported","project":false,"upstream":[{"sha":"11a5fe42e1811f793e04ef885b639ea7668f439d","url":"https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/faac245ca739b66e96fb7bb43e21df537239a4e5","label":"faac245ca739","date":"2026-10-21T10:30:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"11a5fe42e1811f793e04ef885b639ea7668f439d","lines":276,"reason":"","source":"https://github.com/torvalds/linux/commit/11a5fe42e1811f793e04ef885b639ea7668f439d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93221","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93221.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93216","title":"mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()","status":"backported","project":false,"upstream":[{"sha":"90f095b816e25c6a9e4446d299bac5007fdcb3df","url":"https://git.kernel.org/stable/c/90f095b816e25c6a9e4446d299bac5007fdcb3df"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a4c940ab3f794f221a338c9431ad1ce0d73a2bea","label":"a4c940ab3f79","date":"2026-10-21T10:30:57+02:00","lore":["https://lore.kernel.org/20260714015117.78351-10-ye.liu@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"90f095b816e25c6a9e4446d299bac5007fdcb3df","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/90f095b816e25c6a9e4446d299bac5007fdcb3df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93216","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93216.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93184","title":"ASoC: fsl_audmix: rework runtime PM handling in probe","status":"backported","project":false,"upstream":[{"sha":"3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71","url":"https://git.kernel.org/stable/c/3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b5c3f8015af442c2411722cf8c220cfbae271230","label":"b5c3f8015af4","date":"2026-09-14T13:31:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71","lines":59,"reason":"","source":"https://github.com/torvalds/linux/commit/3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93184","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93184.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93181","title":"perf/x86/intel/uncore: Fix uncore_box ref/unref ordering","status":"backported","project":false,"upstream":[{"sha":"174f0582e38abe03b88e15f04bfe58490f88cb19","url":"https://git.kernel.org/stable/c/174f0582e38abe03b88e15f04bfe58490f88cb19"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3cfd351602e6704cce9bc766a974afb9f745d44b","label":"3cfd351602e6","date":"2026-10-21T10:31:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"174f0582e38abe03b88e15f04bfe58490f88cb19","lines":108,"reason":"","source":"https://github.com/torvalds/linux/commit/174f0582e38abe03b88e15f04bfe58490f88cb19.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93181","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93181.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93155","title":"crypto: keembay - Fix AEAD unregister count in error path","status":"backported","project":false,"upstream":[{"sha":"e264401ce4776a288524e5b87593d4d864147115","url":"https://git.kernel.org/stable/c/e264401ce4776a288524e5b87593d4d864147115"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5607b101d86cbee8dd1ffab784495c880ca73383","label":"5607b101d86c","date":"2026-09-14T13:31:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e264401ce4776a288524e5b87593d4d864147115","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93155","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93155.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93154","title":"RDMA/irdma: Add refcounting to user ring MRs","status":"unfixed","project":false,"upstream":[{"sha":"f67d8a08f60c9217df6d40da56422d2049f5e334","url":"https://git.kernel.org/stable/c/f67d8a08f60c9217df6d40da56422d2049f5e334"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"f67d8a08f60c9217df6d40da56422d2049f5e334","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/f67d8a08f60c9217df6d40da56422d2049f5e334.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93154","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93154.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93135","title":"bpf: Reject programs with inlined helpers if JIT is not available","status":"unfixed","project":false,"upstream":[{"sha":"f1c27922576edccb99d0257827d09bd05c0304a6","url":"https://git.kernel.org/stable/c/f1c27922576edccb99d0257827d09bd05c0304a6"}],"evidence":[],"submission_lore":[],"basis":"bpf_do_misc_fixups skips helper rewriting for architectures that inline helpers but does not set jit_required, allowing interpreter fallback with unpatched helper IDs.","review":{"id":"CVE-2026-93135","series":"6.12.y","upstream":["f1c27922576edccb99d0257827d09bd05c0304a6"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"bpf_do_misc_fixups skips helper rewriting for architectures that inline helpers but does not set jit_required, allowing interpreter fallback with unpatched helper IDs.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n20922"},{"label":"Upstream fix f1c27922576e","url":"https://git.kernel.org/stable/c/f1c27922576edccb99d0257827d09bd05c0304a6"}]},"size":{"status":"within-limit","patches":[{"sha":"f1c27922576edccb99d0257827d09bd05c0304a6","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/f1c27922576edccb99d0257827d09bd05c0304a6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93135","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93135.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93123","title":"serial: qcom-geni: do not advance stale DMA completions","status":"backported","project":false,"upstream":[{"sha":"7ea38c49e7178960926657863299face6dc0e1b0","url":"https://git.kernel.org/stable/c/7ea38c49e7178960926657863299face6dc0e1b0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/231c84fe7ec40e4a06c398c0591d5b8e823d68e1","label":"231c84fe7ec4","date":"2026-09-14T13:31:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7ea38c49e7178960926657863299face6dc0e1b0","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/7ea38c49e7178960926657863299face6dc0e1b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93100","title":"fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()","status":"backported","project":false,"upstream":[{"sha":"f5bcf539484d2d604c2f2330e09487ea090b21c7","url":"https://git.kernel.org/stable/c/f5bcf539484d2d604c2f2330e09487ea090b21c7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/828ff461c136b95d13b8d712c0a7a06a640e313a","label":"828ff461c136","date":"2026-10-21T10:30:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-93100","series":"6.12.y","upstream":["f5bcf539484d2d604c2f2330e09487ea090b21c7"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"rdtgroup_kn_put decrements then reads flags outside rdtgroup_mutex","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: arch/x86/kernel/cpu/resctrl/rdtgroup.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/cpu/resctrl/rdtgroup.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n2448"},{"label":"Upstream fix f5bcf539484d","url":"https://git.kernel.org/stable/c/f5bcf539484d2d604c2f2330e09487ea090b21c7"}]},"size":{"status":"unknown","patches":[{"sha":"f5bcf539484d2d604c2f2330e09487ea090b21c7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93100","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93100.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93099","title":"fs/resctrl: Fix UAF from worker threads when domains are removed","status":"unfixed","project":false,"upstream":[{"sha":"2566b5cd6a275c124e8f154fef6e815f92ec8d5c","url":"https://git.kernel.org/stable/c/2566b5cd6a275c124e8f154fef6e815f92ec8d5c"}],"evidence":[],"submission_lore":[],"basis":"domain offline path uses non-synchronous delayed-work cancellation","review":{"id":"CVE-2026-93099","series":"6.12.y","upstream":["2566b5cd6a275c124e8f154fef6e815f92ec8d5c"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"domain offline path uses non-synchronous delayed-work cancellation","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: arch/x86/kernel/cpu/resctrl/monitor.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/cpu/resctrl/monitor.c?id=e2acc2211022246c77740d5df08265cc27eedcc5"},{"label":"Upstream fix 2566b5cd6a27","url":"https://git.kernel.org/stable/c/2566b5cd6a275c124e8f154fef6e815f92ec8d5c"}]},"size":{"status":"over-limit","patches":[{"sha":"2566b5cd6a275c124e8f154fef6e815f92ec8d5c","lines":199,"reason":"","source":"https://github.com/torvalds/linux/commit/2566b5cd6a275c124e8f154fef6e815f92ec8d5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93099","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93099.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93093","title":"firmware: arm_scmi: Publish channel state before callbacks","status":"backported","project":false,"upstream":[{"sha":"0314900dcdde044af0208fed212035dbfaa55843","url":"https://git.kernel.org/stable/c/0314900dcdde044af0208fed212035dbfaa55843"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6f3f532531e4a27d28a2240719d1b05ac11766c6","label":"6f3f532531e4","date":"2026-09-14T13:32:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0314900dcdde044af0208fed212035dbfaa55843","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93093","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93093.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93091","title":"firmware: arm_scmi: Quiesce notifications before teardown","status":"backported","project":false,"upstream":[{"sha":"8e49055d0d495c9c07575ad8e111d9eaf0efb13f","url":"https://git.kernel.org/stable/c/8e49055d0d495c9c07575ad8e111d9eaf0efb13f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6778bcabd2e0c32f73476f0bc6369013692540be","label":"6778bcabd2e0","date":"2026-09-14T13:32:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8e49055d0d495c9c07575ad8e111d9eaf0efb13f","lines":86,"reason":"","source":"https://github.com/torvalds/linux/commit/8e49055d0d495c9c07575ad8e111d9eaf0efb13f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93091","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93091.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93083","title":"firmware: arm_scmi: Unwind TX receiver mailbox setup failure","status":"backported","project":false,"upstream":[{"sha":"6f7c06744d53dc8e047725d411d7f915d9ec35ae","url":"https://git.kernel.org/stable/c/6f7c06744d53dc8e047725d411d7f915d9ec35ae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/babb017cf5e4600c94c23ea87175a0380235a3ee","label":"babb017cf5e4","date":"2026-09-14T13:32:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f7c06744d53dc8e047725d411d7f915d9ec35ae","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/6f7c06744d53dc8e047725d411d7f915d9ec35ae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93083","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93083.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93072","title":"irqchip/renesas-irqc: Fix generic interrupt chip leak on remove","status":"backported","project":false,"upstream":[{"sha":"616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba","url":"https://git.kernel.org/stable/c/616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4bf7614d048434326081eef0ebef33cb77fe2ffc","label":"4bf7614d0484","date":"2026-09-14T13:32:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93072","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93072.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93047","title":"drm/v3d: Associate BOs with every job that accesses them","status":"unfixed","project":false,"upstream":[{"sha":"fa98563ab00dbe62fcedfef6bdd34ded7a860d9f","url":"https://git.kernel.org/stable/c/fa98563ab00dbe62fcedfef6bdd34ded7a860d9f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"fa98563ab00dbe62fcedfef6bdd34ded7a860d9f","lines":175,"reason":"","source":"https://github.com/torvalds/linux/commit/fa98563ab00dbe62fcedfef6bdd34ded7a860d9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93047","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93047.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93044","title":"bpf: Disallow interpreter fallback for arena-related insns","status":"unfixed","project":false,"upstream":[{"sha":"34746b5a84ec37c0ea2bf6808c65c5ed8790eb51","url":"https://git.kernel.org/stable/c/34746b5a84ec37c0ea2bf6808c65c5ed8790eb51"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"34746b5a84ec37c0ea2bf6808c65c5ed8790eb51","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/34746b5a84ec37c0ea2bf6808c65c5ed8790eb51.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92518","title":"riscv, bpf: Fix kernel stack corruption in tailcall with CFI","status":"unfixed","project":false,"upstream":[{"sha":"52fb1756ea1d2759dfef2d86245be00b05dac3a2","url":"https://git.kernel.org/stable/c/52fb1756ea1d2759dfef2d86245be00b05dac3a2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"52fb1756ea1d2759dfef2d86245be00b05dac3a2","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/52fb1756ea1d2759dfef2d86245be00b05dac3a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92518","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92518.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92500","title":"ext4: use fsdata to track inline data write state and fix race","status":"unfixed","project":false,"upstream":[{"sha":"7edbb323bab2b2a609016014caafdb651c898249","url":"https://git.kernel.org/stable/c/7edbb323bab2b2a609016014caafdb651c898249"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7edbb323bab2b2a609016014caafdb651c898249","lines":95,"reason":"","source":"https://github.com/torvalds/linux/commit/7edbb323bab2b2a609016014caafdb651c898249.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92500","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92500.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92499","title":"ext4: validate readdir offset before accessing dirent","status":"unfixed","project":false,"upstream":[{"sha":"bc4b7b0414c33b2c8898eb04386df0d21a13dad8","url":"https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"bc4b7b0414c33b2c8898eb04386df0d21a13dad8","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/bc4b7b0414c33b2c8898eb04386df0d21a13dad8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92493","title":"cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active","status":"unfixed","project":false,"upstream":[{"sha":"8d31bb1451643f328db0cea0e21e63ef54b4faf2","url":"https://git.kernel.org/stable/c/8d31bb1451643f328db0cea0e21e63ef54b4faf2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8d31bb1451643f328db0cea0e21e63ef54b4faf2","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/8d31bb1451643f328db0cea0e21e63ef54b4faf2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90401","title":"md: remove REQ_NOWAIT support from raid1/10/456","status":"unfixed","project":false,"upstream":[{"sha":"3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","url":"https://git.kernel.org/stable/c/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","lines":588,"reason":"","source":"https://github.com/torvalds/linux/commit/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90401","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90401.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90397","title":"firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published","status":"backported","project":false,"upstream":[{"sha":"966d23c7e68ea32679275a7e3d2383181002c868","url":"https://git.kernel.org/stable/c/966d23c7e68ea32679275a7e3d2383181002c868"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b451f38cb7f5bca78484362347f039c08c94de95","label":"b451f38cb7f5","date":"2026-09-14T13:32:23+02:00","lore":["https://lore.kernel.org/r/20260724094939.613844-2-mukesh.ojha@oss.qualcomm.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"966d23c7e68ea32679275a7e3d2383181002c868","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/966d23c7e68ea32679275a7e3d2383181002c868.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90397","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90397.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90389","title":"md: scope memalloc_noio to allocation critical sections","status":"backported","project":false,"upstream":[{"sha":"bace2010dd7ac07bc980575afb135c406730a7fe","url":"https://git.kernel.org/stable/c/bace2010dd7ac07bc980575afb135c406730a7fe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/72ebfdf507ede7d7f2b7ca0a5634811a0e4bf045","label":"72ebfdf507ed","date":"2026-09-14T13:32:25+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"bace2010dd7ac07bc980575afb135c406730a7fe","lines":306,"reason":"","source":"https://github.com/torvalds/linux/commit/bace2010dd7ac07bc980575afb135c406730a7fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90389","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90389.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90379","title":"wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash","status":"unfixed","project":false,"upstream":[{"sha":"915672c5ae32deeb72f4572856d123f314791136","url":"https://git.kernel.org/stable/c/915672c5ae32deeb72f4572856d123f314791136"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"915672c5ae32deeb72f4572856d123f314791136","lines":227,"reason":"","source":"https://github.com/torvalds/linux/commit/915672c5ae32deeb72f4572856d123f314791136.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90379","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90379.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90375","title":"wifi: mt76: fix non-AQL packet accounting for MLO stations","status":"backported","project":false,"upstream":[{"sha":"8ae659743ba936b22ecb4620815887728e2820d6","url":"https://git.kernel.org/stable/c/8ae659743ba936b22ecb4620815887728e2820d6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f85f6933cc170155f1c7c2dffdd014965787c71b","label":"f85f6933cc17","date":"2026-09-14T13:32:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8ae659743ba936b22ecb4620815887728e2820d6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90375","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90375.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90373","title":"wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear","status":"backported","project":false,"upstream":[{"sha":"6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba","url":"https://git.kernel.org/stable/c/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5dce25f1d609ba991a9c22c27be586c92f03ed77","label":"5dce25f1d609","date":"2026-09-14T13:32:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90373","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90373.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90359","title":"bpf: Reject >8 byte return values on return-reading trampoline paths","status":"backported","project":false,"upstream":[{"sha":"c48796aa6c392cde93946e5d5a9a1f1b1cf72feb","url":"https://git.kernel.org/stable/c/c48796aa6c392cde93946e5d5a9a1f1b1cf72feb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/de54ba33690d2dd3c4aa686c9693505644285b0b","label":"de54ba33690d","date":"2026-10-21T10:30:54+02:00","lore":["https://lore.kernel.org/bpf/20260729050159.2585809-1-yonghong.song@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c48796aa6c392cde93946e5d5a9a1f1b1cf72feb","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/c48796aa6c392cde93946e5d5a9a1f1b1cf72feb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90359","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90359.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90333","title":"dm-integrity: replace forgeable discard filler with a keyed sector marker","status":"backported","project":false,"upstream":[{"sha":"68c5c42567bc462139128968ebbfadd0aefff519","url":"https://git.kernel.org/stable/c/68c5c42567bc462139128968ebbfadd0aefff519"}],"evidence":[{"url":"https://git.kernel.org/stable/c/388c3f6496bb8083576d989e6d249ba9807c6b0b","label":"388c3f6496bb","date":"2026-10-21T10:31:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"68c5c42567bc462139128968ebbfadd0aefff519","lines":357,"reason":"","source":"https://github.com/torvalds/linux/commit/68c5c42567bc462139128968ebbfadd0aefff519.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90321","title":"ocfs2: validate inline xattrs during inode block validation","status":"backported","project":false,"upstream":[{"sha":"8914a3330b72378136c2c02d6328a826f6abdad7","url":"https://git.kernel.org/stable/c/8914a3330b72378136c2c02d6328a826f6abdad7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8138d06e7a1d9a0b0481dc015c67b34e8bb60a58","label":"8138d06e7a1d","date":"2026-10-21T10:30:53+02:00","lore":["https://lore.kernel.org/20260705025311.3429854-1-zzzccc427@gmail.com","https://lore.kernel.org/20260705025311.3429854-2-zzzccc427@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8914a3330b72378136c2c02d6328a826f6abdad7","lines":164,"reason":"","source":"https://github.com/torvalds/linux/commit/8914a3330b72378136c2c02d6328a826f6abdad7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90321","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90321.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90320","title":"ocfs2: validate external xattr entries when reading metadata","status":"backported","project":false,"upstream":[{"sha":"2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6","url":"https://git.kernel.org/stable/c/2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ee4ef26927e967ea699b3f0d7ecf97ce044fbc79","label":"ee4ef26927e9","date":"2026-10-21T10:31:04+02:00","lore":["https://lore.kernel.org/20260705025311.3429854-3-zzzccc427@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6","lines":121,"reason":"","source":"https://github.com/torvalds/linux/commit/2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90320","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90320.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90317","title":"bpf: Invalidate RCU pointers after final spin unlock","status":"unfixed","project":false,"upstream":[{"sha":"180c7000712db77063b3a26f4c97e7dd9038f449","url":"https://git.kernel.org/stable/c/180c7000712db77063b3a26f4c97e7dd9038f449"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"180c7000712db77063b3a26f4c97e7dd9038f449","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/180c7000712db77063b3a26f4c97e7dd9038f449.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90315","title":"PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers","status":"unfixed","project":false,"upstream":[{"sha":"747b9bbbbdfdee51aee2456388f9b94b5086de4d","url":"https://git.kernel.org/stable/c/747b9bbbbdfdee51aee2456388f9b94b5086de4d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"747b9bbbbdfdee51aee2456388f9b94b5086de4d","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/747b9bbbbdfdee51aee2456388f9b94b5086de4d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90306","title":"ARM: 9481/2: breakpoint: CFI breakpoints only on demand","status":"unfixed","project":false,"upstream":[{"sha":"8ed9bff906cf8036531d1559f10e82733a52b41f","url":"https://git.kernel.org/stable/c/8ed9bff906cf8036531d1559f10e82733a52b41f"}],"evidence":[],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ed9bff906cf8036531d1559f10e82733a52b41f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8ed9bff906cf8036531d1559f10e82733a52b41f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90306","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90306.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90265","title":"btrfs: defrag: fix deadlock between defrag and delalloc space reservation","status":"backported","project":false,"upstream":[{"sha":"ba02eab28041f9a4bbe9fc90c7249644fef6de0f","url":"https://git.kernel.org/stable/c/ba02eab28041f9a4bbe9fc90c7249644fef6de0f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/37614074596827a5f292243673b699c90ff63e7d","label":"376140745968","date":"2026-10-21T10:30:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ba02eab28041f9a4bbe9fc90c7249644fef6de0f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90265","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90265.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90261","title":"btrfs: zoned: flush active metadata block group at btree_writepages() start","status":"unfixed","project":false,"upstream":[{"sha":"ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b","url":"https://git.kernel.org/stable/c/ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b","lines":132,"reason":"","source":"https://github.com/torvalds/linux/commit/ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90261","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90261.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90256","title":"Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind","status":"backported","project":false,"upstream":[{"sha":"2b66c83ff1751d6bd3201b3017206262ab46dc05","url":"https://git.kernel.org/stable/c/2b66c83ff1751d6bd3201b3017206262ab46dc05"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7c032b6d48a46634cbd58aaebad2638c00ad3b51","label":"7c032b6d48a4","date":"2026-10-21T10:30:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b66c83ff1751d6bd3201b3017206262ab46dc05","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/2b66c83ff1751d6bd3201b3017206262ab46dc05.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90256","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90256.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90237","title":"netfilter: nft_ct: move custom expectation support to helper","status":"unfixed","project":false,"upstream":[{"sha":"3679da4ad8be84cddaf40bc307fef1fe13e051ff","url":"https://git.kernel.org/stable/c/3679da4ad8be84cddaf40bc307fef1fe13e051ff"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3679da4ad8be84cddaf40bc307fef1fe13e051ff","lines":260,"reason":"","source":"https://github.com/torvalds/linux/commit/3679da4ad8be84cddaf40bc307fef1fe13e051ff.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90230","title":"nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()","status":"backported","project":false,"upstream":[{"sha":"5bb96cc218835769ab74ec7f3ea2bf81fbffe955","url":"https://git.kernel.org/stable/c/5bb96cc218835769ab74ec7f3ea2bf81fbffe955"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aaac783950b17c57df9b6f7344747cacb1a407ed","label":"aaac783950b1","date":"2026-09-14T13:32:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5bb96cc218835769ab74ec7f3ea2bf81fbffe955","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/5bb96cc218835769ab74ec7f3ea2bf81fbffe955.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90230","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90230.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90227","title":"nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()","status":"backported","project":false,"upstream":[{"sha":"b53d495c7f0db46b6748b5ade48371a10dd5d3bc","url":"https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/95b0591d51dbf9e618d7845883d535e88ad7c8af","label":"95b0591d51db","date":"2026-09-14T13:32:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b53d495c7f0db46b6748b5ade48371a10dd5d3bc","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/b53d495c7f0db46b6748b5ade48371a10dd5d3bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90227","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90227.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90220","title":"ALSA: seq: Don't leak the extension cell pointer in the bounce payload","status":"backported","project":false,"upstream":[{"sha":"59e1592d3c270ff4642d5d6dc55c545306eb0693","url":"https://git.kernel.org/stable/c/59e1592d3c270ff4642d5d6dc55c545306eb0693"}],"evidence":[{"url":"https://git.kernel.org/stable/c/42c3f856d13a91a0d4c302a0c6854813621136db","label":"42c3f856d13a","date":"2026-09-14T13:32:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"59e1592d3c270ff4642d5d6dc55c545306eb0693","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/59e1592d3c270ff4642d5d6dc55c545306eb0693.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90220","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90220.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90217","title":"bpf: Compare iterator types during state pruning","status":"backported","project":false,"upstream":[{"sha":"83608e303b95d07afba1c15da0b5d9e513c2f15a","url":"https://git.kernel.org/stable/c/83608e303b95d07afba1c15da0b5d9e513c2f15a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/86bbaf9e6e4fa6c0dfb352e9e11fae328069233a","label":"86bbaf9e6e4f","date":"2026-10-21T10:30:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-90217","series":"6.12.y","upstream":["83608e303b95d07afba1c15da0b5d9e513c2f15a"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"BPF iterator state pruning compares BTF/ID/state but omits pointer type, allowing distinct iterator pointer types to be treated equivalent.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n17851"},{"label":"Upstream fix 83608e303b95","url":"https://git.kernel.org/stable/c/83608e303b95d07afba1c15da0b5d9e513c2f15a"}]},"size":{"status":"within-limit","patches":[{"sha":"83608e303b95d07afba1c15da0b5d9e513c2f15a","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/83608e303b95d07afba1c15da0b5d9e513c2f15a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90211","title":"bpf, s390: Clear fetch destination on faulting arena atomic","status":"unfixed","project":false,"upstream":[{"sha":"cc3e12330599f097f0e1f792435686ddc276f26d","url":"https://git.kernel.org/stable/c/cc3e12330599f097f0e1f792435686ddc276f26d"}],"evidence":[],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"within-limit","patches":[{"sha":"cc3e12330599f097f0e1f792435686ddc276f26d","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/cc3e12330599f097f0e1f792435686ddc276f26d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90199","title":"fs/ntfs3: reject out-of-range evcn in mi_enum_attr()","status":"backported","project":false,"upstream":[{"sha":"20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3","url":"https://git.kernel.org/stable/c/20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7ab69cef49ebdfee288287d62641b24ab1445ecc","label":"7ab69cef49eb","date":"2026-09-14T13:32:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90199","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90199.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90154","title":"ksmbd: scope session state changes to bound connections","status":"backported","project":false,"upstream":[{"sha":"c50e628122aed077695669e25b842e778511a43d","url":"https://git.kernel.org/stable/c/c50e628122aed077695669e25b842e778511a43d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3d66f3ec3c69fa242939a9f9e6815df33390b1bb","label":"3d66f3ec3c69","date":"2026-10-21T10:30:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c50e628122aed077695669e25b842e778511a43d","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/c50e628122aed077695669e25b842e778511a43d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90154","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90154.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90129","title":"virtio_balloon: quiesce balloon work before device shutdown","status":"unfixed","project":false,"upstream":[{"sha":"7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","url":"https://git.kernel.org/stable/c/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90119","title":"ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup","status":"backported","project":false,"upstream":[{"sha":"d736eba9c453fedce664fdf592c8b71ecff1932b","url":"https://git.kernel.org/stable/c/d736eba9c453fedce664fdf592c8b71ecff1932b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d8ac49391a1562dc784fc91e810e696284cb647e","label":"d8ac49391a15","date":"2026-09-14T13:32:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d736eba9c453fedce664fdf592c8b71ecff1932b","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/d736eba9c453fedce664fdf592c8b71ecff1932b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90119","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90119.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90098","title":"net: sparx5: fix sleep in atomic context in MAC table access","status":"unfixed","project":false,"upstream":[{"sha":"b62793a7baeea9cf20209c9fd2e333311aaf3b8d","url":"https://git.kernel.org/stable/c/b62793a7baeea9cf20209c9fd2e333311aaf3b8d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b62793a7baeea9cf20209c9fd2e333311aaf3b8d","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/b62793a7baeea9cf20209c9fd2e333311aaf3b8d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90098","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90098.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90060","title":"ALSA: control: Don't add invalid kcontrols to LED layer","status":"backported","project":false,"upstream":[{"sha":"74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11","url":"https://git.kernel.org/stable/c/74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3d20cd049fc5f51f80e24a2db7a3cf00593c79e4","label":"3d20cd049fc5","date":"2026-09-14T13:32:57+02:00","lore":["https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90060","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90060.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90040","title":"KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped","status":"unfixed","project":false,"upstream":[{"sha":"d1a3c216233413f57f5341a9b878b7e2dde7e785","url":"https://git.kernel.org/stable/c/d1a3c216233413f57f5341a9b878b7e2dde7e785"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d1a3c216233413f57f5341a9b878b7e2dde7e785","lines":242,"reason":"","source":"https://github.com/torvalds/linux/commit/d1a3c216233413f57f5341a9b878b7e2dde7e785.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90040","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90040.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90036","title":"NFSD: Prevent client use-after-free during blocked-lock reaping","status":"backported","project":false,"upstream":[{"sha":"9026932ac8be4d0ae01db47f23619a98cc57b671","url":"https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7081224a59a0ca4edcd62c068588f4d900199a18","label":"7081224a59a0","date":"2026-09-21T15:02:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9026932ac8be4d0ae01db47f23619a98cc57b671","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/9026932ac8be4d0ae01db47f23619a98cc57b671.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90036","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90036.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90027","title":"usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop","status":"backported","project":false,"upstream":[{"sha":"263f7d61a4201cde16849b2d016251806e7418be","url":"https://git.kernel.org/stable/c/263f7d61a4201cde16849b2d016251806e7418be"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4359b5f95c93a4658e08368fa6fab9d89eb98447","label":"4359b5f95c93","date":"2026-09-14T13:30:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"263f7d61a4201cde16849b2d016251806e7418be","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/263f7d61a4201cde16849b2d016251806e7418be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90027","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90027.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89944","title":"ASoC: hdac_hda: Fix hlink refcount leak on component registration failure","status":"backported","project":false,"upstream":[{"sha":"6ad4892c4f5cb437a928a02f5b7d37d496aa9268","url":"https://git.kernel.org/stable/c/6ad4892c4f5cb437a928a02f5b7d37d496aa9268"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7eef9ae3b4ef782557526dd8ba0c206f028d8c2f","label":"7eef9ae3b4ef","date":"2026-09-14T13:31:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6ad4892c4f5cb437a928a02f5b7d37d496aa9268","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89938","title":"iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF","status":"backported","project":false,"upstream":[{"sha":"be61c8c6252671ecf1fee0ad90f87669e0be1e20","url":"https://git.kernel.org/stable/c/be61c8c6252671ecf1fee0ad90f87669e0be1e20"}],"evidence":[{"url":"https://git.kernel.org/stable/c/91e12b0fbd7047d02bf4ef4dbc491b9ef0159250","label":"91e12b0fbd70","date":"2026-09-14T13:31:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"be61c8c6252671ecf1fee0ad90f87669e0be1e20","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/be61c8c6252671ecf1fee0ad90f87669e0be1e20.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89935","title":"iio: light: apds9306: fix PM reference leak in apds9306_read_data()","status":"unfixed","project":false,"upstream":[{"sha":"d378fceaafd79e0dc59d3546bda251a3058062c0","url":"https://git.kernel.org/stable/c/d378fceaafd79e0dc59d3546bda251a3058062c0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d378fceaafd79e0dc59d3546bda251a3058062c0","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/d378fceaafd79e0dc59d3546bda251a3058062c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89935","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89935.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89929","title":"KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU","status":"backported","project":false,"upstream":[{"sha":"6d00e67326d831e6e610933a3800712f4ffe6ec1","url":"https://git.kernel.org/stable/c/6d00e67326d831e6e610933a3800712f4ffe6ec1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d03e721801ac54b9fdf05668aa0c069f07913b68","label":"d03e721801ac","date":"2026-09-14T13:31:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6d00e67326d831e6e610933a3800712f4ffe6ec1","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/6d00e67326d831e6e610933a3800712f4ffe6ec1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89913","title":"KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables","status":"backported","project":false,"upstream":[{"sha":"f5b8f203bfc07a5a257dff859e66d2c500f9f509","url":"https://git.kernel.org/stable/c/f5b8f203bfc07a5a257dff859e66d2c500f9f509"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4000462866bc71f16d1bfb3cf8e969f95150cd64","label":"4000462866bc","date":"2026-10-21T10:30:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f5b8f203bfc07a5a257dff859e66d2c500f9f509","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/f5b8f203bfc07a5a257dff859e66d2c500f9f509.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89913","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89913.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89906","title":"LoongArch: BPF: Refactor jump offset calculation in tail call","status":"backported","project":false,"upstream":[{"sha":"37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","url":"https://git.kernel.org/stable/c/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/89819868cde78cb2f748533785a46a3430873f20","label":"89819868cde7","date":"2026-10-21T10:30:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89899","title":"media: cec: disable delayed work before freeing an interrupted transmit","status":"backported","project":false,"upstream":[{"sha":"0fbd5c2327020858c45b2d1c65775d64cdeca523","url":"https://git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9a951931d4b4084acd64fa55fc3672a9da45ddf9","label":"9a951931d4b4","date":"2026-09-14T13:31:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fbd5c2327020858c45b2d1c65775d64cdeca523","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0fbd5c2327020858c45b2d1c65775d64cdeca523.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89866","title":"media: chips-media: wave5: Resume device before setting EOS flag","status":"unfixed","project":false,"upstream":[{"sha":"a52e6f7923c17a672135b485ffd96fbd72f46267","url":"https://git.kernel.org/stable/c/a52e6f7923c17a672135b485ffd96fbd72f46267"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a52e6f7923c17a672135b485ffd96fbd72f46267","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/a52e6f7923c17a672135b485ffd96fbd72f46267.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89866","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89866.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89862","title":"scsi: qla2xxx: Fix BSG job leak on validate flash image error path","status":"unfixed","project":false,"upstream":[{"sha":"0fb52cc632464b0cd07f970341330466d772efe1","url":"https://git.kernel.org/stable/c/0fb52cc632464b0cd07f970341330466d772efe1"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fb52cc632464b0cd07f970341330466d772efe1","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/0fb52cc632464b0cd07f970341330466d772efe1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89826","title":"drm/panthor: harden firmware build-info bounds checks","status":"unfixed","project":false,"upstream":[{"sha":"8321b093fa6c297b80586460ce6914d9655df170","url":"https://git.kernel.org/stable/c/8321b093fa6c297b80586460ce6914d9655df170"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8321b093fa6c297b80586460ce6914d9655df170","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/8321b093fa6c297b80586460ce6914d9655df170.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89806","title":"drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation","status":"backported","project":false,"upstream":[{"sha":"c6f48e59ece0123f6a11527ad4d89b21c2d65b87","url":"https://git.kernel.org/stable/c/c6f48e59ece0123f6a11527ad4d89b21c2d65b87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/711fe7949d37656a5586244afee9523b9e5e37e9","label":"711fe7949d37","date":"2026-10-03T12:35:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6f48e59ece0123f6a11527ad4d89b21c2d65b87","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/c6f48e59ece0123f6a11527ad4d89b21c2d65b87.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89805","title":"drm/pagemap: Fix folio allocation fallback and use-after-put","status":"not-applicable","project":false,"upstream":[{"sha":"df72e55e754c8d449321ddddad19a8bd3cb8d032","url":"https://git.kernel.org/stable/c/df72e55e754c8d449321ddddad19a8bd3cb8d032"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"df72e55e754c8d449321ddddad19a8bd3cb8d032","lines":181,"reason":"","source":"https://github.com/torvalds/linux/commit/df72e55e754c8d449321ddddad19a8bd3cb8d032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89805","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89805.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89797","title":"power: supply: ab8500_fg: fix use-after-free on remove","status":"backported","project":false,"upstream":[{"sha":"75b1e88d34254f4fb7753345e21bfee47abddd7f","url":"https://git.kernel.org/stable/c/75b1e88d34254f4fb7753345e21bfee47abddd7f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c2ce9b8f325f522e10e4d262b37ae49deb83e79b","label":"c2ce9b8f325f","date":"2026-10-03T12:35:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75b1e88d34254f4fb7753345e21bfee47abddd7f","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/75b1e88d34254f4fb7753345e21bfee47abddd7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89793","title":"ublk: clear VM_MAYWRITE on read-only ublk char device mmap","status":"backported","project":false,"upstream":[{"sha":"6e2b571b0a54755b06e092501913e1dfefe75d6c","url":"https://git.kernel.org/stable/c/6e2b571b0a54755b06e092501913e1dfefe75d6c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5befd06a72216869b607cf7724a4f16c6a2d3999","label":"5befd06a7221","date":"2026-09-14T13:31:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6e2b571b0a54755b06e092501913e1dfefe75d6c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/6e2b571b0a54755b06e092501913e1dfefe75d6c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89793","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89793.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89788","title":"ksmbd: fix tree connection use-after-free in smb2_tree_connect()","status":"backported","project":false,"upstream":[{"sha":"b5ec6c462aab1062cf5d1e667ba7c6442f737055","url":"https://git.kernel.org/stable/c/b5ec6c462aab1062cf5d1e667ba7c6442f737055"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bd58a52738f7576ee5f5eb74243df13f902c8051","label":"bd58a52738f7","date":"2026-10-21T10:30:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5ec6c462aab1062cf5d1e667ba7c6442f737055","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/b5ec6c462aab1062cf5d1e667ba7c6442f737055.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89788","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89788.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89772","title":"btrfs: write-protect folios during data writeback","status":"not-applicable","project":false,"upstream":[{"sha":"5376c9db45368eb210b4d71104ac00a59dc8b6e0","url":"https://git.kernel.org/stable/c/5376c9db45368eb210b4d71104ac00a59dc8b6e0"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"5376c9db45368eb210b4d71104ac00a59dc8b6e0","lines":125,"reason":"","source":"https://github.com/torvalds/linux/commit/5376c9db45368eb210b4d71104ac00a59dc8b6e0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89772","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89772.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89768","title":"fs: fix user path of nested backing files","status":"backported","project":false,"upstream":[{"sha":"f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d","url":"https://git.kernel.org/stable/c/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/88c927a63dc717b6d46b20fe13ea713916e49089","label":"88c927a63dc7","date":"2026-09-07T17:17:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89762","title":"apparmor: fix cred UAF caused by begin_current_label_crit_section()","status":"backported","project":false,"upstream":[{"sha":"3f4ae5fab613dca01d6a2a8210dd832e009fcf47","url":"https://git.kernel.org/stable/c/3f4ae5fab613dca01d6a2a8210dd832e009fcf47"}],"evidence":[{"url":"https://git.kernel.org/stable/c/361488984d668235438faac28635f3632351407f","label":"361488984d66","date":"2026-09-07T17:17:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3f4ae5fab613dca01d6a2a8210dd832e009fcf47","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89755","title":"mm/migrate_device: clear stale mapping after freeing swapcache","status":"backported","project":false,"upstream":[{"sha":"34a00895d032a414830d41106a09329ae6c251b6","url":"https://git.kernel.org/stable/c/34a00895d032a414830d41106a09329ae6c251b6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4fa91f7bbc4135240b67daac03fc17d9e180a331","label":"4fa91f7bbc41","date":"2026-09-21T15:02:41+02:00","lore":["https://lore.kernel.org/20260728062832.1107127-1-arvind.yadav@intel.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"34a00895d032a414830d41106a09329ae6c251b6","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/34a00895d032a414830d41106a09329ae6c251b6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89755","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89755.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89739","title":"usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition","status":"backported","project":false,"upstream":[{"sha":"9c855832790cd488d87de1885974f4c37cfe7358","url":"https://git.kernel.org/stable/c/9c855832790cd488d87de1885974f4c37cfe7358"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5f359265f616873edf32db418bd1513fdae3ddec","label":"5f359265f616","date":"2026-10-03T12:35:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9c855832790cd488d87de1885974f4c37cfe7358","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/9c855832790cd488d87de1885974f4c37cfe7358.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89739","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89739.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89722","title":"PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()","status":"unfixed","project":false,"upstream":[{"sha":"dc76258d0132df1d831a5a29758bd448ca9c566e","url":"https://git.kernel.org/stable/c/dc76258d0132df1d831a5a29758bd448ca9c566e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"dc76258d0132df1d831a5a29758bd448ca9c566e","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/dc76258d0132df1d831a5a29758bd448ca9c566e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89722","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89722.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89708","title":"nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown","status":"backported","project":false,"upstream":[{"sha":"01c5d5f58a5db9b0ee5afba2e49d3157788687b2","url":"https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2775ec1d617e665eab71ce0f13ab1f7959713a2b","label":"2775ec1d617e","date":"2026-09-21T15:02:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"01c5d5f58a5db9b0ee5afba2e49d3157788687b2","lines":324,"reason":"","source":"https://github.com/torvalds/linux/commit/01c5d5f58a5db9b0ee5afba2e49d3157788687b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89708","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89708.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89675","title":"nfsd: fix UAF in async copy cancel and shutdown","status":"unfixed","project":false,"upstream":[{"sha":"62c0f6eaf050bb9284c1f9cac6ed1770092e6b95","url":"https://git.kernel.org/stable/c/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"62c0f6eaf050bb9284c1f9cac6ed1770092e6b95","lines":230,"reason":"","source":"https://github.com/torvalds/linux/commit/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89675","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89675.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89644","title":"btrfs: fix extent map leak in NOCOW direct I/O write","status":"backported","project":false,"upstream":[{"sha":"3f950867c307c5413d628a153ac44915bd117ffd","url":"https://git.kernel.org/stable/c/3f950867c307c5413d628a153ac44915bd117ffd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b7c873765875645b11503f94c9bae2ca80127375","label":"b7c873765875","date":"2026-09-21T15:02:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3f950867c307c5413d628a153ac44915bd117ffd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89644","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89644.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89639","title":"cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC","status":"unfixed","project":false,"upstream":[{"sha":"364b183230586a62660a7280c1eb20138338eeb5","url":"https://git.kernel.org/stable/c/364b183230586a62660a7280c1eb20138338eeb5"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"364b183230586a62660a7280c1eb20138338eeb5","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/364b183230586a62660a7280c1eb20138338eeb5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89639","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89639.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89637","title":"smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2","status":"unfixed","project":false,"upstream":[{"sha":"730d0bb19507b9e19c2fe5343109ac618e2fbce5","url":"https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5"}],"evidence":[],"submission_lore":[],"basis":"cifs_check_trans2 returns false for malformed/rejected secondary replies even when multiRsp is set, allowing handle_mid to overwrite response state and leave dangling server buffer pointers.","review":{"id":"CVE-2026-89637","series":"6.12.y","upstream":["730d0bb19507b9e19c2fe5343109ac618e2fbce5"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"cifs_check_trans2 returns false for malformed/rejected secondary replies even when multiRsp is set, allowing handle_mid to overwrite response state and leave dangling server buffer pointers.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/smb/client/smb1ops.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/smb/client/smb1ops.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n386"},{"label":"Upstream fix 730d0bb19507","url":"https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5"}]},"size":{"status":"within-limit","patches":[{"sha":"730d0bb19507b9e19c2fe5343109ac618e2fbce5","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/730d0bb19507b9e19c2fe5343109ac618e2fbce5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89637","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89637.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89633","title":"smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()","status":"backported","project":false,"upstream":[{"sha":"6343c1da561962688f203362d80d6a3bfa39fa1b","url":"https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/36d01415d881d5326a0dd3384f781cd7e69aff2d","label":"36d01415d881","date":"2026-10-15T11:56:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-89633","series":"6.12.y","upstream":["6343c1da561962688f203362d80d6a3bfa39fa1b"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"The SMB1 coalesce_t2 handler trusts server-provided DataOffset for source and target pointers and memcpy without validating either range against its buffer.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/smb/client/smb1ops.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/smb/client/smb1ops.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n287"},{"label":"Upstream fix 6343c1da5619","url":"https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b"}]},"size":{"status":"unknown","patches":[{"sha":"6343c1da561962688f203362d80d6a3bfa39fa1b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89633","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89633.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89632","title":"smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()","status":"unfixed","project":false,"upstream":[{"sha":"05f78e6cf34ea3a285053bd5999e08e8ac298bd5","url":"https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"05f78e6cf34ea3a285053bd5999e08e8ac298bd5","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/05f78e6cf34ea3a285053bd5999e08e8ac298bd5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89632","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89632.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89630","title":"smb: client: restore the data_offset bound in is_valid_oplock_break()","status":"not-applicable","project":false,"upstream":[{"sha":"ba22f575de9deeae4ae0859ca4315a7698226237","url":"https://git.kernel.org/stable/c/ba22f575de9deeae4ae0859ca4315a7698226237"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ba22f575de9deeae4ae0859ca4315a7698226237","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/ba22f575de9deeae4ae0859ca4315a7698226237.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89630","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89630.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89611","title":"ntfs: validate non-resident attribute offsets","status":"not-applicable","project":false,"upstream":[{"sha":"a83e82b0ec3ae523028e24813f23f18b43e8fc1c","url":"https://git.kernel.org/stable/c/a83e82b0ec3ae523028e24813f23f18b43e8fc1c"}],"evidence":[],"submission_lore":[],"basis":"NTFS3 validator is independent; legacy fs/ntfs/attrib.c conversion path absent","review":{"id":"CVE-2026-89611","series":"6.12.y","upstream":["a83e82b0ec3ae523028e24813f23f18b43e8fc1c"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"not-applicable","applicability":"unaffected","reason":"NTFS3 validator is independent; legacy fs/ntfs/attrib.c conversion path absent","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/ntfs3/attrib.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ntfs3/attrib.c?id=e2acc2211022246c77740d5df08265cc27eedcc5"},{"label":"Upstream fix a83e82b0ec3a","url":"https://git.kernel.org/stable/c/a83e82b0ec3ae523028e24813f23f18b43e8fc1c"}]},"size":{"status":"within-limit","patches":[{"sha":"a83e82b0ec3ae523028e24813f23f18b43e8fc1c","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/a83e82b0ec3ae523028e24813f23f18b43e8fc1c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89611","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89611.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89610","title":"ntfs: verify run length exceeding volume boundary","status":"not-applicable","project":false,"upstream":[{"sha":"fea9e4488f384c0ef1c0e3d96b565127c1b98447","url":"https://git.kernel.org/stable/c/fea9e4488f384c0ef1c0e3d96b565127c1b98447"}],"evidence":[],"submission_lore":[],"basis":"target uses separate NTFS3 implementation; legacy fs/ntfs/runlist.c decoder absent","review":{"id":"CVE-2026-89610","series":"6.12.y","upstream":["fea9e4488f384c0ef1c0e3d96b565127c1b98447"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"not-applicable","applicability":"unaffected","reason":"target uses separate NTFS3 implementation; legacy fs/ntfs/runlist.c decoder absent","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/ntfs3/attrib.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ntfs3/attrib.c?id=e2acc2211022246c77740d5df08265cc27eedcc5"},{"label":"Upstream fix fea9e4488f38","url":"https://git.kernel.org/stable/c/fea9e4488f384c0ef1c0e3d96b565127c1b98447"}]},"size":{"status":"within-limit","patches":[{"sha":"fea9e4488f384c0ef1c0e3d96b565127c1b98447","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/fea9e4488f384c0ef1c0e3d96b565127c1b98447.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89610","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89610.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89584","title":"block: validate user space vectors during extraction","status":"not-applicable","project":false,"upstream":[{"sha":"14b007e178811db72fbb1ebb3535160db6ec1e6a","url":"https://git.kernel.org/stable/c/14b007e178811db72fbb1ebb3535160db6ec1e6a"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"14b007e178811db72fbb1ebb3535160db6ec1e6a","lines":168,"reason":"","source":"https://github.com/torvalds/linux/commit/14b007e178811db72fbb1ebb3535160db6ec1e6a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89584","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89584.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89568","title":"kho: fix size calculation in kho_preserved_memory_reserve()","status":"not-applicable","project":false,"upstream":[{"sha":"3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded","url":"https://git.kernel.org/stable/c/3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89568","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89568.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89567","title":"jbd2: bound shrinker scans by examined checkpoint buffers","status":"backported","project":false,"upstream":[{"sha":"15cb16496446b94e67f7abcb049b8e2c75cd3d02","url":"https://git.kernel.org/stable/c/15cb16496446b94e67f7abcb049b8e2c75cd3d02"}],"evidence":[{"url":"https://git.kernel.org/stable/c/edf5fcd0469b7467bd5b37a79502c8d9c3257dbb","label":"edf5fcd0469b","date":"2026-09-07T17:18:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"15cb16496446b94e67f7abcb049b8e2c75cd3d02","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/15cb16496446b94e67f7abcb049b8e2c75cd3d02.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89567","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89567.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89566","title":"jbd2: check need_resched() when skipping busy checkpoint buffers","status":"backported","project":false,"upstream":[{"sha":"f213e12ff5c9590b1034ae8da0e6d09665c772d0","url":"https://git.kernel.org/stable/c/f213e12ff5c9590b1034ae8da0e6d09665c772d0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f83c23286e54180cdc83a36463a60003534cc290","label":"f83c23286e54","date":"2026-09-07T17:18:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f213e12ff5c9590b1034ae8da0e6d09665c772d0","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/f213e12ff5c9590b1034ae8da0e6d09665c772d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89566","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89566.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89545","title":"sunrpc: defer rq_argp and rq_resp free until after RCU grace period","status":"backported","project":false,"upstream":[{"sha":"c479bde671cbe2f9e152834a8b0eb7c3c295bbaf","url":"https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0ea49d69aa806008b2424c8cf21cf746b9963967","label":"0ea49d69aa80","date":"2026-09-21T15:02:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c479bde671cbe2f9e152834a8b0eb7c3c295bbaf","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89545","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89545.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89534","title":"svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails","status":"backported","project":false,"upstream":[{"sha":"01500306e1d50de7ca7a2cdcdfa28ac0523eb747","url":"https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2a68aeb2de8ad0fef9c50e73a50622a35c6af1a8","label":"2a68aeb2de8a","date":"2026-10-21T10:30:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"01500306e1d50de7ca7a2cdcdfa28ac0523eb747","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/01500306e1d50de7ca7a2cdcdfa28ac0523eb747.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89534","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89534.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89451","title":"iommu/sva: Set handle->dev before the SVA handle is visible","status":"backported","project":false,"upstream":[{"sha":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","url":"https://git.kernel.org/stable/c/530f8f9c3546cb3ebee1b135375aaee08a073ebb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bcffb1c75da8fc9d51168ff9f09d471c26507912","label":"bcffb1c75da8","date":"2026-09-07T17:18:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/530f8f9c3546cb3ebee1b135375aaee08a073ebb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89451","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89451.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-81016","title":"platform/x86/amd/pmc: Propagate SMU errors and validate S2D address","status":"backported","project":false,"upstream":[{"sha":"0225c1d637687b03726f00ac65b6def843d2c464","url":"https://git.kernel.org/stable/c/0225c1d637687b03726f00ac65b6def843d2c464"}],"evidence":[{"url":"https://git.kernel.org/stable/c/638e1ca5d4e2b4fdbb209db64926d013b34f3b79","label":"638e1ca5d4e2","date":"2026-10-03T12:35:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0225c1d637687b03726f00ac65b6def843d2c464","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81016","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-81016.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-81010","title":"io_uring/waitid: honor task_work cancellation","status":"unfixed","project":false,"upstream":[{"sha":"14572de82e5022899e5856008bc9cac97004a88c","url":"https://git.kernel.org/stable/c/14572de82e5022899e5856008bc9cac97004a88c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"14572de82e5022899e5856008bc9cac97004a88c","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/14572de82e5022899e5856008bc9cac97004a88c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-81010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80999","title":"net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO","status":"backported","project":false,"upstream":[{"sha":"fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc","url":"https://git.kernel.org/stable/c/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c32cf5292a0dd70c4afc138b4dc45743a190cd5a","label":"c32cf5292a0d","date":"2026-09-07T17:18:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80990","title":"net: thunderbolt: Release the Rx HopID that was handed out on mismatch","status":"backported","project":false,"upstream":[{"sha":"2f1463554d0561a2fead81e3888604e5c1125e29","url":"https://git.kernel.org/stable/c/2f1463554d0561a2fead81e3888604e5c1125e29"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9eac1817bfc5fa76e3a2d1b8fd824cc6ef5a9ab0","label":"9eac1817bfc5","date":"2026-09-07T17:18:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2f1463554d0561a2fead81e3888604e5c1125e29","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80989","title":"net: thunderbolt: Mark the connection down when bringing it up fails","status":"backported","project":false,"upstream":[{"sha":"3c8b26ebf525ba5960510f48c6e9936a79ebe76f","url":"https://git.kernel.org/stable/c/3c8b26ebf525ba5960510f48c6e9936a79ebe76f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ed1d6e3d735e7b03f43a02f4306c89eb7663da14","label":"ed1d6e3d735e","date":"2026-09-07T17:18:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3c8b26ebf525ba5960510f48c6e9936a79ebe76f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80947","title":"wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop","status":"backported","project":false,"upstream":[{"sha":"6c080026ecc17eecb103f8927c64ea73a74bb818","url":"https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818"}],"evidence":[{"url":"https://git.kernel.org/stable/c/800d2b490a9af1e7132a3564c2ad5a81292e5b40","label":"800d2b490a9a","date":"2026-09-07T17:18:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6c080026ecc17eecb103f8927c64ea73a74bb818","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80920","title":"io_uring: defer eventfd signaling when queued from a wakeup handler","status":"backported","project":false,"upstream":[{"sha":"cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e","url":"https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9d984451baf768ecd9e1fdad4637b729fcb2c9d5","label":"9d984451baf7","date":"2026-10-21T10:30:45+02:00","lore":["https://lore.kernel.org/all/20260813133843.2933127-1-4ncienth@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e","lines":163,"reason":"","source":"https://github.com/torvalds/linux/commit/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80899","title":"erofs: remove fscache backend entirely","status":"unfixed","project":false,"upstream":[{"sha":"c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56","url":"https://git.kernel.org/stable/c/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56","lines":1137,"reason":"","source":"https://github.com/torvalds/linux/commit/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80872","title":"ALSA: hda/tas2781: Cancel async firmware request at unbind","status":"unfixed","project":false,"upstream":[{"sha":"5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9","url":"https://git.kernel.org/stable/c/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9"}],"evidence":[],"submission_lore":[],"basis":"async tasdev_fw_ready callback is not canceled before unbind teardown","review":{"id":"CVE-2026-80872","series":"6.12.y","upstream":["5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"async tasdev_fw_ready callback is not canceled before unbind teardown","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: sound/pci/hda/tas2781_hda_i2c.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/sound/pci/hda/tas2781_hda_i2c.c?id=e2acc2211022246c77740d5df08265cc27eedcc5"},{"label":"Upstream fix 5367e2ad14f0","url":"https://git.kernel.org/stable/c/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9"}]},"size":{"status":"within-limit","patches":[{"sha":"5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80862","title":"nvme-tcp: fix usage of page_frag_cache","status":"backported","project":false,"upstream":[{"sha":"36ac05f7cfd59d90c597071304b14e98090d5dd1","url":"https://git.kernel.org/stable/c/36ac05f7cfd59d90c597071304b14e98090d5dd1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d19f98c79f1b7e09e4cdf5c20d626e571e487467","label":"d19f98c79f1b","date":"2026-09-02T14:30:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"36ac05f7cfd59d90c597071304b14e98090d5dd1","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/36ac05f7cfd59d90c597071304b14e98090d5dd1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80820","title":"xfs: don't livelock in scrub on a circular unlinked list","status":"backported","project":false,"upstream":[{"sha":"527eaaefddb6ec5c83a06c9a1559960dd6361753","url":"https://git.kernel.org/stable/c/527eaaefddb6ec5c83a06c9a1559960dd6361753"}],"evidence":[{"url":"https://git.kernel.org/stable/c/599453f83458b57995290a1d31200c263e2c2691","label":"599453f83458","date":"2026-08-27T14:32:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"527eaaefddb6ec5c83a06c9a1559960dd6361753","lines":149,"reason":"","source":"https://github.com/torvalds/linux/commit/527eaaefddb6ec5c83a06c9a1559960dd6361753.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80820","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80820.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80785","title":"fbdev: serialize mode sysfs access with lock_fb_info()","status":"unfixed","project":false,"upstream":[{"sha":"061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2","url":"https://git.kernel.org/stable/c/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80785","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80785.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80771","title":"HID: nintendo: register input device after capabilities are set","status":"backported","project":false,"upstream":[{"sha":"d723bc1fe2e72b9252234e94c11af644ec477bf7","url":"https://git.kernel.org/stable/c/d723bc1fe2e72b9252234e94c11af644ec477bf7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3288bec1a21d582b504344380139cdc0e88ebe4d","label":"3288bec1a21d","date":"2026-08-27T14:32:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d723bc1fe2e72b9252234e94c11af644ec477bf7","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/d723bc1fe2e72b9252234e94c11af644ec477bf7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80771","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80771.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80721","title":"Bluetooth: ISO: ensure no dangling hcon references in iso_conn","status":"unfixed","project":false,"upstream":[{"sha":"aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb","url":"https://git.kernel.org/stable/c/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80721","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80721.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80705","title":"drm/amd/display: check if dml21_add_phantom_plane() is successful","status":"backported","project":false,"upstream":[{"sha":"000acb4ce7fb9feba3072ce468ad681f6585cd5d","url":"https://git.kernel.org/stable/c/000acb4ce7fb9feba3072ce468ad681f6585cd5d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ef7d731f1df63d6230e159996c0703aaf5132bac","label":"ef7d731f1df6","date":"2026-10-21T10:30:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-80705","series":"6.12.y","upstream":["000acb4ce7fb9feba3072ce468ad681f6585cd5d"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"dml21_handle_phantom_streams_planes() discards dml21_add_phantom_plane() failure and marks phantoms_added true unconditionally.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_utils.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_utils.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n420"},{"label":"Upstream fix 000acb4ce7fb","url":"https://git.kernel.org/stable/c/000acb4ce7fb9feba3072ce468ad681f6585cd5d"}]},"size":{"status":"within-limit","patches":[{"sha":"000acb4ce7fb9feba3072ce468ad681f6585cd5d","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/000acb4ce7fb9feba3072ce468ad681f6585cd5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80705","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80705.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80704","title":"drm/amd/display: use proper context for logging","status":"backported","project":false,"upstream":[{"sha":"114b42507b6a23d9d24e24e4ef165233332c64d4","url":"https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a94e62b7c7018fcfe0251e53fa96af30f12d923a","label":"a94e62b7c701","date":"2026-08-09T20:23:20+02:00","lore":["https://lore.kernel.org/all/a9ee54e6-2413-4156-9bde-d528ae3c63a3@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"114b42507b6a23d9d24e24e4ef165233332c64d4","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/114b42507b6a23d9d24e24e4ef165233332c64d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80704","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80704.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80685","title":"mm/util: don't read __page_2 for order-1 folios in snapshot_page()","status":"unfixed","project":false,"upstream":[{"sha":"7441d6348c70738e9ed307510db171c7a9b3f4bf","url":"https://git.kernel.org/stable/c/7441d6348c70738e9ed307510db171c7a9b3f4bf"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7441d6348c70738e9ed307510db171c7a9b3f4bf","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7441d6348c70738e9ed307510db171c7a9b3f4bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80685","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80685.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80676","title":"Drivers: hv: vmbus: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"331d8900121a1d74ecd45cd2db742ddcb5a0a565","url":"https://git.kernel.org/stable/c/331d8900121a1d74ecd45cd2db742ddcb5a0a565"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d1cb12ae81d2f7a58b0b1cfb51862afca98e6058","label":"d1cb12ae81d2","date":"2026-07-24T16:10:52+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"331d8900121a1d74ecd45cd2db742ddcb5a0a565","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/331d8900121a1d74ecd45cd2db742ddcb5a0a565.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80676","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80676.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80670","title":"perf tools: Use perf_env__get_cpu_topology() in machine__resolve()","status":"unfixed","project":false,"upstream":[{"sha":"5484b43a0ec8231c36fba6ead654cb72dbba8b8f","url":"https://git.kernel.org/stable/c/5484b43a0ec8231c36fba6ead654cb72dbba8b8f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5484b43a0ec8231c36fba6ead654cb72dbba8b8f","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/5484b43a0ec8231c36fba6ead654cb72dbba8b8f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80670","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80670.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80668","title":"netfilter: nf_conntrack_expect: use conntrack GC to reap expectations","status":"backported","project":false,"upstream":[{"sha":"b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2","url":"https://git.kernel.org/stable/c/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/02f7809a19fc88cfd9bc113a4bfe7add6305db39","label":"02f7809a19fc","date":"2026-10-21T10:30:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"over-limit","patches":[{"sha":"b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2","lines":512,"reason":"","source":"https://github.com/torvalds/linux/commit/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80668","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80668.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80657","title":"accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer","status":"not-applicable","project":false,"upstream":[{"sha":"506255d46bdb93a281cf39e72abbca124f5c7a1b","url":"https://git.kernel.org/stable/c/506255d46bdb93a281cf39e72abbca124f5c7a1b"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"506255d46bdb93a281cf39e72abbca124f5c7a1b","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/506255d46bdb93a281cf39e72abbca124f5c7a1b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80657","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80657.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80650","title":"media: atomisp: gc2235: fix UAF and memory leak","status":"backported","project":false,"upstream":[{"sha":"628f763aee0047ff44974388d6f70f75a763026b","url":"https://git.kernel.org/stable/c/628f763aee0047ff44974388d6f70f75a763026b"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","url":"https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"628f763aee0047ff44974388d6f70f75a763026b","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/628f763aee0047ff44974388d6f70f75a763026b.patch"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","lines":168072,"reason":"","source":"https://github.com/torvalds/linux/commit/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80650","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80650.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80636","title":"netfilter: conntrack: revert ct extension genid infrastructure","status":"backported","project":false,"upstream":[{"sha":"35e21a4dccc5c255ba59ccfbfeb4629ed21da972","url":"https://git.kernel.org/stable/c/35e21a4dccc5c255ba59ccfbfeb4629ed21da972"}],"evidence":[{"url":"https://git.kernel.org/stable/c/61eab1d0237eb513fe73e391a5926ee70092c325","label":"61eab1d0237e","date":"2026-07-24T16:10:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"35e21a4dccc5c255ba59ccfbfeb4629ed21da972","lines":183,"reason":"","source":"https://github.com/torvalds/linux/commit/35e21a4dccc5c255ba59ccfbfeb4629ed21da972.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80636","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80636.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80634","title":"netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag","status":"backported","project":false,"upstream":[{"sha":"e052f920773b73be49eb4d8702a9f85de7464363","url":"https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ee8440bb000fff4ef8acbfc99652851e9ca0a35b","label":"ee8440bb000f","date":"2026-10-21T10:30:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-80634","series":"6.12.y","upstream":["e052f920773b73be49eb4d8702a9f85de7464363"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"In renamed nft_flow_offload.c, nft_dev_path_info decrements u8 num_encaps inside WARN_ON_ONCE; zero wraps to 255 and the later route loop reads encap beyond its two-entry array.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: net/netfilter/nft_flow_offload.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/netfilter/nft_flow_offload.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n95"},{"label":"Upstream fix e052f920773b","url":"https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363"}]},"size":{"status":"unknown","patches":[{"sha":"e052f920773b73be49eb4d8702a9f85de7464363","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80611","title":"ACPI: processor_idle: Mark LPI enter functions as __cpuidle","status":"backported","project":false,"upstream":[{"sha":"956ca5d72c76504824c8eb601879da9476973e15","url":"https://git.kernel.org/stable/c/956ca5d72c76504824c8eb601879da9476973e15"}],"evidence":[{"url":"https://git.kernel.org/stable/c/10f675902a5fc88ccfe34bb8aa37de50806b03b1","label":"10f675902a5f","date":"2026-07-24T16:11:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"956ca5d72c76504824c8eb601879da9476973e15","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80611","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80611.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80580","title":"fbdev: bound mode sysfs output to the sysfs buffer","status":"unfixed","project":false,"upstream":[{"sha":"d15d51fb26e830af58f3f21964f1c09c239077ea","url":"https://git.kernel.org/stable/c/d15d51fb26e830af58f3f21964f1c09c239077ea"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d15d51fb26e830af58f3f21964f1c09c239077ea","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/d15d51fb26e830af58f3f21964f1c09c239077ea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80580","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80580.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80579","title":"fbdev: clear fb_info->mode before deleting a videomode","status":"unfixed","project":false,"upstream":[{"sha":"95e647d2a5304a8fd11f1ba3c8502de700650131","url":"https://git.kernel.org/stable/c/95e647d2a5304a8fd11f1ba3c8502de700650131"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"95e647d2a5304a8fd11f1ba3c8502de700650131","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/95e647d2a5304a8fd11f1ba3c8502de700650131.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80579","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80579.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80556","title":"mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition","status":"backported","project":false,"upstream":[{"sha":"c125ee35a49a0518521b52b27631eef061b8719a","url":"https://git.kernel.org/stable/c/c125ee35a49a0518521b52b27631eef061b8719a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/22aecf6c4721727a2f724ca0438bc7d4b609bf3f","label":"22aecf6c4721","date":"2026-08-23T14:22:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c125ee35a49a0518521b52b27631eef061b8719a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/c125ee35a49a0518521b52b27631eef061b8719a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80556","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80556.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80546","title":"s390/zcrypt: Improve CCA CPRB length and overflow checks","status":"unfixed","project":false,"upstream":[{"sha":"35ac6754ba6da45fd193f5ce3f665f7490b830d5","url":"https://git.kernel.org/stable/c/35ac6754ba6da45fd193f5ce3f665f7490b830d5"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"35ac6754ba6da45fd193f5ce3f665f7490b830d5","lines":110,"reason":"","source":"https://github.com/torvalds/linux/commit/35ac6754ba6da45fd193f5ce3f665f7490b830d5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80546","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80546.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80545","title":"s390/zcrypt: Improve EP11 CPRB length and overflow checks","status":"unfixed","project":false,"upstream":[{"sha":"17ac0bc866fc624cd05f022dcd8b730c0af11bb1","url":"https://git.kernel.org/stable/c/17ac0bc866fc624cd05f022dcd8b730c0af11bb1"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"17ac0bc866fc624cd05f022dcd8b730c0af11bb1","lines":197,"reason":"","source":"https://github.com/torvalds/linux/commit/17ac0bc866fc624cd05f022dcd8b730c0af11bb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80545","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80545.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80544","title":"s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing","status":"unfixed","project":false,"upstream":[{"sha":"0864a163783bff109b548266921829ea794edc93","url":"https://git.kernel.org/stable/c/0864a163783bff109b548266921829ea794edc93"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"0864a163783bff109b548266921829ea794edc93","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/0864a163783bff109b548266921829ea794edc93.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80544","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80544.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80543","title":"s390/zcrypt: Pad trailing CCA or EP11 message with zeros","status":"unfixed","project":false,"upstream":[{"sha":"eb363254472493e3458156fc11fd56dca92f4333","url":"https://git.kernel.org/stable/c/eb363254472493e3458156fc11fd56dca92f4333"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb363254472493e3458156fc11fd56dca92f4333","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/eb363254472493e3458156fc11fd56dca92f4333.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80543","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80543.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80521","title":"af_unix: Unlink scc_entry in unix_del_edge().","status":"backported","project":true,"upstream":[{"sha":"594d905195024b228c962627ae5ae7c17bd582a4","url":"https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1293fd69a50d188a5788b08ba3741a3e86be1608","label":"1293fd69a50d","date":"2026-09-21T15:01:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"594d905195024b228c962627ae5ae7c17bd582a4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80521","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80521.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74752","title":"sctp: validate cookie AUTH state before use","status":"backported","project":false,"upstream":[{"sha":"3dbb44d88b1e94dd31fe43588af7437b34b44d56","url":"https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7f17984cfa697613800eb693e183b06884129bd3","label":"7f17984cfa69","date":"2026-10-21T10:30:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"3dbb44d88b1e94dd31fe43588af7437b34b44d56","lines":105,"reason":"","source":"https://github.com/torvalds/linux/commit/3dbb44d88b1e94dd31fe43588af7437b34b44d56.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74735","title":"l2tp: fix tunnel and session refcount leak on seq_file release","status":"backported","project":true,"upstream":[{"sha":"9006c116dd111d457bf5d074990210f70a4ad2c8","url":"https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bdf83613781956cc39798ed08321f74ab0467f4d","label":"bdf836137819","date":"2026-09-21T15:01:57+02:00","lore":["https://lore.kernel.org/netdev/6a760f32.01d0871a.3a0d52.004f.GAE@google.com/T/#u"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9006c116dd111d457bf5d074990210f70a4ad2c8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74735","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74735.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74725","title":"enic: fix tx_hang_reset use-after-free on device removal","status":"backported","project":false,"upstream":[{"sha":"ec680ea4ba1bca92a767fb7e7869758bfdd886e3","url":"https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9","label":"8619865f34fb","date":"2026-08-19T18:14:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ec680ea4ba1bca92a767fb7e7869758bfdd886e3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/ec680ea4ba1bca92a767fb7e7869758bfdd886e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74725","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74725.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74677","title":"net: usb: ipheth: fix carrier_work UAF on disconnect","status":"backported","project":false,"upstream":[{"sha":"fde39b8a521780391fb4e5bda2c0aa4928947f12","url":"https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d07133fe1befae9a1e4c4c5e46ef0b73d2992020","label":"d07133fe1bef","date":"2026-08-19T18:14:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fde39b8a521780391fb4e5bda2c0aa4928947f12","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/fde39b8a521780391fb4e5bda2c0aa4928947f12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74677","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74677.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74653","title":"serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx","status":"backported","project":false,"upstream":[{"sha":"1423415471274abda87024967d7fe2206ceee0ea","url":"https://git.kernel.org/stable/c/1423415471274abda87024967d7fe2206ceee0ea"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c321dc5172c8c66e21ffbeeb7a2ebb88ae6fd4c3","label":"c321dc5172c8","date":"2026-08-27T14:32:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1423415471274abda87024967d7fe2206ceee0ea","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/1423415471274abda87024967d7fe2206ceee0ea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74653","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74653.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74638","title":"drm/v3d: Serialize the scheduler timeout handlers","status":"unfixed","project":false,"upstream":[{"sha":"4da94744707b27a3ae1197bdd7127da4505dc5b1","url":"https://git.kernel.org/stable/c/4da94744707b27a3ae1197bdd7127da4505dc5b1"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4da94744707b27a3ae1197bdd7127da4505dc5b1","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/4da94744707b27a3ae1197bdd7127da4505dc5b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74638","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74638.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74592","title":"ima: Instantiate file_truncate and path_truncate hooks","status":"backported","project":false,"upstream":[{"sha":"b80bed5c871a80151351342c065579405ce77145","url":"https://git.kernel.org/stable/c/b80bed5c871a80151351342c065579405ce77145"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5f46705d96eb60587aa7035acfcbec977e08d620","label":"5f46705d96eb","date":"2026-08-19T18:14:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b80bed5c871a80151351342c065579405ce77145","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/b80bed5c871a80151351342c065579405ce77145.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74592","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74592.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74560","title":"xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx","status":"unfixed","project":false,"upstream":[{"sha":"a3c8382ebce4780c6b3ace2c09bc342313ac0186","url":"https://git.kernel.org/stable/c/a3c8382ebce4780c6b3ace2c09bc342313ac0186"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a3c8382ebce4780c6b3ace2c09bc342313ac0186","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/a3c8382ebce4780c6b3ace2c09bc342313ac0186.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74560","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74560.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74559","title":"xsk: drain continuation descs after overflow in xsk_build_skb()","status":"backported","project":false,"upstream":[{"sha":"bd44a6dcd4248883de90f5dad53ae80066e27096","url":"https://git.kernel.org/stable/c/bd44a6dcd4248883de90f5dad53ae80066e27096"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ecd0d1cde0478c232a867f14ec99cf97aff5eb30","label":"ecd0d1cde047","date":"2026-10-21T10:30:41+02:00","lore":["https://lore.kernel.org/all/20260425041726.85FB3C2BCB2@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bd44a6dcd4248883de90f5dad53ae80066e27096","lines":97,"reason":"","source":"https://github.com/torvalds/linux/commit/bd44a6dcd4248883de90f5dad53ae80066e27096.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74559","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74559.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74558","title":"xsk: reclaim invalid Tx descriptors in ZC batch path","status":"backported","project":false,"upstream":[{"sha":"72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","url":"https://git.kernel.org/stable/c/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/56036bdc445c468b1defd1780ed2af4a3fc7ddb2","label":"56036bdc445c","date":"2026-10-21T10:30:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","lines":404,"reason":"","source":"https://github.com/torvalds/linux/commit/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74558","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74558.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74536","title":"Bluetooth: ISO: fix leaking sk after socket release","status":"backported","project":false,"upstream":[{"sha":"ce57442a379212fe3fda59c9437ee8217eceb5b1","url":"https://git.kernel.org/stable/c/ce57442a379212fe3fda59c9437ee8217eceb5b1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/96ed3c772c08e7a91c399567f412618e43231023","label":"96ed3c772c08","date":"2026-08-09T20:23:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ce57442a379212fe3fda59c9437ee8217eceb5b1","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/ce57442a379212fe3fda59c9437ee8217eceb5b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74536","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74536.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74533","title":"Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero","status":"backported","project":false,"upstream":[{"sha":"af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","url":"https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/08ac98f18c8d24cc037858dd6fba2670155e4e84","label":"08ac98f18c8d","date":"2026-10-21T10:30:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"over-limit","patches":[{"sha":"af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","lines":170,"reason":"","source":"https://github.com/torvalds/linux/commit/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74533","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74533.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74531","title":"Bluetooth: hci_conn: hold conn reference in abort_conn_sync()","status":"backported","project":false,"upstream":[{"sha":"5761d003daa987ac81463f570713ce9c9dd204e5","url":"https://git.kernel.org/stable/c/5761d003daa987ac81463f570713ce9c9dd204e5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/963fb4b8e7d1ab07b4ae45bf15d41e667c88caca","label":"963fb4b8e7d1","date":"2026-08-09T20:23:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5761d003daa987ac81463f570713ce9c9dd204e5","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/5761d003daa987ac81463f570713ce9c9dd204e5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74531","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74531.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74521","title":"ksmbd: use memcmp() to compare ClientGUIDs","status":"backported","project":true,"upstream":[{"sha":"e8bb506e6ef749ac0336f3e579d8d02396b7d832","url":"https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ba2a5b66f1d414eb8403d655f8813783892cfc85","label":"ba2a5b66f1d4","date":"2026-09-21T15:01:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e8bb506e6ef749ac0336f3e579d8d02396b7d832","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74521","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74521.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74513","title":"dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister","status":"backported","project":false,"upstream":[{"sha":"a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","url":"https://git.kernel.org/stable/c/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/90b2166605a7476007f7c013521d30b0be557cac","label":"90b2166605a7","date":"2026-10-21T10:30:40+02:00","lore":[]}],"submission_lore":[],"basis":"DIBS loopback driver and DMB hash/refcount implementation absent from target path list","review":{"id":"CVE-2026-74513","series":"6.12.y","upstream":["a10ea943356b9d70c5616a0a06f6fa97cfdaccb1"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"not-applicable","applicability":"unaffected","reason":"DIBS loopback driver and DMB hash/refcount implementation absent from target path list","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/dibs absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers?id=e2acc2211022246c77740d5df08265cc27eedcc5"},{"label":"Upstream fix a10ea943356b","url":"https://git.kernel.org/stable/c/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1"}]},"size":{"status":"over-limit","patches":[{"sha":"a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74513","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74513.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74506","title":"afs: Fix UAF when sending a message","status":"backported","project":false,"upstream":[{"sha":"4af1ec68d54b3871155914d584fb10669c41a861","url":"https://git.kernel.org/stable/c/4af1ec68d54b3871155914d584fb10669c41a861"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cbb0d3da042c01082f40166fdc99bf1752db72be","label":"cbb0d3da042c","date":"2026-10-21T10:30:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4af1ec68d54b3871155914d584fb10669c41a861","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/4af1ec68d54b3871155914d584fb10669c41a861.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74506","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74506.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74449","title":"drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport","status":"backported","project":false,"upstream":[{"sha":"f327e389c07cfc3a2f6ff54f6214e1a52d457edc","url":"https://git.kernel.org/stable/c/f327e389c07cfc3a2f6ff54f6214e1a52d457edc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/70f5f4ddba0d2d89e77ec13b79cdcfbef33be0d9","label":"70f5f4ddba0d","date":"2026-10-21T10:30:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-74449","series":"6.12.y","upstream":["f327e389c07cfc3a2f6ff54f6214e1a52d457edc"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"calculate_mcache_setting() asserts a positive mcache count but continues into calculations that use the count and viewport dimensions; it does not return failure for invalid zero-count inputs.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n2452"},{"label":"Upstream fix f327e389c07c","url":"https://git.kernel.org/stable/c/f327e389c07cfc3a2f6ff54f6214e1a52d457edc"}]},"size":{"status":"within-limit","patches":[{"sha":"f327e389c07cfc3a2f6ff54f6214e1a52d457edc","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/f327e389c07cfc3a2f6ff54f6214e1a52d457edc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74419","title":"accel/amdxdna: Adjust size for copy_to_user()","status":"not-applicable","project":false,"upstream":[{"sha":"6e87001fe19f251e2ae14373bc76554358a13df2","url":"https://git.kernel.org/stable/c/6e87001fe19f251e2ae14373bc76554358a13df2"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"6e87001fe19f251e2ae14373bc76554358a13df2","lines":264,"reason":"","source":"https://github.com/torvalds/linux/commit/6e87001fe19f251e2ae14373bc76554358a13df2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74419","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74419.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74407","title":"wifi: ath11k: cancel SSR work items during PCI shutdown","status":"backported","project":false,"upstream":[{"sha":"8c79aac429b583301f387374ff37c59be671df87","url":"https://git.kernel.org/stable/c/8c79aac429b583301f387374ff37c59be671df87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/daeb44fb8d700654f37f54d1ee36cd67645d0d34","label":"daeb44fb8d70","date":"2026-10-21T10:30:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8c79aac429b583301f387374ff37c59be671df87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74407","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74407.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74374","title":"md/raid1,raid10: fix error-path detection with md_cloned_bio()","status":"backported","project":false,"upstream":[{"sha":"811545e0926d02a6a0b1a1258bb5544777c164d4","url":"https://git.kernel.org/stable/c/811545e0926d02a6a0b1a1258bb5544777c164d4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8719aa0f57955fd641f952d16e02fc6b4934c6e3","label":"8719aa0f5795","date":"2026-10-21T10:30:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"811545e0926d02a6a0b1a1258bb5544777c164d4","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/811545e0926d02a6a0b1a1258bb5544777c164d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74374","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74374.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74368","title":"wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()","status":"backported","project":false,"upstream":[{"sha":"98d4f92ab6a1af2ea2ab590d7e2801b203110981","url":"https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981"}],"evidence":[{"url":"https://git.kernel.org/stable/c/779ab501dc8f1148b3f10740a68335741bdc5ffe","label":"779ab501dc8f","date":"2026-10-21T10:30:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":{"id":"CVE-2026-74368","series":"6.12.y","upstream":["98d4f92ab6a1af2ea2ab590d7e2801b203110981"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"On TKIP MIC failure, ath12k_dp_rx_h_verify_tkip_mic returns -EINVAL when NWIFI header-length validation fails without freeing msdu. ath12k_dp_rx_h_defrag has already unlinked first_frag from rx_tid->rx_frags, then sets first_frag to NULL on this error. The caller error path frees NULL and purges only the remaining queue, so the unlinked first fragment leaks.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/wireless/ath/ath12k/dp_rx.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/ath/ath12k/dp_rx.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n2860"},{"label":"Checked source: drivers/net/wireless/ath/ath12k/dp_rx.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/ath/ath12k/dp_rx.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n2860"},{"label":"Checked source: drivers/net/wireless/ath/ath12k/dp_rx.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/ath/ath12k/dp_rx.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n2860"},{"label":"Upstream fix 98d4f92ab6a1","url":"https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981"}]},"size":{"status":"within-limit","patches":[{"sha":"98d4f92ab6a1af2ea2ab590d7e2801b203110981","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/98d4f92ab6a1af2ea2ab590d7e2801b203110981.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74368","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74368.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74354","title":"bpf: Take mmap_lock in zap_pages()","status":"unfixed","project":false,"upstream":[{"sha":"80b89d0226a05e8b67969de99c31b51fcd54f76a","url":"https://git.kernel.org/stable/c/80b89d0226a05e8b67969de99c31b51fcd54f76a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"80b89d0226a05e8b67969de99c31b51fcd54f76a","lines":93,"reason":"","source":"https://github.com/torvalds/linux/commit/80b89d0226a05e8b67969de99c31b51fcd54f76a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74354","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74354.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74342","title":"kernfs: link kn to its parent before the LSM init hook","status":"unfixed","project":false,"upstream":[{"sha":"6cccc49b027c7551ffc1d2532f2ef1922661f3da","url":"https://git.kernel.org/stable/c/6cccc49b027c7551ffc1d2532f2ef1922661f3da"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6cccc49b027c7551ffc1d2532f2ef1922661f3da","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/6cccc49b027c7551ffc1d2532f2ef1922661f3da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74342","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74342.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74337","title":"bpf: Fix NMI/tracepoint re-entry deadlock on lru locks","status":"unfixed","project":false,"upstream":[{"sha":"89edbdfc5d0308cef57b71359331de5c4ddbf763","url":"https://git.kernel.org/stable/c/89edbdfc5d0308cef57b71359331de5c4ddbf763"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"89edbdfc5d0308cef57b71359331de5c4ddbf763","lines":402,"reason":"","source":"https://github.com/torvalds/linux/commit/89edbdfc5d0308cef57b71359331de5c4ddbf763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74336","title":"wifi: mac80211: bound S1G TIM PVB walk to the TIM element","status":"not-applicable","project":false,"upstream":[{"sha":"b224d18b1e5d1cddfc67f63f41d80023b2ec8889","url":"https://git.kernel.org/stable/c/b224d18b1e5d1cddfc67f63f41d80023b2ec8889"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"b224d18b1e5d1cddfc67f63f41d80023b2ec8889","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b224d18b1e5d1cddfc67f63f41d80023b2ec8889.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74336","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74336.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74324","title":"wifi: mt76: mt7925: validate skb length in testmode query","status":"not-applicable","project":false,"upstream":[{"sha":"c7369a00860a0704461d440e7c3bf9b49bfdbaee","url":"https://git.kernel.org/stable/c/c7369a00860a0704461d440e7c3bf9b49bfdbaee"}],"evidence":[],"submission_lore":[],"basis":"mt7925 testmode query endpoint and mt7925_tm_query are absent from this target.","review":{"id":"CVE-2026-74324","series":"6.12.y","upstream":["c7369a00860a0704461d440e7c3bf9b49bfdbaee"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"not-applicable","applicability":"unaffected","reason":"mt7925 testmode query endpoint and mt7925_tm_query are absent from this target.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/net/wireless/mediatek/mt76/mt7925/testmode.c absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/mediatek/mt76/mt7925?id=e2acc2211022246c77740d5df08265cc27eedcc5"},{"label":"Upstream fix c7369a00860a","url":"https://git.kernel.org/stable/c/c7369a00860a0704461d440e7c3bf9b49bfdbaee"}]},"size":{"status":"within-limit","patches":[{"sha":"c7369a00860a0704461d440e7c3bf9b49bfdbaee","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/c7369a00860a0704461d440e7c3bf9b49bfdbaee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74324","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74324.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74314","title":"bpf: Cancel special fields on map value recycle","status":"unfixed","project":false,"upstream":[{"sha":"a3a81d247651218e47153f2d2afd7aee236726fd","url":"https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"a3a81d247651218e47153f2d2afd7aee236726fd","lines":471,"reason":"","source":"https://github.com/torvalds/linux/commit/a3a81d247651218e47153f2d2afd7aee236726fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74314","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74314.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74294","title":"ASoC: meson: aiu: Validate written enum values","status":"backported","project":true,"upstream":[{"sha":"d65adf85477247be04ac86886f8edfaa047b5d4a","url":"https://git.kernel.org/stable/c/d65adf85477247be04ac86886f8edfaa047b5d4a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8a6d6735e7c02e88841cca1497ff3d8089f2ef24","label":"8a6d6735e7c0","date":"2026-09-21T15:01:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d65adf85477247be04ac86886f8edfaa047b5d4a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74294","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74294.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74291","title":"ASoC: topology: Check PCM and DAI name strings before use","status":"backported","project":true,"upstream":[{"sha":"b7e44d1986d6671342c19b82192189ca5db5dab7","url":"https://git.kernel.org/stable/c/b7e44d1986d6671342c19b82192189ca5db5dab7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/473f7d25d93e80db526a9d05887f0071abdc6d9b","label":"473f7d25d93e","date":"2026-09-21T15:01:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"b7e44d1986d6671342c19b82192189ca5db5dab7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74291","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74291.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74289","title":"ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().","status":"backported","project":true,"upstream":[{"sha":"06b693d2eb6651a63ad85bad8673de3b7d4edd6d","url":"https://git.kernel.org/stable/c/06b693d2eb6651a63ad85bad8673de3b7d4edd6d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7980a13add57f97c5da1dc961d0145a6ad2a7f98","label":"7980a13add57","date":"2026-09-21T15:01:56+02:00","lore":["https://lore.kernel.org/netdev/6a290011.39669fcc.33b062.00b1.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"06b693d2eb6651a63ad85bad8673de3b7d4edd6d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74272","title":"cxl/region: Resolve region deletion races","status":"backported","project":false,"upstream":[{"sha":"4dd86ca99ffcc413cbf79063fd9956ef54e0ca91","url":"https://git.kernel.org/stable/c/4dd86ca99ffcc413cbf79063fd9956ef54e0ca91"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c478810c4ce7216261fc1b6ca5180adcda26b1a1","label":"c478810c4ce7","date":"2026-10-21T10:31:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"4dd86ca99ffcc413cbf79063fd9956ef54e0ca91","lines":176,"reason":"","source":"https://github.com/torvalds/linux/commit/4dd86ca99ffcc413cbf79063fd9956ef54e0ca91.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74272","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74272.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74269","title":"bnxt: fix head underflow on XDP head-grow","status":"backported","project":false,"upstream":[{"sha":"e26657fe3b85c068b01f42bb0c602f242d643ba9","url":"https://git.kernel.org/stable/c/e26657fe3b85c068b01f42bb0c602f242d643ba9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ff34e5a26a26c92142afea11455e259c4c4c617b","label":"ff34e5a26a26","date":"2026-10-21T10:30:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e26657fe3b85c068b01f42bb0c602f242d643ba9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74269","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74269.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74258","title":"bpf: Guard __get_user acesss with access_ok for uprobe_multi data","status":"backported","project":true,"upstream":[{"sha":"4d87a251d45b4a95eb4c0abcfab809c9f231258a","url":"https://git.kernel.org/stable/c/4d87a251d45b4a95eb4c0abcfab809c9f231258a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2c387db784293256d35fd3d438f577cc82bb823d","label":"2c387db78429","date":"2026-09-21T15:01:56+02:00","lore":["https://lore.kernel.org/bpf/20260610145235.CB1441F00893@smtp.kernel.org/","https://lore.kernel.org/r/20260611114230.950379-2-jolsa@kernel.org"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"4d87a251d45b4a95eb4c0abcfab809c9f231258a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74258","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74258.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72501","title":"RDMA/bnxt_re: Initialize dpi variable to zero","status":"backported","project":false,"upstream":[{"sha":"978b27d6ce538bb832ccd69e45802824e4301c4b","url":"https://git.kernel.org/stable/c/978b27d6ce538bb832ccd69e45802824e4301c4b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/31ba386230e6093991b4800a59c42ed1766627df","label":"31ba386230e6","date":"2026-10-21T10:30:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-72501","series":"6.12.y","upstream":["978b27d6ce538bb832ccd69e45802824e4301c4b"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"In renamed ib_verbs.c BNXT_RE_METHOD_ALLOC_PAGE, dpi is initialized only for WC_PAGE, then copied to userspace for DBR_BAR_PAGE and DBR_PAGE.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/infiniband/hw/bnxt_re/ib_verbs.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/bnxt_re/ib_verbs.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n4431"},{"label":"Upstream fix 978b27d6ce53","url":"https://git.kernel.org/stable/c/978b27d6ce538bb832ccd69e45802824e4301c4b"}]},"size":{"status":"within-limit","patches":[{"sha":"978b27d6ce538bb832ccd69e45802824e4301c4b","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/978b27d6ce538bb832ccd69e45802824e4301c4b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72501","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72501.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72496","title":"RDMA/bnxt_re: Proper rollback if the ioremap fails","status":"backported","project":true,"upstream":[{"sha":"87267803a8c824616eb147c5dad7030a5db6f878","url":"https://git.kernel.org/stable/c/87267803a8c824616eb147c5dad7030a5db6f878"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3c69ff7f4a761e18ce8abfa0c98e12097b39adaa","label":"3c69ff7f4a76","date":"2026-09-21T15:01:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"87267803a8c824616eb147c5dad7030a5db6f878","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72496","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72496.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72494","title":"RDMA/irdma: Replace waitqueue and flag with completion","status":"backported","project":false,"upstream":[{"sha":"d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd","url":"https://git.kernel.org/stable/c/d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8de303efe2ff4fcbf240dfc6eb3469e1e8f18a3f","label":"8de303efe2ff","date":"2026-10-21T10:30:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72494","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72494.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72493","title":"net: serialize netif_running() check in enqueue_to_backlog()","status":"backported","project":false,"upstream":[{"sha":"46762cefe7f4e5bffc1eb467810a7bbb02e461d7","url":"https://git.kernel.org/stable/c/46762cefe7f4e5bffc1eb467810a7bbb02e461d7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cbe10ea090ea9d6fa5ff50c9b44f2a86fe56f0b7","label":"cbe10ea090ea","date":"2026-10-21T10:30:37+02:00","lore":["https://lore.kernel.org/netdev/6a315824.b0403584.28d0ff.0000.GAE@google.com/T/#u"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"46762cefe7f4e5bffc1eb467810a7bbb02e461d7","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/46762cefe7f4e5bffc1eb467810a7bbb02e461d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72485","title":"coresight: platform: defer connection counter increment until alloc succeeds","status":"backported","project":true,"upstream":[{"sha":"1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae","url":"https://git.kernel.org/stable/c/1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aed6915c2f304ed34281856c53e374483c71b68b","label":"aed6915c2f30","date":"2026-09-21T15:01:56+02:00","lore":["https://lore.kernel.org/r/20260511-fix-ref-count-issue-v1-1-99d647810d3c@oss.qualcomm.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72485","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72485.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72472","title":"nfs: use nfsi->rwsem to protect traversal of the file lock list","status":"backported","project":false,"upstream":[{"sha":"4837fb36219e6c08b666bc31a86841bad8526358","url":"https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1cda95bf2e9c0e6b63545b7565fe4a1e474322f4","label":"1cda95bf2e9c","date":"2026-07-24T16:11:08+02:00","lore":["https://lore.kernel.org/all/20250419085709.1452492-1-lilingfeng3@huawei.com/","https://lore.kernel.org/all/20250715030559.2906634-1-lilingfeng3@huawei.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4837fb36219e6c08b666bc31a86841bad8526358","lines":87,"reason":"","source":"https://github.com/torvalds/linux/commit/4837fb36219e6c08b666bc31a86841bad8526358.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72472","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72472.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72469","title":"xprtrdma: Fix ep kref imbalance on ADDR_CHANGE","status":"backported","project":false,"upstream":[{"sha":"af9b65b29af341932625c4283dc7a23cdb62688a","url":"https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cfd1bab66b042da7a778786685125656c695931b","label":"cfd1bab66b04","date":"2026-07-24T16:11:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"af9b65b29af341932625c4283dc7a23cdb62688a","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/af9b65b29af341932625c4283dc7a23cdb62688a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72469","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72469.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72463","title":"xfrm: Fix dev use-after-free in xfrm async resumption","status":"backported","project":false,"upstream":[{"sha":"8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff","url":"https://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fed4d3195a31125566876952ce66113ec1eb9008","label":"fed4d3195a31","date":"2026-10-03T12:35:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"over-limit","patches":[{"sha":"8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff","lines":115,"reason":"","source":"https://github.com/torvalds/linux/commit/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72463","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72463.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72454","title":"i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()","status":"unfixed","project":false,"upstream":[{"sha":"650716f23eac488c6696babdc7805f6a6b7427ad","url":"https://git.kernel.org/stable/c/650716f23eac488c6696babdc7805f6a6b7427ad"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"650716f23eac488c6696babdc7805f6a6b7427ad","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/650716f23eac488c6696babdc7805f6a6b7427ad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72454","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72454.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72438","title":"md/raid10: fix writes_pending and barrier reference leaks on discard failures","status":"backported","project":true,"upstream":[{"sha":"393d687131d8aa8c7e4de2cb494438e145d20fc2","url":"https://git.kernel.org/stable/c/393d687131d8aa8c7e4de2cb494438e145d20fc2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fea33968592559a55a3f5a96a6386bebcaf988a8","label":"fea339685925","date":"2026-09-21T15:01:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"393d687131d8aa8c7e4de2cb494438e145d20fc2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72438","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72438.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72434","title":"netfilter: ipset: make sure gc is properly stopped","status":"backported","project":false,"upstream":[{"sha":"4a597a87e2e2f608edb6be2c510dc826b4fdfb53","url":"https://git.kernel.org/stable/c/4a597a87e2e2f608edb6be2c510dc826b4fdfb53"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c940d1b96248c3081b664ede5418078bdc7c8c07","label":"c940d1b96248","date":"2026-07-24T16:11:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4a597a87e2e2f608edb6be2c510dc826b4fdfb53","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/4a597a87e2e2f608edb6be2c510dc826b4fdfb53.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72434","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72434.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72413","title":"sctp: fix err_chunk memory leaks in INIT handling","status":"backported","project":true,"upstream":[{"sha":"9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2","url":"https://git.kernel.org/stable/c/9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6acedac7a14af71cfe25024ead28e16a070899e4","label":"6acedac7a14a","date":"2026-09-21T15:01:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72413","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72413.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72402","title":"bpf: Mask pseudo pointer values in verifier logs","status":"backported","project":true,"upstream":[{"sha":"72a85e9464a5332fb2cd7efd26d9295275ceda2d","url":"https://git.kernel.org/stable/c/72a85e9464a5332fb2cd7efd26d9295275ceda2d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c727b3d50ecb0f4992a964360771040a84026914","label":"c727b3d50ecb","date":"2026-09-21T15:01:56+02:00","lore":["https://lore.kernel.org/r/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-1-a190ebb8f3e2@mails.tsinghua.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"72a85e9464a5332fb2cd7efd26d9295275ceda2d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72402","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72402.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72397","title":"hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()","status":"backported","project":false,"upstream":[{"sha":"828cd614e2af053ca5e1d6da767bbd8a1b5cabfb","url":"https://git.kernel.org/stable/c/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/125a5a4ad03c74ced4c2a55db45ef03505362ff9","label":"125a5a4ad03c","date":"2026-10-21T10:30:37+02:00","lore":["https://lore.kernel.org/r/20260620-pmbus-data2reg-vid-v1-1-5518030432c4@nexthop.ai"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"828cd614e2af053ca5e1d6da767bbd8a1b5cabfb","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72397","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72397.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72377","title":"afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints","status":"not-applicable","project":false,"upstream":[{"sha":"81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459","url":"https://git.kernel.org/stable/c/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72377","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72377.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72376","title":"afs: Fix misplaced inc of net->cells_outstanding","status":"backported","project":false,"upstream":[{"sha":"c9c3b615a462a4023bd148f02c564e175ed10502","url":"https://git.kernel.org/stable/c/c9c3b615a462a4023bd148f02c564e175ed10502"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6e310f818abcef947a06584158b9e6c6cd0c98d3","label":"6e310f818abc","date":"2026-07-24T16:11:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c9c3b615a462a4023bd148f02c564e175ed10502","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c9c3b615a462a4023bd148f02c564e175ed10502.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72376","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72376.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72373","title":"afs: Fix missing NULL pointer check in afs_break_some_callbacks()","status":"backported","project":false,"upstream":[{"sha":"794a01110390c1b76f59ece773fb0fbfd89c6f5c","url":"https://git.kernel.org/stable/c/794a01110390c1b76f59ece773fb0fbfd89c6f5c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a99a617701186dc68c7b330d35fc2253f48e2ab2","label":"a99a61770118","date":"2026-07-24T16:11:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"794a01110390c1b76f59ece773fb0fbfd89c6f5c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/794a01110390c1b76f59ece773fb0fbfd89c6f5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72373","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72373.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72369","title":"minix: avoid overflow in bitmap block count calculation","status":"backported","project":false,"upstream":[{"sha":"fb3e566cafc38fe3ba35e6843a2d529a3748870c","url":"https://git.kernel.org/stable/c/fb3e566cafc38fe3ba35e6843a2d529a3748870c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/959c95340a9e19cd333b4c18935fdeecbb2f319d","label":"959c95340a9e","date":"2026-07-24T16:11:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb3e566cafc38fe3ba35e6843a2d529a3748870c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/fb3e566cafc38fe3ba35e6843a2d529a3748870c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72369","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72369.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72367","title":"iomap: guard io_size EOF trim against concurrent truncate underflow","status":"backported","project":false,"upstream":[{"sha":"55ec50d046c03b3724741957f7b007856e36dbe7","url":"https://git.kernel.org/stable/c/55ec50d046c03b3724741957f7b007856e36dbe7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cc1d6af0bee27d6595908b497424f338161299fc","label":"cc1d6af0bee2","date":"2026-10-21T10:30:36+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":{"id":"CVE-2026-72367","series":"6.12.y","upstream":["55ec50d046c03b3724741957f7b007856e36dbe7"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"iomap_add_to_ioend can underflow size_t io_size when EOF <= io_offset","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/iomap/buffered-io.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/iomap/buffered-io.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n1796"},{"label":"Upstream fix 55ec50d046c0","url":"https://git.kernel.org/stable/c/55ec50d046c03b3724741957f7b007856e36dbe7"}]},"size":{"status":"within-limit","patches":[{"sha":"55ec50d046c03b3724741957f7b007856e36dbe7","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/55ec50d046c03b3724741957f7b007856e36dbe7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72367","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72367.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72365","title":"netfs: Fix writethrough to use collection offload","status":"unfixed","project":false,"upstream":[{"sha":"ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4","url":"https://git.kernel.org/stable/c/ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72365","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72365.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72355","title":"netfs: Fix barriering when walking subrequest list","status":"unfixed","project":false,"upstream":[{"sha":"5c6ce05e406520290c1d89da97fb3cd70c09137d","url":"https://git.kernel.org/stable/c/5c6ce05e406520290c1d89da97fb3cd70c09137d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5c6ce05e406520290c1d89da97fb3cd70c09137d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/5c6ce05e406520290c1d89da97fb3cd70c09137d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72345","title":"net/mlx5: LAG, Fix off-by-one in single-FDB error rollback","status":"unknown","project":false,"upstream":[{"sha":"0f0e4ae6975c773f7854fc48932a267f6c79088f","url":"https://git.kernel.org/stable/c/0f0e4ae6975c773f7854fc48932a267f6c79088f"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"0f0e4ae6975c773f7854fc48932a267f6c79088f","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0f0e4ae6975c773f7854fc48932a267f6c79088f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72345","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72345.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72334","title":"Bluetooth: ISO: fix malformed ISO_END/CONT handling","status":"backported","project":true,"upstream":[{"sha":"e054c1a6ae7310d2815778fddb87da616e11c255","url":"https://git.kernel.org/stable/c/e054c1a6ae7310d2815778fddb87da616e11c255"}],"evidence":[{"url":"https://git.kernel.org/stable/c/49aeb54e3c912ef785311264a51ab9f3698e421b","label":"49aeb54e3c91","date":"2026-09-21T15:01:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e054c1a6ae7310d2815778fddb87da616e11c255","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72324","title":"gpio: mvebu: free generic chips on unbind","status":"backported","project":false,"upstream":[{"sha":"b11c513ad943f35cf5e8007d3a56279c79b7ed4b","url":"https://git.kernel.org/stable/c/b11c513ad943f35cf5e8007d3a56279c79b7ed4b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3649b04f86b95243fa0c845695051455fa2ba40b","label":"3649b04f86b9","date":"2026-07-24T16:11:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b11c513ad943f35cf5e8007d3a56279c79b7ed4b","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b11c513ad943f35cf5e8007d3a56279c79b7ed4b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72324","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72324.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72315","title":"smb: client: fix busy dentry warning on unmount after DIO","status":"backported","project":false,"upstream":[{"sha":"75f5c412fa867efa0bf9b646bffe0d912109e84a","url":"https://git.kernel.org/stable/c/75f5c412fa867efa0bf9b646bffe0d912109e84a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f7748b551010c021d92f0125e37f32ac0c376d8a","label":"f7748b551010","date":"2026-10-03T12:35:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"75f5c412fa867efa0bf9b646bffe0d912109e84a","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/75f5c412fa867efa0bf9b646bffe0d912109e84a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72203","title":"ntfs: skip extent mft records in writeback to prevent deadlock","status":"backported","project":false,"upstream":[{"sha":"76bc14c7097ff678b2b5dbfd4fa33b46897d87ce","url":"https://git.kernel.org/stable/c/76bc14c7097ff678b2b5dbfd4fa33b46897d87ce"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"76bc14c7097ff678b2b5dbfd4fa33b46897d87ce","lines":154,"reason":"","source":"https://github.com/torvalds/linux/commit/76bc14c7097ff678b2b5dbfd4fa33b46897d87ce.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72203","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72203.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72200","title":"ntfs: detect mapping-pairs LCN accumulator overflow","status":"backported","project":false,"upstream":[{"sha":"ec4f061f2219e0f0c6465d56d0380bf749235a53","url":"https://git.kernel.org/stable/c/ec4f061f2219e0f0c6465d56d0380bf749235a53"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ec4f061f2219e0f0c6465d56d0380bf749235a53","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/ec4f061f2219e0f0c6465d56d0380bf749235a53.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72200","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72200.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72198","title":"ntfs: reject non-resident records for resident-only attributes","status":"backported","project":false,"upstream":[{"sha":"097cdfd0a55df5af82c9753833f39a8bfadbcfcb","url":"https://git.kernel.org/stable/c/097cdfd0a55df5af82c9753833f39a8bfadbcfcb"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"097cdfd0a55df5af82c9753833f39a8bfadbcfcb","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/097cdfd0a55df5af82c9753833f39a8bfadbcfcb.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72198","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72198.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72073","title":"mmc: vub300: fix use-after-free on probe failure","status":"backported","project":false,"upstream":[{"sha":"a3b5f242997a3be7404112fd48784881560aea57","url":"https://git.kernel.org/stable/c/a3b5f242997a3be7404112fd48784881560aea57"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6c66653dac9b25272d5fd4ed42a34aa5249e16df","label":"6c66653dac9b","date":"2026-10-21T10:30:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a3b5f242997a3be7404112fd48784881560aea57","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/a3b5f242997a3be7404112fd48784881560aea57.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72042","title":"ipmi: Fix user refcount underflow in event delivery","status":"unfixed","project":false,"upstream":[{"sha":"6aa9e61c46465d231e9beddf56af7effd71be682","url":"https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6aa9e61c46465d231e9beddf56af7effd71be682","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/6aa9e61c46465d231e9beddf56af7effd71be682.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72042","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72042.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72028","title":"riscv: probes: save original sp in rethook trampoline","status":"backported","project":false,"upstream":[{"sha":"bc7b086a45521a986a49045907f017e3e46c763e","url":"https://git.kernel.org/stable/c/bc7b086a45521a986a49045907f017e3e46c763e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c386e1c591d72eab58ee2e69105c8cbc70928857","label":"c386e1c591d7","date":"2026-07-24T16:11:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"bc7b086a45521a986a49045907f017e3e46c763e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72009","title":"pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI","status":"backported","project":false,"upstream":[{"sha":"99611233f8cda833169fa6487d5dacdf189e5cb0","url":"https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/94b8a47f45f19c537964355fa539670631882b20","label":"94b8a47f45f1","date":"2026-10-21T10:31:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"99611233f8cda833169fa6487d5dacdf189e5cb0","lines":126,"reason":"","source":"https://github.com/torvalds/linux/commit/99611233f8cda833169fa6487d5dacdf189e5cb0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72009","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72009.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72007","title":"pmdomain: imx: Fix i.MX8MP VC8000E power up sequence","status":"backported","project":false,"upstream":[{"sha":"25e252bcf1593b420b12a7231d9dd64b885a2ae2","url":"https://git.kernel.org/stable/c/25e252bcf1593b420b12a7231d9dd64b885a2ae2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c498928f85651b56a4041ea165a22037eae69580","label":"c498928f8565","date":"2026-07-24T16:11:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"25e252bcf1593b420b12a7231d9dd64b885a2ae2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72007","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72007.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68480","title":"x86/bugs: Make Safe-RET robust against interrupt injection","status":"backported","project":false,"upstream":[{"sha":"7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9","url":"https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9"},{"sha":"52db77a13be224e09eb4ba6b4252ae8ab9085c2c","url":"https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c"},{"sha":"dfefa3c51370f84acb643cddf98bb42c885d0483","url":"https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9","lines":187,"reason":"","source":"https://github.com/torvalds/linux/commit/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9.patch"},{"sha":"52db77a13be224e09eb4ba6b4252ae8ab9085c2c","lines":190,"reason":"","source":"https://github.com/torvalds/linux/commit/52db77a13be224e09eb4ba6b4252ae8ab9085c2c.patch"},{"sha":"dfefa3c51370f84acb643cddf98bb42c885d0483","lines":190,"reason":"","source":"https://github.com/torvalds/linux/commit/dfefa3c51370f84acb643cddf98bb42c885d0483.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68480","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68480.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68471","title":"wifi: ieee80211: validate MLE common info length","status":"backported","project":false,"upstream":[{"sha":"293baeae9b2434a3e432629d7720b5603db2d77e","url":"https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/22941b5c5c46e61a7053e5f32f260f2bc39da617","label":"22941b5c5c46","date":"2026-10-21T10:30:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-68471","series":"6.12.y","upstream":["293baeae9b2434a3e432629d7720b5603db2d77e"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"The merged ieee80211_mle_size_ok check verifies common-info minimum length but not that it fits inside the supplied element length.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: include/linux/ieee80211.h","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/linux/ieee80211.h?id=e2acc2211022246c77740d5df08265cc27eedcc5#n5129"},{"label":"Upstream fix 293baeae9b24","url":"https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"}]},"size":{"status":"unknown","patches":[{"sha":"293baeae9b2434a3e432629d7720b5603db2d77e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68471","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68471.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68470","title":"wifi: mac80211: validate extension-frame layout before RX","status":"backported","project":false,"upstream":[{"sha":"57d503ce32eccfa7650065ca4c560f7e29a2e676","url":"https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7aba69b611007e11b9b93118ff8fe88998c3107f","label":"7aba69b61100","date":"2026-10-21T10:30:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"57d503ce32eccfa7650065ca4c560f7e29a2e676","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/57d503ce32eccfa7650065ca4c560f7e29a2e676.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68470","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68470.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68447","title":"drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size","status":"backported","project":false,"upstream":[{"sha":"426ffae6ecc7ec77d32bf8be065c21a1b881b084","url":"https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1218c6dcec80f886372635e82f3229d5babc37d3","label":"1218c6dcec80","date":"2026-10-21T10:30:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"426ffae6ecc7ec77d32bf8be065c21a1b881b084","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/426ffae6ecc7ec77d32bf8be065c21a1b881b084.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68447","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68447.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68421","title":"sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()","status":"backported","project":false,"upstream":[{"sha":"b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da","url":"https://git.kernel.org/stable/c/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6267ebee9f2f3e26f4968bf6dc29d350620fa320","label":"6267ebee9f2f","date":"2026-10-21T10:30:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-68421","series":"6.12.y","upstream":["b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"put_prev_task_scx enq-last WARN lacks sched_cpu_cookie_match exception","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/sched/ext.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/sched/ext.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n2223"},{"label":"Upstream fix b7d9c359e5cf","url":"https://git.kernel.org/stable/c/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da"}]},"size":{"status":"within-limit","patches":[{"sha":"b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68421","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68421.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68412","title":"wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()","status":"backported","project":false,"upstream":[{"sha":"c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6","url":"https://git.kernel.org/stable/c/c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f4114597b7949e90f4fa181342cf01400b8a5a75","label":"f4114597b794","date":"2026-10-21T10:30:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68412","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68412.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68391","title":"Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds","status":"backported","project":false,"upstream":[{"sha":"da55f570191d5d72f10c607a7043b947eb05ea46","url":"https://git.kernel.org/stable/c/da55f570191d5d72f10c607a7043b947eb05ea46"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f915e74b6f18293d1d69a2a3305ef321ff7c0172","label":"f915e74b6f18","date":"2026-08-03T11:17:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"da55f570191d5d72f10c607a7043b947eb05ea46","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68391","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68391.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68382","title":"drm/xe/guc: Hold device ref until queue teardown completes","status":"unfixed","project":false,"upstream":[{"sha":"9b7e60184f4b22e893d4ae95234d5f26261a430c","url":"https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"9b7e60184f4b22e893d4ae95234d5f26261a430c","lines":263,"reason":"","source":"https://github.com/torvalds/linux/commit/9b7e60184f4b22e893d4ae95234d5f26261a430c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68382","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68382.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68337","title":"bpf: Reject redirect helpers without a bpf_net_context","status":"backported","project":true,"upstream":[{"sha":"3f4920d165b29052255527d8ae7619e7ec132ece","url":"https://git.kernel.org/stable/c/3f4920d165b29052255527d8ae7619e7ec132ece"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0f2118b757509332bb0e65f90e5233766f14bb88","label":"0f2118b75750","date":"2026-09-21T15:01:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f4920d165b29052255527d8ae7619e7ec132ece","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/3f4920d165b29052255527d8ae7619e7ec132ece.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68303","title":"drm/vc4: hvs/v3d: Fix null dereference in unbind","status":"backported","project":true,"upstream":[{"sha":"7dc3680b7ffe01add3e9299fde8471d2dd53a8ae","url":"https://git.kernel.org/stable/c/7dc3680b7ffe01add3e9299fde8471d2dd53a8ae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8f62aae059e06746a18a00af27179c3c0f17f4c7","label":"8f62aae059e0","date":"2026-09-21T15:01:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7dc3680b7ffe01add3e9299fde8471d2dd53a8ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68303","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68303.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68290","title":"rds: tcp: unregister sysctl before tearing down listen socket","status":"backported","project":false,"upstream":[{"sha":"167e54c703ccd4fa028feb568b0d1002020cff86","url":"https://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86"}],"evidence":[{"url":"https://git.kernel.org/stable/c/80fffed08dc1c10e971066941d2daa56253f1552","label":"80fffed08dc1","date":"2026-08-03T11:17:15+02:00","lore":["https://lore.kernel.org/all/20260719203718.9680-1-blbllhy@gmail.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"167e54c703ccd4fa028feb568b0d1002020cff86","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/167e54c703ccd4fa028feb568b0d1002020cff86.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68290","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68290.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68289","title":"tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()","status":"backported","project":true,"upstream":[{"sha":"47f42ff521b4eeb46e82f9a46a4783a99f7570d7","url":"https://git.kernel.org/stable/c/47f42ff521b4eeb46e82f9a46a4783a99f7570d7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1b6066313b9b8fac870483bf7a26d6bd56579747","label":"1b6066313b9b","date":"2026-09-21T15:01:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"47f42ff521b4eeb46e82f9a46a4783a99f7570d7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68288","title":"net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD","status":"backported","project":true,"upstream":[{"sha":"5e9c8baee0329fbefe7c67aea945e2a07f15e98b","url":"https://git.kernel.org/stable/c/5e9c8baee0329fbefe7c67aea945e2a07f15e98b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/05173de42a9923a3eaadebcb0dd5bc83ffba174c","label":"05173de42a99","date":"2026-09-21T15:01:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5e9c8baee0329fbefe7c67aea945e2a07f15e98b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68287","title":"drop_monitor: fix size calculations for 64-bit attributes","status":"backported","project":true,"upstream":[{"sha":"7089f7ab99c89f443c92d8fcc585e63f2727f0b3","url":"https://git.kernel.org/stable/c/7089f7ab99c89f443c92d8fcc585e63f2727f0b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6048ed2dfb33426c8aef32f8d225ea91c66813db","label":"6048ed2dfb33","date":"2026-09-21T15:01:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7089f7ab99c89f443c92d8fcc585e63f2727f0b3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68287","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68287.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68286","title":"drop_monitor: perform u64_stats updates under IRQ-disabled section","status":"backported","project":true,"upstream":[{"sha":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","url":"https://git.kernel.org/stable/c/fd098a23bf8fda7eae48db9b06e7c34fc4d228fa"}],"evidence":[{"url":"https://git.kernel.org/stable/c/be9b121894d6ad44f0011f79543a2e3245979497","label":"be9b121894d6","date":"2026-09-21T15:01:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68286","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68286.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68245","title":"drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()","status":"backported","project":false,"upstream":[{"sha":"04cc4aa3617b0ed67e859f91f09de5d896a46f3a","url":"https://git.kernel.org/stable/c/04cc4aa3617b0ed67e859f91f09de5d896a46f3a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fe16a7e5336ae888751984e30c451fbf7cfa5df7","label":"fe16a7e5336a","date":"2026-08-03T11:17:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"04cc4aa3617b0ed67e859f91f09de5d896a46f3a","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/04cc4aa3617b0ed67e859f91f09de5d896a46f3a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68245","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68245.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68205","title":"media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()","status":"backported","project":false,"upstream":[{"sha":"06cb687a5132fcffe624c0070576ab852ac6b568","url":"https://git.kernel.org/stable/c/06cb687a5132fcffe624c0070576ab852ac6b568"}],"evidence":[{"url":"https://git.kernel.org/stable/c/caea6bc68c925d63ca33d21b2255f47181943d61","label":"caea6bc68c92","date":"2026-08-03T11:17:21+02:00","lore":["https://lore.kernel.org/linux-media/20240315073125.275501-2-sakari.ailus@linux.intel.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"06cb687a5132fcffe624c0070576ab852ac6b568","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/06cb687a5132fcffe624c0070576ab852ac6b568.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68205","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68205.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68161","title":"sctp: close UDP tunnel sockets during netns teardown","status":"backported","project":false,"upstream":[{"sha":"ffb2bd7ade36ec4da32c46a6eddbf4515316d08c","url":"https://git.kernel.org/stable/c/ffb2bd7ade36ec4da32c46a6eddbf4515316d08c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8ff78591d309c50a4fdab683b68dd8d512a270dd","label":"8ff78591d309","date":"2026-08-03T11:17:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ffb2bd7ade36ec4da32c46a6eddbf4515316d08c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68152","title":"amt: fix use-after-free in AMT delayed works","status":"backported","project":false,"upstream":[{"sha":"ea20c44935d6142daecfa9b39d635033a7553e1b","url":"https://git.kernel.org/stable/c/ea20c44935d6142daecfa9b39d635033a7553e1b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a46bfa01e01df0f6f6dc4b0be18db002d6d2dbd2","label":"a46bfa01e01d","date":"2026-08-03T11:17:25+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ea20c44935d6142daecfa9b39d635033a7553e1b","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/ea20c44935d6142daecfa9b39d635033a7553e1b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68152","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68152.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68112","title":"drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()","status":"backported","project":false,"upstream":[{"sha":"00f4050f7c367d7bdce347ca279ce467c434cf15","url":"https://git.kernel.org/stable/c/00f4050f7c367d7bdce347ca279ce467c434cf15"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cfb02825277526bd216b56be555a97a9e8612682","label":"cfb028252775","date":"2026-08-03T11:17:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00f4050f7c367d7bdce347ca279ce467c434cf15","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/00f4050f7c367d7bdce347ca279ce467c434cf15.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68112","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68112.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68103","title":"drm/amdgpu: reject mapping a reserved doorbell to a new queue","status":"not-applicable","project":false,"upstream":[{"sha":"a609b6278bf3cde17eeee6620091465521e4b02c","url":"https://git.kernel.org/stable/c/a609b6278bf3cde17eeee6620091465521e4b02c"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"a609b6278bf3cde17eeee6620091465521e4b02c","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a609b6278bf3cde17eeee6620091465521e4b02c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68097","title":"ksmbd: validate ACE size against SID sub-authorities","status":"backported","project":false,"upstream":[{"sha":"5152c6d49e3fd4e9f2e857c57527aead752f1f87","url":"https://git.kernel.org/stable/c/5152c6d49e3fd4e9f2e857c57527aead752f1f87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/62d80d7c2d9428085e7458ad4c06ca8c0984039b","label":"62d80d7c2d94","date":"2026-08-03T11:17:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5152c6d49e3fd4e9f2e857c57527aead752f1f87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68086","title":"mm/khugepaged: write all dirty file folios when collapsing","status":"unfixed","project":false,"upstream":[{"sha":"2dfe9f5c91d0963058f8a5e46e1c2a908382cc46","url":"https://git.kernel.org/stable/c/2dfe9f5c91d0963058f8a5e46e1c2a908382cc46"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2dfe9f5c91d0963058f8a5e46e1c2a908382cc46","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/2dfe9f5c91d0963058f8a5e46e1c2a908382cc46.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68086","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68086.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68085","title":"Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled","status":"backported","project":false,"upstream":[{"sha":"1b0d946d6f08bd39211385bc703a440911b41e46","url":"https://git.kernel.org/stable/c/1b0d946d6f08bd39211385bc703a440911b41e46"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d52446b3e735cfdbdc2a58342163803bc2e64249","label":"d52446b3e735","date":"2026-07-18T16:52:04+02:00","lore":["https://lore.kernel.org/linux-bluetooth/07e0a28650773abec711ee492fdb1bf5d21a6c98.camel@iki.fi/"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"1b0d946d6f08bd39211385bc703a440911b41e46","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/1b0d946d6f08bd39211385bc703a440911b41e46.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64525","title":"xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit","status":"backported","project":false,"upstream":[{"sha":"3e52417318473782012b236d0325bf7d2266a597","url":"https://git.kernel.org/stable/c/3e52417318473782012b236d0325bf7d2266a597"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bca6386dc08750fc7cdcbc7683473748ba3114b9","label":"bca6386dc087","date":"2026-06-09T12:25:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"3e52417318473782012b236d0325bf7d2266a597","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/3e52417318473782012b236d0325bf7d2266a597.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64525","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64525.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64520","title":"firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies","status":"unfixed","project":false,"upstream":[{"sha":"3974ea1938406f9bfa7c1f48d4e43533f447bb08","url":"https://git.kernel.org/stable/c/3974ea1938406f9bfa7c1f48d4e43533f447bb08"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3974ea1938406f9bfa7c1f48d4e43533f447bb08","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/3974ea1938406f9bfa7c1f48d4e43533f447bb08.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64520","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64520.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64513","title":"KVM: x86: Unconditionally recompute CR8 intercept on PPR update","status":"backported","project":false,"upstream":[{"sha":"bb365a506b1e6fb050c0fceaad354fe395385ef0","url":"https://git.kernel.org/stable/c/bb365a506b1e6fb050c0fceaad354fe395385ef0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a7277b66511983b57e345c0fba21f1810fd07c0f","label":"a7277b665119","date":"2026-10-21T10:30:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bb365a506b1e6fb050c0fceaad354fe395385ef0","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/bb365a506b1e6fb050c0fceaad354fe395385ef0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64513","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64513.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64481","title":"ALSA: hda/cs35l41: Fix firmware load work teardown","status":"backported","project":false,"upstream":[{"sha":"b65020d5398f499c09498c9786dba6d67ae57664","url":"https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8947215c0136c9d905e4a46d824824f8b48a2e5b","label":"8947215c0136","date":"2026-07-24T16:11:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"b65020d5398f499c09498c9786dba6d67ae57664","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64481","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64481.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64424","title":"netpoll: fix a use-after-free on shutdown path","status":"backported","project":false,"upstream":[{"sha":"45f1458a85017a023f138b22ac5c76abd477db42","url":"https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/95ecc5b58042f6b6743b589e6588f1cd7ba336aa","label":"95ecc5b58042","date":"2026-07-18T16:52:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"45f1458a85017a023f138b22ac5c76abd477db42","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/45f1458a85017a023f138b22ac5c76abd477db42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64305","title":"crypto: qat - protect service table iterations with service_lock","status":"backported","project":false,"upstream":[{"sha":"5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e","url":"https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/222fa7b453b612f4407f260146d89a2ce2bc831d","label":"222fa7b453b6","date":"2026-07-18T16:52:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64305","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64305.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64255","title":"wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers","status":"not-applicable","project":false,"upstream":[{"sha":"f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","url":"https://git.kernel.org/stable/c/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2"}],"evidence":[],"submission_lore":[],"basis":"The iwlwifi MLD aggregation/BA-session handlers changed upstream are absent from these targets.","review":{"id":"CVE-2026-64255","series":"6.12.y","upstream":["f056fc2b927448d37eca6b6cacc3d1b0f67b20d2"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"not-applicable","applicability":"unaffected","reason":"The iwlwifi MLD aggregation/BA-session handlers changed upstream are absent from these targets.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/net/wireless/intel/iwlwifi/mld/agg.c absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi?id=e2acc2211022246c77740d5df08265cc27eedcc5"},{"label":"Upstream fix f056fc2b9274","url":"https://git.kernel.org/stable/c/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2"}]},"size":{"status":"within-limit","patches":[{"sha":"f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64255","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64255.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64241","title":"gpio: rockchip: teardown bugs and resource leaks","status":"backported","project":false,"upstream":[{"sha":"9500077678230e36d22bf16d2b9539c13e59a801","url":"https://git.kernel.org/stable/c/9500077678230e36d22bf16d2b9539c13e59a801"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cdc603ce3118232712ba443dd8b414d8f25ca467","label":"cdc603ce3118","date":"2026-07-18T16:51:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9500077678230e36d22bf16d2b9539c13e59a801","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/9500077678230e36d22bf16d2b9539c13e59a801.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64241","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64241.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64212","title":"wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it","status":"not-applicable","project":false,"upstream":[{"sha":"d733ed481fd20a8e7bfe5119c4e77761ba3f87ee","url":"https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee"}],"evidence":[],"submission_lore":[],"basis":"The iwlwifi MLD remove-link implementation changed upstream is absent from this target; no corresponding remove-link path exists.","review":{"id":"CVE-2026-64212","series":"6.12.y","upstream":["d733ed481fd20a8e7bfe5119c4e77761ba3f87ee"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"not-applicable","applicability":"unaffected","reason":"The iwlwifi MLD remove-link implementation changed upstream is absent from this target; no corresponding remove-link path exists.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Tree inventory: drivers/net/wireless/intel/iwlwifi/mld/link.c absent","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi?id=e2acc2211022246c77740d5df08265cc27eedcc5"},{"label":"Upstream fix d733ed481fd2","url":"https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee"}]},"size":{"status":"within-limit","patches":[{"sha":"d733ed481fd20a8e7bfe5119c4e77761ba3f87ee","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64212","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64212.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64190","title":"net: team: fix NULL pointer dereference in team_xmit during mode change","status":"backported","project":false,"upstream":[{"sha":"25fe708bbc59289d3d1ea4b126fbc1b460a072a5","url":"https://git.kernel.org/stable/c/25fe708bbc59289d3d1ea4b126fbc1b460a072a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cde5c7f0286c4203d0abc7248201542aa8bf33bb","label":"cde5c7f0286c","date":"2026-10-21T10:30:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"25fe708bbc59289d3d1ea4b126fbc1b460a072a5","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64190","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64190.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64163","title":"test_kprobes: clear kprobes between test runs","status":"backported","project":false,"upstream":[{"sha":"ef5581bb30efb939cc2bf093475c6cc85258e5cd","url":"https://git.kernel.org/stable/c/ef5581bb30efb939cc2bf093475c6cc85258e5cd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/accc0004c501a9918313142282b094d408af06fb","label":"accc0004c501","date":"2026-06-01T17:46:25+02:00","lore":["https://lore.kernel.org/all/20260507134615.1010905-1-martin@kaiser.cx/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ef5581bb30efb939cc2bf093475c6cc85258e5cd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64163","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64163.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64160","title":"netfs: Fix potential for tearing in ->remote_i_size and ->zero_point","status":"unfixed","project":false,"upstream":[{"sha":"2c8f4742bb76117d735f92a3932d85239b16c494","url":"https://git.kernel.org/stable/c/2c8f4742bb76117d735f92a3932d85239b16c494"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2c8f4742bb76117d735f92a3932d85239b16c494","lines":953,"reason":"","source":"https://github.com/torvalds/linux/commit/2c8f4742bb76117d735f92a3932d85239b16c494.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64160","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64160.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64112","title":"rbd: eliminate a race in lock_dwork draining on unmap","status":"backported","project":false,"upstream":[{"sha":"9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90","url":"https://git.kernel.org/stable/c/9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3427d7ae38337066ce88b68302e285d344ab756b","label":"3427d7ae3833","date":"2026-06-01T17:46:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64112","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64112.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64109","title":"af_unix: Fix UAF read of tail->len in unix_stream_data_wait()","status":"backported","project":false,"upstream":[{"sha":"be309f8eae8b474a4a617eaae01324da996fc719","url":"https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719"}],"evidence":[{"url":"https://git.kernel.org/stable/c/38bccb927d83d7d52e5b20015a172a0b6101d11e","label":"38bccb927d83","date":"2026-06-01T17:46:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"be309f8eae8b474a4a617eaae01324da996fc719","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/be309f8eae8b474a4a617eaae01324da996fc719.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64109","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64109.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64082","title":"riscv: Fix register corruption from uninitialized cregs on error","status":"backported","project":false,"upstream":[{"sha":"6ebcbb53fc9bc30843054ed99fd60b8e542628f4","url":"https://git.kernel.org/stable/c/6ebcbb53fc9bc30843054ed99fd60b8e542628f4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2a7d1daf2674fe7d5b1cc99a4e3b5f0f72d5958f","label":"2a7d1daf2674","date":"2026-09-02T14:30:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6ebcbb53fc9bc30843054ed99fd60b8e542628f4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64082","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64082.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64079","title":"netfilter: x_tables: allocate hook ops while under mutex","status":"backported","project":false,"upstream":[{"sha":"b62eb8dcf2c47d4d676a434efbd57c4f776f7829","url":"https://git.kernel.org/stable/c/b62eb8dcf2c47d4d676a434efbd57c4f776f7829"}],"evidence":[{"url":"https://git.kernel.org/stable/c/693bffd742dd4fa9a0076ed120545af3679c588b","label":"693bffd742dd","date":"2026-10-21T10:30:30+02:00","lore":["https://lore.kernel.org/netfilter-devel/20260429175613.1459342-1-tristmd@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"b62eb8dcf2c47d4d676a434efbd57c4f776f7829","lines":271,"reason":"","source":"https://github.com/torvalds/linux/commit/b62eb8dcf2c47d4d676a434efbd57c4f776f7829.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64078","title":"netfilter: x_tables: add and use xtables_unregister_table_exit","status":"unfixed","project":false,"upstream":[{"sha":"b4597d5fd7d2f8cebfffd40dffb5e003cc78964c","url":"https://git.kernel.org/stable/c/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"b4597d5fd7d2f8cebfffd40dffb5e003cc78964c","lines":246,"reason":"","source":"https://github.com/torvalds/linux/commit/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64078","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64078.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64070","title":"powerpc/hv-gpci: fix preempt count leak in sysfs show paths","status":"backported","project":false,"upstream":[{"sha":"dbc30a57bd8e026995e9fa8e8c31cffd18542c01","url":"https://git.kernel.org/stable/c/dbc30a57bd8e026995e9fa8e8c31cffd18542c01"}],"evidence":[{"url":"https://git.kernel.org/stable/c/45afabe7f99c5d8746434ee41c86584c01d70147","label":"45afabe7f99c","date":"2026-09-02T14:30:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"dbc30a57bd8e026995e9fa8e8c31cffd18542c01","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64070","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64070.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64068","title":"netfs: Fix missing locking around retry adding new subreqs","status":"backported","project":false,"upstream":[{"sha":"cce18c263e9623872327ba3c956012f73c1179cc","url":"https://git.kernel.org/stable/c/cce18c263e9623872327ba3c956012f73c1179cc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f59c4ec86ef3a9ac99706ae163a38ec28129fd76","label":"f59c4ec86ef3","date":"2026-10-21T10:30:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"cce18c263e9623872327ba3c956012f73c1179cc","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64068","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64068.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64067","title":"netfs: Fix missing barriers when accessing stream->subrequests locklessly","status":"unfixed","project":false,"upstream":[{"sha":"b5782e2d462c028096f922abca46318cec890670","url":"https://git.kernel.org/stable/c/b5782e2d462c028096f922abca46318cec890670"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5782e2d462c028096f922abca46318cec890670","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/b5782e2d462c028096f922abca46318cec890670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64067","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64067.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64066","title":"netfs: Fix netfs_read_to_pagecache() to pause on subreq failure","status":"unfixed","project":false,"upstream":[{"sha":"8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4","url":"https://git.kernel.org/stable/c/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64066","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64066.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64060","title":"netfs: Fix leak of request in netfs_write_begin() error handling","status":"backported","project":false,"upstream":[{"sha":"5046a34f0643441f05b0253ea64e1a3af87efe14","url":"https://git.kernel.org/stable/c/5046a34f0643441f05b0253ea64e1a3af87efe14"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9192f304379187b396d56d6a1a406712c6bfa5a3","label":"9192f3043791","date":"2026-10-21T10:30:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5046a34f0643441f05b0253ea64e1a3af87efe14","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/5046a34f0643441f05b0253ea64e1a3af87efe14.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64060","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64060.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64026","title":"rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg","status":"backported","project":false,"upstream":[{"sha":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","url":"https://git.kernel.org/stable/c/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5","label":"b94a6ccbaf11","date":"2026-06-09T12:26:02+02:00","lore":["https://lore.kernel.org/r/afKV2zGR6rrelPC7@v4bel/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","lines":534,"reason":"","source":"https://github.com/torvalds/linux/commit/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64017","title":"blk-mq: pop cached request if it is usable","status":"backported","project":false,"upstream":[{"sha":"dc278e9bf2b9513a763353e6b9cc21e0f532954e","url":"https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/23d8ea1e303b5f32d883757a4a707e791dbc9808","label":"23d8ea1e303b","date":"2026-08-19T18:14:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"dc278e9bf2b9513a763353e6b9cc21e0f532954e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64001","title":"ALSA: pcm: oss: Fix setup list UAF on proc write error","status":"backported","project":false,"upstream":[{"sha":"4cc54bdd54b337e77115be5b55577d1c58608eae","url":"https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8be4efd0dc0093eb7a02ad1aac936bca2a1f04ce","label":"8be4efd0dc00","date":"2026-06-09T12:25:39+02:00","lore":["https://lore.kernel.org/all/6a1062b7.170a0220.35b2b7.0003.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4cc54bdd54b337e77115be5b55577d1c58608eae","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/4cc54bdd54b337e77115be5b55577d1c58608eae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64001","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64001.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63999","title":"ethtool: rss: fix indir_table and hkey leak on get_rxfh failure","status":"backported","project":false,"upstream":[{"sha":"266297692f97008ca48bc311775c087c59bd7fe3","url":"https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/323faef6366349f57d4ad67d318a0c8906e360b3","label":"323faef63663","date":"2026-10-21T10:30:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"266297692f97008ca48bc311775c087c59bd7fe3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/266297692f97008ca48bc311775c087c59bd7fe3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63983","title":"net/sched: fix packet loop on netem when duplicate is on","status":"backported","project":false,"upstream":[{"sha":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","url":"https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1a298a514ce766c6d0c232991a390fec67af81ad","label":"1a298a514ce7","date":"2026-06-09T12:25:42+02:00","lore":["https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/9552b11e3edabc97cfcd9f29103d5afbce7ae183.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63983","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63983.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63977","title":"dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work","status":"not-applicable","project":false,"upstream":[{"sha":"d733f519f6443540f8359461a34e3b0042099bbe","url":"https://git.kernel.org/stable/c/d733f519f6443540f8359461a34e3b0042099bbe"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"d733f519f6443540f8359461a34e3b0042099bbe","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/d733f519f6443540f8359461a34e3b0042099bbe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63977","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63977.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63959","title":"usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT","status":"backported","project":false,"upstream":[{"sha":"aa2f716327be1818e1cb156da8a2844804aaec2f","url":"https://git.kernel.org/stable/c/aa2f716327be1818e1cb156da8a2844804aaec2f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dc17721d42e6d89f63572e63add8306a0e15eb3c","label":"dc17721d42e6","date":"2026-06-09T12:25:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"aa2f716327be1818e1cb156da8a2844804aaec2f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63959","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63959.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63941","title":"KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor","status":"unfixed","project":false,"upstream":[{"sha":"83726330748981372bde86ed5411d7b306612991","url":"https://git.kernel.org/stable/c/83726330748981372bde86ed5411d7b306612991"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"83726330748981372bde86ed5411d7b306612991","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/83726330748981372bde86ed5411d7b306612991.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63941","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63941.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63871","title":"Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls","status":"backported","project":false,"upstream":[{"sha":"9ca7053d6215d89c33f28893bfd1625a32919d3f","url":"https://git.kernel.org/stable/c/9ca7053d6215d89c33f28893bfd1625a32919d3f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9798f7d41d85ff763afd1f1cc0533b5c416c8348","label":"9798f7d41d85","date":"2026-06-19T13:42:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"9ca7053d6215d89c33f28893bfd1625a32919d3f","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/9ca7053d6215d89c33f28893bfd1625a32919d3f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63871","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63871.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63858","title":"netfilter: nf_tables: add hook transactions for device deletions","status":"unfixed","project":false,"upstream":[{"sha":"10f79dbd7719d1da9f5884d13060322d8729f091","url":"https://git.kernel.org/stable/c/10f79dbd7719d1da9f5884d13060322d8729f091"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"10f79dbd7719d1da9f5884d13060322d8729f091","lines":525,"reason":"","source":"https://github.com/torvalds/linux/commit/10f79dbd7719d1da9f5884d13060322d8729f091.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63858","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63858.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63839","title":"platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()","status":"not-applicable","project":false,"upstream":[{"sha":"0c3887a134f191723b53e2a47e501b534c8723ee","url":"https://git.kernel.org/stable/c/0c3887a134f191723b53e2a47e501b534c8723ee"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"0c3887a134f191723b53e2a47e501b534c8723ee","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63839","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63839.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63819","title":"f2fs: fix to do sanity check on f2fs_get_node_folio_ra()","status":"unfixed","project":false,"upstream":[{"sha":"8712353ed80f87271d732297567dcdbe4b84e8c7","url":"https://git.kernel.org/stable/c/8712353ed80f87271d732297567dcdbe4b84e8c7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8712353ed80f87271d732297567dcdbe4b84e8c7","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8712353ed80f87271d732297567dcdbe4b84e8c7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63819","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63819.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63816","title":"f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode","status":"backported","project":false,"upstream":[{"sha":"e0288584baa5dc41df4a829a023c4c1b33fe53d7","url":"https://git.kernel.org/stable/c/e0288584baa5dc41df4a829a023c4c1b33fe53d7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/56038756aae68312df00d4aa1d97e51ef3aca725","label":"56038756aae6","date":"2026-07-18T16:51:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"e0288584baa5dc41df4a829a023c4c1b33fe53d7","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/e0288584baa5dc41df4a829a023c4c1b33fe53d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63816","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63816.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63805","title":"crypto: nx - fix nx_crypto_ctx_exit argument","status":"unfixed","project":false,"upstream":[{"sha":"4e67f504ee9ded15e256b64f4fde150e917381d7","url":"https://git.kernel.org/stable/c/4e67f504ee9ded15e256b64f4fde150e917381d7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4e67f504ee9ded15e256b64f4fde150e917381d7","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/4e67f504ee9ded15e256b64f4fde150e917381d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63805","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63805.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53368","title":"f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage","status":"backported","project":false,"upstream":[{"sha":"019f9dda7f66e55eb94cd32e1d3fff5835f73fbc","url":"https://git.kernel.org/stable/c/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/270c519bca3a59b6140d176415aff16e4e06f9e3","label":"270c519bca3a","date":"2026-10-21T10:30:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"019f9dda7f66e55eb94cd32e1d3fff5835f73fbc","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53368","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53368.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53313","title":"drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths","status":"backported","project":false,"upstream":[{"sha":"4ae3e16f4b3bf64140f773629b765d605ee079a9","url":"https://git.kernel.org/stable/c/4ae3e16f4b3bf64140f773629b765d605ee079a9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a71fdbd6e8289e2725d33a9873833459f3b1824f","label":"a71fdbd6e828","date":"2026-09-07T17:17:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"4ae3e16f4b3bf64140f773629b765d605ee079a9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53285","title":"drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED","status":"backported","project":false,"upstream":[{"sha":"183182235f6d53bac62c6c39014738a54a68dfa6","url":"https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/19e82047cb68bcde55791ee20178acd431609b8d","label":"19e82047cb68","date":"2026-10-21T10:30:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"183182235f6d53bac62c6c39014738a54a68dfa6","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/183182235f6d53bac62c6c39014738a54a68dfa6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53285","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53285.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53246","title":"sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing","status":"unfixed","project":false,"upstream":[{"sha":"0861615c28de668669d748ef4eb913ea9262d13b","url":"https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0861615c28de668669d748ef4eb913ea9262d13b","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/0861615c28de668669d748ef4eb913ea9262d13b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53246","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53246.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53226","title":"gpio: rockchip: fix generic IRQ chip leak on remove","status":"backported","project":false,"upstream":[{"sha":"1c1e0fc88d6ef65bf15d517853251f75ab9d18c3","url":"https://git.kernel.org/stable/c/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/50c7a6d2bf179588ba2daee97be93d19c96a94af","label":"50c7a6d2bf17","date":"2026-07-18T16:51:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c1e0fc88d6ef65bf15d517853251f75ab9d18c3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53226","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53226.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53185","title":"zram: fix use-after-free in zram_bvec_write_partial()","status":"backported","project":false,"upstream":[{"sha":"732fd9f0b9c1cdc6dfd77162ded60df005182cc0","url":"https://git.kernel.org/stable/c/732fd9f0b9c1cdc6dfd77162ded60df005182cc0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/77a602b505ce4802915853cfc435a4722fab3e64","label":"77a602b505ce","date":"2026-06-19T13:42:30+02:00","lore":["https://lore.kernel.org/20260528-zram-v3-1-cab86eef8764@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"732fd9f0b9c1cdc6dfd77162ded60df005182cc0","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/732fd9f0b9c1cdc6dfd77162ded60df005182cc0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53185","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53185.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53179","title":"staging: rtl8723bs: fix buffer over-read in rtw_update_protection","status":"backported","project":false,"upstream":[{"sha":"514ab98364595007d4557ecc85d7e5f012c504d3","url":"https://git.kernel.org/stable/c/514ab98364595007d4557ecc85d7e5f012c504d3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c35ce55b12bb8fcd365daeb516e9782048119b36","label":"c35ce55b12bb","date":"2026-07-04T13:43:26+02:00","lore":["https://lore.kernel.org/linux-staging/DI2H39EAAFBZ.3KI5NWN02AQ2S@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"514ab98364595007d4557ecc85d7e5f012c504d3","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/514ab98364595007d4557ecc85d7e5f012c504d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53179","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53179.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53178","title":"staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction","status":"backported","project":false,"upstream":[{"sha":"88e994c57a79f62d5338231d8d37ee8dd98baffe","url":"https://git.kernel.org/stable/c/88e994c57a79f62d5338231d8d37ee8dd98baffe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8863ac3a4fedf86b0ef5b8ecc37fbaa52f2a8160","label":"8863ac3a4fed","date":"2026-10-21T10:30:27+02:00","lore":["https://lore.kernel.org/linux-staging/DI2H39EAAFBZ.3KI5NWN02AQ2S@linux.dev/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"88e994c57a79f62d5338231d8d37ee8dd98baffe","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/88e994c57a79f62d5338231d8d37ee8dd98baffe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53178","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53178.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53156","title":"nvmem: core: fix use-after-free bugs in error paths","status":"backported","project":false,"upstream":[{"sha":"5b6b6fc491899d583eaa75344e094796ae9b530b","url":"https://git.kernel.org/stable/c/5b6b6fc491899d583eaa75344e094796ae9b530b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e0d38bf47a72da2f02c9fa6f752cd66d977cd7f7","label":"e0d38bf47a72","date":"2026-06-19T13:42:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5b6b6fc491899d583eaa75344e094796ae9b530b","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/5b6b6fc491899d583eaa75344e094796ae9b530b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53156","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53156.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53143","title":"drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11","status":"backported","project":false,"upstream":[{"sha":"352ea59028ea48a6fff77f19ae28f98f71946a80","url":"https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2c5b66c9b4057b385566940935ebc32f6e6ebfd2","label":"2c5b66c9b405","date":"2026-06-19T13:42:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"352ea59028ea48a6fff77f19ae28f98f71946a80","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/352ea59028ea48a6fff77f19ae28f98f71946a80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53143","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53143.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53132","title":"vsock/virtio: fix potential unbounded skb queue","status":"backported","project":false,"upstream":[{"sha":"059b7dbd20a6f0c539a45ddff1573cb8946685b5","url":"https://git.kernel.org/stable/c/059b7dbd20a6f0c539a45ddff1573cb8946685b5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1eca304f97a34ed5e921e1f0e06c8b241f25bf12","label":"1eca304f97a3","date":"2026-06-19T13:42:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"059b7dbd20a6f0c539a45ddff1573cb8946685b5","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/059b7dbd20a6f0c539a45ddff1573cb8946685b5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53132","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53132.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53123","title":"md: wake raid456 reshape waiters before suspend","status":"backported","project":false,"upstream":[{"sha":"cf86bb53b9c92354904a328e947a05ffbfdd1840","url":"https://git.kernel.org/stable/c/cf86bb53b9c92354904a328e947a05ffbfdd1840"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8b6a72420821e6da2cab6a69d5233500d2698b93","label":"8b6a72420821","date":"2026-05-23T13:04:20+02:00","lore":["https://lore.kernel.org/linux-raid/20260327140729.2030564-1-yukuai@fnnas.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf86bb53b9c92354904a328e947a05ffbfdd1840","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/cf86bb53b9c92354904a328e947a05ffbfdd1840.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53120","title":"PCI: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"10a4206a24013be4d558d476010cbf2eb4c9fa64","url":"https://git.kernel.org/stable/c/10a4206a24013be4d558d476010cbf2eb4c9fa64"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dfe950d9464cad609f3b118c6203e2708055bc61","label":"dfe950d9464c","date":"2026-05-23T13:04:20+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"10a4206a24013be4d558d476010cbf2eb4c9fa64","lines":131,"reason":"","source":"https://github.com/torvalds/linux/commit/10a4206a24013be4d558d476010cbf2eb4c9fa64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53120","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53120.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53118","title":"vdpa: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"85bb534ff12aab6916058897b39c748940a7a4c6","url":"https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4eab1a74a498f0bf19f102f9362e9deef9307aea","label":"4eab1a74a498","date":"2026-10-21T10:30:27+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"85bb534ff12aab6916058897b39c748940a7a4c6","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/85bb534ff12aab6916058897b39c748940a7a4c6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53117","title":"s390/cio: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4","url":"https://git.kernel.org/stable/c/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/106d594711e97762788046c5bbb94f580abc4bf4","label":"106d594711e9","date":"2026-05-23T13:04:20+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53117","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53117.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53115","title":"bus: fsl-mc: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"6c8dfb0362732bf1e4829867a2a5239fedc592d0","url":"https://git.kernel.org/stable/c/6c8dfb0362732bf1e4829867a2a5239fedc592d0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4911b836f35c034c36f102db4ecbe339b38e7d1d","label":"4911b836f35c","date":"2026-05-23T13:04:20+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6c8dfb0362732bf1e4829867a2a5239fedc592d0","lines":99,"reason":"","source":"https://github.com/torvalds/linux/commit/6c8dfb0362732bf1e4829867a2a5239fedc592d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53113","title":"wifi: ath11k: fix memory leaks in beacon template setup","status":"backported","project":true,"upstream":[{"sha":"ff49eba595df500e4ddccc593088c8a4ab5f2c27","url":"https://git.kernel.org/stable/c/ff49eba595df500e4ddccc593088c8a4ab5f2c27"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9478aa5b39e986d45fafe279c24d3546783c22b1","label":"9478aa5b39e9","date":"2026-09-07T17:17:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ff49eba595df500e4ddccc593088c8a4ab5f2c27","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53113","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53113.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53107","title":"wifi: libertas: don't kill URBs in interrupt context","status":"unfixed","project":false,"upstream":[{"sha":"7c5c2b661bdb78c1472b8833265c9ed1ee880039","url":"https://git.kernel.org/stable/c/7c5c2b661bdb78c1472b8833265c9ed1ee880039"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c5c2b661bdb78c1472b8833265c9ed1ee880039","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/7c5c2b661bdb78c1472b8833265c9ed1ee880039.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53107","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53107.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53106","title":"bpf: Do not allow deleting local storage in NMI","status":"unfixed","project":false,"upstream":[{"sha":"350de5b8a9befaa2a68861c51f671d4f5f751ca5","url":"https://git.kernel.org/stable/c/350de5b8a9befaa2a68861c51f671d4f5f751ca5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"350de5b8a9befaa2a68861c51f671d4f5f751ca5","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/350de5b8a9befaa2a68861c51f671d4f5f751ca5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53106","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53106.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53102","title":"wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()","status":"backported","project":true,"upstream":[{"sha":"c41075ce8cf05ed8c0e7b7efef000dce548ffc42","url":"https://git.kernel.org/stable/c/c41075ce8cf05ed8c0e7b7efef000dce548ffc42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7de35b99503012e57bec027e98ed53f881518b5b","label":"7de35b995030","date":"2026-09-07T17:17:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"c41075ce8cf05ed8c0e7b7efef000dce548ffc42","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53091","title":"net: pull headers in qdisc_pkt_len_segs_init()","status":"backported","project":false,"upstream":[{"sha":"7fb4c19670110f052c04e1ec1d2b953b9f4f57e4","url":"https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7564dc804d8289d2e5c6edb8173754051b71bff4","label":"7564dc804d82","date":"2026-10-21T10:30:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"7fb4c19670110f052c04e1ec1d2b953b9f4f57e4","lines":118,"reason":"","source":"https://github.com/torvalds/linux/commit/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53091","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53091.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53089","title":"bpf: Fix use-after-free in offloaded map/prog info fill","status":"backported","project":false,"upstream":[{"sha":"a0c584fc18056709c8e047a82a6045d6c209f4ce","url":"https://git.kernel.org/stable/c/a0c584fc18056709c8e047a82a6045d6c209f4ce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1a2dc103e16448d022a77ad5fc3234641436c4b7","label":"1a2dc103e164","date":"2026-09-02T14:30:58+02:00","lore":["https://lore.kernel.org/bpf/f0aa3678-79c9-47ae-9e8c-02a3d1df160a@hust.edu.cn/","https://lore.kernel.org/r/20260409023733.168050-1-jiayuan.chen@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a0c584fc18056709c8e047a82a6045d6c209f4ce","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53078","title":"bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops","status":"backported","project":false,"upstream":[{"sha":"10f86a2a5c91fc4c4d001960f1c21abe52545ef6","url":"https://git.kernel.org/stable/c/10f86a2a5c91fc4c4d001960f1c21abe52545ef6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2a2c98141e0a75f2d4a7d78b0316c88b3da784ac","label":"2a2c98141e0a","date":"2026-08-03T11:17:29+02:00","lore":["https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"10f86a2a5c91fc4c4d001960f1c21abe52545ef6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53078","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53078.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53070","title":"sctp: disable BH before calling udp_tunnel_xmit_skb()","status":"backported","project":false,"upstream":[{"sha":"2cd7e6971fc2787408ceef17906ea152791448cf","url":"https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c","label":"be3bfcb34bda","date":"2026-07-04T13:43:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2cd7e6971fc2787408ceef17906ea152791448cf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53070","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53070.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53024","title":"greybus: raw: fix use-after-free if write is called after disconnect","status":"backported","project":false,"upstream":[{"sha":"84265cbd96b97058ef67e3f8be3933667a000835","url":"https://git.kernel.org/stable/c/84265cbd96b97058ef67e3f8be3933667a000835"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2b46f07913a80521ecfe60b229c84bdd7dfb15ab","label":"2b46f07913a8","date":"2026-10-21T10:31:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"84265cbd96b97058ef67e3f8be3933667a000835","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/84265cbd96b97058ef67e3f8be3933667a000835.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53024","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53024.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53015","title":"erofs: unify lcn as u64 for 32-bit platforms","status":"backported","project":false,"upstream":[{"sha":"2d8c7edcb661812249469f4a5b62e9339118846f","url":"https://git.kernel.org/stable/c/2d8c7edcb661812249469f4a5b62e9339118846f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4fc9b12e43a3f19a01a8fb61f7961be79de20253","label":"4fc9b12e43a3","date":"2026-05-23T13:04:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2d8c7edcb661812249469f4a5b62e9339118846f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53010","title":"ksmbd: fix use-after-free in smb2_open during durable reconnect","status":"backported","project":true,"upstream":[{"sha":"1baff47b81f94f9231c91236aa511420d0e266b9","url":"https://git.kernel.org/stable/c/1baff47b81f94f9231c91236aa511420d0e266b9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4db3dcac84c2f14a45ae201efb38de1fb1bfc009","label":"4db3dcac84c2","date":"2026-09-14T13:31:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1baff47b81f94f9231c91236aa511420d0e266b9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52994","title":"vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting","status":"unfixed","project":false,"upstream":[{"sha":"1cb36e252211506f51095fe7ced8286cc77b4c80","url":"https://git.kernel.org/stable/c/1cb36e252211506f51095fe7ced8286cc77b4c80"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1cb36e252211506f51095fe7ced8286cc77b4c80","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/1cb36e252211506f51095fe7ced8286cc77b4c80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52994","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52994.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52961","title":"ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size","status":"backported","project":false,"upstream":[{"sha":"0c22d9511cbde746622f8e4c11aaa63fe76d45f9","url":"https://git.kernel.org/stable/c/0c22d9511cbde746622f8e4c11aaa63fe76d45f9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7eb72425c4e3234926502eb262f9d6193ccd572c","label":"7eb72425c4e3","date":"2026-05-23T13:04:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0c22d9511cbde746622f8e4c11aaa63fe76d45f9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52960","title":"ceph: put folios not suitable for writeback","status":"unfixed","project":false,"upstream":[{"sha":"544576f0f05c4a759806acddfaaeb686f14fb4b0","url":"https://git.kernel.org/stable/c/544576f0f05c4a759806acddfaaeb686f14fb4b0"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"544576f0f05c4a759806acddfaaeb686f14fb4b0","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/544576f0f05c4a759806acddfaaeb686f14fb4b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52960","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52960.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52953","title":"iommu/vt-d: Fix oops due to out of scope access","status":"unfixed","project":false,"upstream":[{"sha":"a6dea58d8625c06b9654c0555f101742481335c3","url":"https://git.kernel.org/stable/c/a6dea58d8625c06b9654c0555f101742481335c3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6dea58d8625c06b9654c0555f101742481335c3","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a6dea58d8625c06b9654c0555f101742481335c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52953","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52953.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52944","title":"ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE","status":"backported","project":true,"upstream":[{"sha":"cc57232cae23c0df91b4a59d0f519141ce9b5b02","url":"https://git.kernel.org/stable/c/cc57232cae23c0df91b4a59d0f519141ce9b5b02"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c5ab11263e3c89aa7989afc5374ef7743e092fd0","label":"c5ab11263e3c","date":"2026-09-14T13:31:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"cc57232cae23c0df91b4a59d0f519141ce9b5b02","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46317","title":"KVM: arm64: Reassign nested_mmus array behind mmu_lock","status":"unfixed","project":false,"upstream":[{"sha":"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8","url":"https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46314","title":"drm/v3d: Reject empty multisync extension to prevent infinite loop","status":"unfixed","project":false,"upstream":[{"sha":"fb44d589bf3148e13452185a6e772a7efbf2d684","url":"https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb44d589bf3148e13452185a6e772a7efbf2d684","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/fb44d589bf3148e13452185a6e772a7efbf2d684.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46314","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46314.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46282","title":"iio: frequency: admv1013: fix NULL pointer dereference on str","status":"backported","project":false,"upstream":[{"sha":"aac0a51b16700b403a55b67ba495de021db78763","url":"https://git.kernel.org/stable/c/aac0a51b16700b403a55b67ba495de021db78763"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3a9d8ec2051c2d80158ed7bded5e158c42870037","label":"3a9d8ec2051c","date":"2026-05-07T06:09:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aac0a51b16700b403a55b67ba495de021db78763","lines":93,"reason":"","source":"https://github.com/torvalds/linux/commit/aac0a51b16700b403a55b67ba495de021db78763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46282","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46282.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46279","title":"mm/alloc_tag: clear codetag for pages allocated before page_ext initialization","status":"unfixed","project":false,"upstream":[{"sha":"6b1842775a460245e97d36d3a67d0cfba7c4ff79","url":"https://git.kernel.org/stable/c/6b1842775a460245e97d36d3a67d0cfba7c4ff79"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"6b1842775a460245e97d36d3a67d0cfba7c4ff79","lines":162,"reason":"","source":"https://github.com/torvalds/linux/commit/6b1842775a460245e97d36d3a67d0cfba7c4ff79.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46279","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46279.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46274","title":"io-wq: check that the predecessor is hashed in io_wq_remove_pending()","status":"backported","project":false,"upstream":[{"sha":"d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc","url":"https://git.kernel.org/stable/c/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5a20ebf0c81b61f5ea3b1b529c100cad69b9f603","label":"5a20ebf0c81b","date":"2026-05-23T13:05:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46274","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46274.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46254","title":"AppArmor: Allow apparmor to handle unaligned dfa tables","status":"backported","project":false,"upstream":[{"sha":"64802f731214a51dfe3c6c27636b3ddafd003eb0","url":"https://git.kernel.org/stable/c/64802f731214a51dfe3c6c27636b3ddafd003eb0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ec737e7fdf2f0ba7b203d4ec72cc915978b10e7e","label":"ec737e7fdf2f","date":"2026-03-04T07:20:40-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"64802f731214a51dfe3c6c27636b3ddafd003eb0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46254","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46254.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46245","title":"drm/amd/display: Fix dc_link NULL handling in HPD init","status":"backported","project":false,"upstream":[{"sha":"226a40c06a183abaeb7529a4f54d6c203bd14407","url":"https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0965f1e775130e325e74152d867d2e8ce865fa05","label":"0965f1e77513","date":"2026-10-21T10:30:25+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"226a40c06a183abaeb7529a4f54d6c203bd14407","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/226a40c06a183abaeb7529a4f54d6c203bd14407.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46245","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46245.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46157","title":"ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger","status":"backported","project":false,"upstream":[{"sha":"901ac0ff15edf9503162e2cf6579bd11a30f1ed4","url":"https://git.kernel.org/stable/c/901ac0ff15edf9503162e2cf6579bd11a30f1ed4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/49f9d048845be874df7997e4b1ce662de450c4b6","label":"49f9d048845b","date":"2026-05-14T15:29:19+02:00","lore":["https://lore.kernel.org/20260423145330.210035-1-jjy600901@snu.ac.kr"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"901ac0ff15edf9503162e2cf6579bd11a30f1ed4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46157","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46157.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46153","title":"8021q: delete cleared egress QoS mappings","status":"unfixed","project":false,"upstream":[{"sha":"7dddc74af369478ba7f9bc136d0fc1dc4570cb66","url":"https://git.kernel.org/stable/c/7dddc74af369478ba7f9bc136d0fc1dc4570cb66"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7dddc74af369478ba7f9bc136d0fc1dc4570cb66","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7dddc74af369478ba7f9bc136d0fc1dc4570cb66.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46153","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46153.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46147","title":"KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()","status":"unfixed","project":false,"upstream":[{"sha":"73b9c1e5da84cd69b1a86e374e450817cd051371","url":"https://git.kernel.org/stable/c/73b9c1e5da84cd69b1a86e374e450817cd051371"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"73b9c1e5da84cd69b1a86e374e450817cd051371","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/73b9c1e5da84cd69b1a86e374e450817cd051371.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46147","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46147.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46130","title":"dm-verity-fec: fix reading parity bytes split across blocks (take 3)","status":"backported","project":false,"upstream":[{"sha":"430a05cb926f6bdf53e81460a2c3a553257f3f61","url":"https://git.kernel.org/stable/c/430a05cb926f6bdf53e81460a2c3a553257f3f61"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dac69d1b76049d7e5f565089a6a7f4502a85b9de","label":"dac69d1b7604","date":"2026-10-21T10:30:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"over-limit","patches":[{"sha":"430a05cb926f6bdf53e81460a2c3a553257f3f61","lines":129,"reason":"","source":"https://github.com/torvalds/linux/commit/430a05cb926f6bdf53e81460a2c3a553257f3f61.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46130","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46130.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46096","title":"tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()","status":"unfixed","project":false,"upstream":[{"sha":"f0f75a3d98b7959a8677b6363e23190f3018636b","url":"https://git.kernel.org/stable/c/f0f75a3d98b7959a8677b6363e23190f3018636b"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0f75a3d98b7959a8677b6363e23190f3018636b","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/f0f75a3d98b7959a8677b6363e23190f3018636b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46096","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46096.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46068","title":"crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx","status":"backported","project":false,"upstream":[{"sha":"adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c","url":"https://git.kernel.org/stable/c/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/910bb34b801d39794e656f7d48414844b2bd354e","label":"910bb34b801d","date":"2026-05-14T15:29:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46068","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46068.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46054","title":"selinux: fix overlayfs mmap() and mprotect() access checks","status":"backported","project":false,"upstream":[{"sha":"82544d36b1729153c8aeb179e84750f0c085d3b1","url":"https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8bacd09f12c27710228562e4d13163e58c5f4a45","label":"8bacd09f12c2","date":"2026-07-04T13:43:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"82544d36b1729153c8aeb179e84750f0c085d3b1","lines":373,"reason":"","source":"https://github.com/torvalds/linux/commit/82544d36b1729153c8aeb179e84750f0c085d3b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46054","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46054.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46044","title":"ipmi:ssif: Clean up kthread on errors","status":"backported","project":false,"upstream":[{"sha":"75c486cb1bcaa1a3ec3a6438498176a3a4998ae4","url":"https://git.kernel.org/stable/c/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d6855a3b15851061c817506492b6aa0b605cff1e","label":"d6855a3b1585","date":"2026-10-21T10:30:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75c486cb1bcaa1a3ec3a6438498176a3a4998ae4","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46017","title":"mm: fix deferred split queue races during migration","status":"unfixed","project":false,"upstream":[{"sha":"3bac01168982ec3e3bf87efdc1807c7933590a85","url":"https://git.kernel.org/stable/c/3bac01168982ec3e3bf87efdc1807c7933590a85"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3bac01168982ec3e3bf87efdc1807c7933590a85","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/3bac01168982ec3e3bf87efdc1807c7933590a85.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46014","title":"KVM: SVM: Add missing save/restore handling of LBR MSRs","status":"backported","project":false,"upstream":[{"sha":"3700f0788da6acf73b2df56690f4b201aa4aefd2","url":"https://git.kernel.org/stable/c/3700f0788da6acf73b2df56690f4b201aa4aefd2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4428a0a8643b0acf4ed7b8ea3e5975023bf4aafb","label":"4428a0a8643b","date":"2026-10-21T10:30:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3700f0788da6acf73b2df56690f4b201aa4aefd2","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/3700f0788da6acf73b2df56690f4b201aa4aefd2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46014","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46014.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45988","title":"rxrpc: Fix re-decryption of RESPONSE packets","status":"backported","project":false,"upstream":[{"sha":"0422e7a4883f25101903f3e8105c0808aa5f4ce9","url":"https://git.kernel.org/stable/c/0422e7a4883f25101903f3e8105c0808aa5f4ce9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7b89868305052b94a91b708c462bc2281fa42a4a","label":"7b8986830505","date":"2026-05-07T06:09:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0422e7a4883f25101903f3e8105c0808aa5f4ce9","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/0422e7a4883f25101903f3e8105c0808aa5f4ce9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45981","title":"s390/cio: Fix device lifecycle handling in css_alloc_subchannel()","status":"backported","project":false,"upstream":[{"sha":"f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7","url":"https://git.kernel.org/stable/c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424","label":"f96c5ccf95ae","date":"2026-03-04T07:19:32-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45981","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45981.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45963","title":"ASoC: nau8821: Cancel delayed work on component remove","status":"backported","project":false,"upstream":[{"sha":"dbd3fd05cddfdeec1e49b0a66269881c09eebd17","url":"https://git.kernel.org/stable/c/dbd3fd05cddfdeec1e49b0a66269881c09eebd17"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9210ae708ddead67f55610342ea03fe9d4de6005","label":"9210ae708dde","date":"2026-09-02T14:30:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"dbd3fd05cddfdeec1e49b0a66269881c09eebd17","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45963","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45963.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45901","title":"netfilter: nf_tables: revert commit_mutex usage in reset path","status":"backported","project":false,"upstream":[{"sha":"7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc","url":"https://git.kernel.org/stable/c/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d66bedfe97a2bc321fa8118e669aae988038f729","label":"d66bedfe97a2","date":"2026-08-03T11:16:59+02:00","lore":["https://lore.kernel.org/all/aUh_3mVRV8OrGsVo@strlen.de/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc","lines":372,"reason":"","source":"https://github.com/torvalds/linux/commit/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45897","title":"netfilter: nft_counter: serialize reset with spinlock","status":"backported","project":false,"upstream":[{"sha":"779c60a5190c42689534172f4b49e927c9959e4e","url":"https://git.kernel.org/stable/c/779c60a5190c42689534172f4b49e927c9959e4e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/48cf7918d10c66cb6b05226fa3fa5daf0c891089","label":"48cf7918d10c","date":"2026-08-03T11:16:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"779c60a5190c42689534172f4b49e927c9959e4e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45897","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45897.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45893","title":"apparmor: Fix & Optimize table creation from possibly unaligned memory","status":"backported","project":false,"upstream":[{"sha":"6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a","url":"https://git.kernel.org/stable/c/6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/47e351dfef60ab0e3285133556e1a9c7f646a969","label":"47e351dfef60","date":"2026-03-04T07:20:40-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45893","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45893.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45877","title":"HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients","status":"backported","project":false,"upstream":[{"sha":"56f7db581ee73af53cd512e00a6261a025bf1d58","url":"https://git.kernel.org/stable/c/56f7db581ee73af53cd512e00a6261a025bf1d58"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0b605e8ce60698c27a26f512968a597fd620d2e8","label":"0b605e8ce606","date":"2026-03-04T07:19:57-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"56f7db581ee73af53cd512e00a6261a025bf1d58","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45877","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45877.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45858","title":"ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1","status":"backported","project":false,"upstream":[{"sha":"1bf6974822d1dba86cf11b5f05498581cf3488a2","url":"https://git.kernel.org/stable/c/1bf6974822d1dba86cf11b5f05498581cf3488a2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d17857b4fb9ba5745b59be0ef38fd532991fccbf","label":"d17857b4fb9b","date":"2026-03-04T07:20:46-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1bf6974822d1dba86cf11b5f05498581cf3488a2","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/1bf6974822d1dba86cf11b5f05498581cf3488a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45858","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45858.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45855","title":"ata: libata-scsi: avoid Non-NCQ command starvation","status":"backported","project":false,"upstream":[{"sha":"0ea84089dbf62a92dc7889c79e6b18fc89260808","url":"https://git.kernel.org/stable/c/0ea84089dbf62a92dc7889c79e6b18fc89260808"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ce22aaed011206fed9cbd8c9c2d44718607f31ee","label":"ce22aaed0112","date":"2026-03-13T17:20:23+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"0ea84089dbf62a92dc7889c79e6b18fc89260808","lines":165,"reason":"","source":"https://github.com/torvalds/linux/commit/0ea84089dbf62a92dc7889c79e6b18fc89260808.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45855","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45855.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43500","title":"rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present","status":"backported","project":false,"upstream":[{"sha":"aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","url":"https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568","label":"3711382a7734","date":"2026-05-14T15:29:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43500","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43500.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43485","title":"nouveau/gsp: drop WARN_ON in ACPI probes","status":"backported","project":false,"upstream":[{"sha":"9478c166c46934160135e197b049b5a05753f2ad","url":"https://git.kernel.org/stable/c/9478c166c46934160135e197b049b5a05753f2ad"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2bbb55c4e6665e35a2ebb856d393802753017b2d","label":"2bbb55c4e666","date":"2026-10-21T10:30:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-43485","series":"6.12.y","upstream":["9478c166c46934160135e197b049b5a05753f2ad"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"r535_gsp_acpi_caps/jt/dod retain WARN_ON for invalid ACPI object type/length","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n1448"},{"label":"Upstream fix 9478c166c469","url":"https://git.kernel.org/stable/c/9478c166c46934160135e197b049b5a05753f2ad"}]},"size":{"status":"within-limit","patches":[{"sha":"9478c166c46934160135e197b049b5a05753f2ad","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/9478c166c46934160135e197b049b5a05753f2ad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43485","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43485.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43446","title":"accel/amdxdna: Fix runtime suspend deadlock when there is pending job","status":"not-applicable","project":false,"upstream":[{"sha":"6b13cb8f48a42ddf6dd98865b673a82e37ff238b","url":"https://git.kernel.org/stable/c/6b13cb8f48a42ddf6dd98865b673a82e37ff238b"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6b13cb8f48a42ddf6dd98865b673a82e37ff238b","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/6b13cb8f48a42ddf6dd98865b673a82e37ff238b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43446","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43446.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43416","title":"powerpc, perf: Check that current->mm is alive before getting user callchain","status":"unfixed","project":false,"upstream":[{"sha":"e9bbfb4bfa86c6b5515b868d6982ac60505d7e39","url":"https://git.kernel.org/stable/c/e9bbfb4bfa86c6b5515b868d6982ac60505d7e39"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e9bbfb4bfa86c6b5515b868d6982ac60505d7e39","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/e9bbfb4bfa86c6b5515b868d6982ac60505d7e39.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43416","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43416.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43409","title":"kprobes: avoid crash when rmmod/insmod after ftrace killed","status":"backported","project":false,"upstream":[{"sha":"e113f0b46d19626ec15388bcb91432c9a4fd6261","url":"https://git.kernel.org/stable/c/e113f0b46d19626ec15388bcb91432c9a4fd6261"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b0ca81616a010807e91fc31db9be242b96326adc","label":"b0ca81616a01","date":"2026-03-25T11:08:33+01:00","lore":["https://lore.kernel.org/all/176473947565.1727781.13110060700668331950.stgit@mhiramat.tok.corp.google.com/","https://lore.kernel.org/all/20251125020536.2484381-1-yebin@huaweicloud.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e113f0b46d19626ec15388bcb91432c9a4fd6261","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/e113f0b46d19626ec15388bcb91432c9a4fd6261.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43409","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43409.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43408","title":"ceph: add a bunch of missing ceph_path_info initializers","status":"backported","project":false,"upstream":[{"sha":"43323a5934b660afae687e8e4e95ac328615a5c4","url":"https://git.kernel.org/stable/c/43323a5934b660afae687e8e4e95ac328615a5c4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/644b47f0574fd82aeb9d00317eca8d1f2a525c8c","label":"644b47f0574f","date":"2026-03-25T11:08:33+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"43323a5934b660afae687e8e4e95ac328615a5c4","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/43323a5934b660afae687e8e4e95ac328615a5c4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43408","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43408.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43391","title":"nsfs: tighten permission checks for handle opening","status":"not-applicable","project":false,"upstream":[{"sha":"d2324a9317f00013facb0ba00b00440e19d2af5e","url":"https://git.kernel.org/stable/c/d2324a9317f00013facb0ba00b00440e19d2af5e"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"unknown","patches":[{"sha":"d2324a9317f00013facb0ba00b00440e19d2af5e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43391","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43391.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43362","title":"smb: client: fix in-place encryption corruption in SMB2_write()","status":"backported","project":false,"upstream":[{"sha":"d78840a6a38d312dc1a51a65317bb67e46f0b929","url":"https://git.kernel.org/stable/c/d78840a6a38d312dc1a51a65317bb67e46f0b929"}],"evidence":[{"url":"https://git.kernel.org/stable/c/52327268224fb9ccc7ecfbbdfdfff54b6e93c518","label":"52327268224f","date":"2026-03-25T11:08:38+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d78840a6a38d312dc1a51a65317bb67e46f0b929","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/d78840a6a38d312dc1a51a65317bb67e46f0b929.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43362","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43362.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43344","title":"perf/x86/intel/uncore: Fix die ID init and look up bugs","status":"backported","project":true,"upstream":[{"sha":"a16d1ec4dd0cdcf689f324adde6067083bce9099","url":"https://git.kernel.org/stable/c/a16d1ec4dd0cdcf689f324adde6067083bce9099"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bdb35811ff41a1678620a407056b6372f350028a","label":"bdb35811ff41","date":"2026-09-07T17:17:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a16d1ec4dd0cdcf689f324adde6067083bce9099","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43344","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43344.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43326","title":"sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback","status":"unfixed","project":false,"upstream":[{"sha":"415cb193bb9736f0e830286c72a6fa8eb2a9cc5c","url":"https://git.kernel.org/stable/c/415cb193bb9736f0e830286c72a6fa8eb2a9cc5c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"415cb193bb9736f0e830286c72a6fa8eb2a9cc5c","lines":158,"reason":"","source":"https://github.com/torvalds/linux/commit/415cb193bb9736f0e830286c72a6fa8eb2a9cc5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43326","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43326.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43318","title":"drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify","status":"backported","project":false,"upstream":[{"sha":"b18fc0ab837381c1a6ef28386602cd888f2d9edf","url":"https://git.kernel.org/stable/c/b18fc0ab837381c1a6ef28386602cd888f2d9edf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/82a7ea35a1526bef8ae170c33ff80e5db7728961","label":"82a7ea35a152","date":"2026-03-04T07:21:56-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b18fc0ab837381c1a6ef28386602cd888f2d9edf","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/b18fc0ab837381c1a6ef28386602cd888f2d9edf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43318","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43318.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43317","title":"most: core: fix leak on early registration failure","status":"backported","project":false,"upstream":[{"sha":"2c198c272f9c9213b0fdf6b4a879f445c574f416","url":"https://git.kernel.org/stable/c/2c198c272f9c9213b0fdf6b4a879f445c574f416"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bbfe49ffb892bddf32c34bea95b7ff0fc30affb5","label":"bbfe49ffb892","date":"2026-03-04T07:22:00-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c198c272f9c9213b0fdf6b4a879f445c574f416","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/2c198c272f9c9213b0fdf6b4a879f445c574f416.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43309","title":"md raid: fix hang when stopping arrays with metadata through dm-raid","status":"backported","project":false,"upstream":[{"sha":"cefcb9297fbdb6d94b61787b4f8d84f55b741470","url":"https://git.kernel.org/stable/c/cefcb9297fbdb6d94b61787b4f8d84f55b741470"}],"evidence":[{"url":"https://git.kernel.org/stable/c/63054027d95200b04f3cf624faa7817e0555d56a","label":"63054027d952","date":"2026-10-21T10:30:22+02:00","lore":["https://lore.kernel.org/linux-raid/CAM23VxqYrwkhKEBeQrZeZwQudbiNey2_8B_SEOLqug=pXxaFrA@mail.gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cefcb9297fbdb6d94b61787b4f8d84f55b741470","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/cefcb9297fbdb6d94b61787b4f8d84f55b741470.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43309","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43309.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43301","title":"media: chips-media: wave5: Fix PM runtime usage count underflow","status":"unfixed","project":false,"upstream":[{"sha":"9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38","url":"https://git.kernel.org/stable/c/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43301","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43301.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43299","title":"btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()","status":"backported","project":false,"upstream":[{"sha":"8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3","url":"https://git.kernel.org/stable/c/8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/da3f596073de1c3cbc99941f01296968a85c8c76","label":"da3f596073de","date":"2026-10-21T10:30:21+02:00","lore":["https://lore.kernel.org/linux-btrfs/20260126045555.GB31641@lst.de/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43299","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43299.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43288","title":"ext4: move ext4_percpu_param_init() before ext4_mb_init()","status":"backported","project":false,"upstream":[{"sha":"270564513489d98b721a1e4a10017978d5213bff","url":"https://git.kernel.org/stable/c/270564513489d98b721a1e4a10017978d5213bff"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9e9fb259bcddf459a0168f4a964e979e500a68a5","label":"9e9fb259bcdd","date":"2026-03-04T07:21:14-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"270564513489d98b721a1e4a10017978d5213bff","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43234","title":"team: avoid NETDEV_CHANGEMTU event when unregistering slave","status":"backported","project":false,"upstream":[{"sha":"bb4c698633c0e19717586a6524a33196cff01a32","url":"https://git.kernel.org/stable/c/bb4c698633c0e19717586a6524a33196cff01a32"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dde2fa2a658802d0ff03cd4a0e7d4a5459ef18de","label":"dde2fa2a6588","date":"2026-10-21T10:30:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"bb4c698633c0e19717586a6524a33196cff01a32","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43234","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43234.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43188","title":"ceph: do not propagate page array emplacement errors as batch errors","status":"unfixed","project":false,"upstream":[{"sha":"707104682e3c163f7c14cdd6b07a3e95fb374759","url":"https://git.kernel.org/stable/c/707104682e3c163f7c14cdd6b07a3e95fb374759"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"707104682e3c163f7c14cdd6b07a3e95fb374759","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/707104682e3c163f7c14cdd6b07a3e95fb374759.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43188","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43188.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43174","title":"io_uring/zcrx: fix post open error handling","status":"not-applicable","project":false,"upstream":[{"sha":"5d540e4508950c674d6feef1d95463d039bbf4f5","url":"https://git.kernel.org/stable/c/5d540e4508950c674d6feef1d95463d039bbf4f5"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"5d540e4508950c674d6feef1d95463d039bbf4f5","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/5d540e4508950c674d6feef1d95463d039bbf4f5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43173","title":"net: ethernet: xscale: Check for PTP support properly","status":"backported","project":false,"upstream":[{"sha":"594163ea88a03bdb412063af50fc7177ef3cbeae","url":"https://git.kernel.org/stable/c/594163ea88a03bdb412063af50fc7177ef3cbeae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/21d1e80d0d6e7d0c3cd8b1e001ed1fa92fb9f3f5","label":"21d1e80d0d6e","date":"2026-03-04T07:21:32-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"594163ea88a03bdb412063af50fc7177ef3cbeae","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/594163ea88a03bdb412063af50fc7177ef3cbeae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43173","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43173.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43172","title":"wifi: iwlwifi: fix 22000 series SMEM parsing","status":"backported","project":false,"upstream":[{"sha":"58192b9ce09b0f0f86e2036683bd542130b91a98","url":"https://git.kernel.org/stable/c/58192b9ce09b0f0f86e2036683bd542130b91a98"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b23c7cd616a6a113363be707b7b9e4bc41b18a07","label":"b23c7cd616a6","date":"2026-10-21T10:30:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"58192b9ce09b0f0f86e2036683bd542130b91a98","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/58192b9ce09b0f0f86e2036683bd542130b91a98.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43172","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43172.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43161","title":"iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode","status":"backported","project":false,"upstream":[{"sha":"42662d19839f34735b718129ea200e3734b07e50","url":"https://git.kernel.org/stable/c/42662d19839f34735b718129ea200e3734b07e50"}],"evidence":[{"url":"https://git.kernel.org/stable/c/48b3f08e68b29a79527869cdde7298ca2a9b9646","label":"48b3f08e68b2","date":"2026-03-13T17:20:26+01:00","lore":["https://lore.kernel.org/r/20251211035946.2071-2-guojinhui.liam@bytedance.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"42662d19839f34735b718129ea200e3734b07e50","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/42662d19839f34735b718129ea200e3734b07e50.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43137","title":"ASoC: SOF: Intel: hda: Fix NULL pointer dereference","status":"backported","project":false,"upstream":[{"sha":"16c589567a956d46a7c1363af3f64de3d420af20","url":"https://git.kernel.org/stable/c/16c589567a956d46a7c1363af3f64de3d420af20"}],"evidence":[{"url":"https://git.kernel.org/stable/c/10411f1f2c76be67103b1f95822ff629aa25e2aa","label":"10411f1f2c76","date":"2026-03-04T07:21:09-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"16c589567a956d46a7c1363af3f64de3d420af20","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/16c589567a956d46a7c1363af3f64de3d420af20.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43126","title":"ALSA: mixer: oss: Add card disconnect checkpoints","status":"backported","project":false,"upstream":[{"sha":"084d5d44418148662365eced3e126ad1a81ee3e2","url":"https://git.kernel.org/stable/c/084d5d44418148662365eced3e126ad1a81ee3e2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ae583f113d15fa97e5234133c20d09f8e6214e47","label":"ae583f113d15","date":"2026-03-04T07:21:10-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"084d5d44418148662365eced3e126ad1a81ee3e2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43126","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43126.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43115","title":"srcu: Use irq_work to start GP in tiny SRCU","status":"backported","project":false,"upstream":[{"sha":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","url":"https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2127e6b79d9d579ea538a350d1bbe859e39814d5","label":"2127e6b79d9d","date":"2026-10-21T10:30:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43095","title":"ASoC: SDCA: Fix errors in IRQ cleanup","status":"not-applicable","project":false,"upstream":[{"sha":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","url":"https://git.kernel.org/stable/c/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"over-limit","patches":[{"sha":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","lines":145,"reason":"","source":"https://github.com/torvalds/linux/commit/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43095","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43095.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43088","title":"net: af_key: zero aligned sockaddr tail in PF_KEY exports","status":"backported","project":false,"upstream":[{"sha":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","url":"https://git.kernel.org/stable/c/426c355742f02cf743b347d9d7dbdc1bfbfa31ef"}],"evidence":[{"url":"https://git.kernel.org/stable/c/11cbf294bac623bd57296f231199193087f57b4a","label":"11cbf294bac6","date":"2026-05-14T15:29:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43088","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43088.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43073","title":"x86-64: rename misleadingly named '__copy_user_nocache()' function","status":"backported","project":false,"upstream":[{"sha":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","url":"https://git.kernel.org/stable/c/d187a86de793f84766ea40b9ade7ac60aabbb4fe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd","label":"14b9194db4a2","date":"2026-04-22T13:19:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","lines":84,"reason":"","source":"https://github.com/torvalds/linux/commit/d187a86de793f84766ea40b9ade7ac60aabbb4fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43053","title":"xfs: close crash window in attr dabtree inactivation","status":"backported","project":false,"upstream":[{"sha":"b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61","url":"https://git.kernel.org/stable/c/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61"}],"evidence":[{"url":"https://git.kernel.org/stable/c/190d54d1d42878fce8c735c2d9ac835725694d3a","label":"190d54d1d428","date":"2026-10-21T10:30:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61","lines":171,"reason":"","source":"https://github.com/torvalds/linux/commit/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43053","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43053.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43045","title":"mshv: Fix error handling in mshv_region_pin","status":"not-applicable","project":false,"upstream":[{"sha":"c0e296f257671ba10249630fe58026f29e4804d9","url":"https://git.kernel.org/stable/c/c0e296f257671ba10249630fe58026f29e4804d9"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"c0e296f257671ba10249630fe58026f29e4804d9","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/c0e296f257671ba10249630fe58026f29e4804d9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43045","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43045.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43042","title":"mpls: add seqcount to protect the platform_label{,s} pair","status":"backported","project":false,"upstream":[{"sha":"629ec78ef8608d955ce217880cdc3e1873af3a15","url":"https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8adc5b6fc876928d8c95555d30b66fa50b07421e","label":"8adc5b6fc876","date":"2026-10-21T10:30:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"629ec78ef8608d955ce217880cdc3e1873af3a15","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/629ec78ef8608d955ce217880cdc3e1873af3a15.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43042","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43042.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43029","title":"mptcp: fix soft lockup in mptcp_recvmsg()","status":"unfixed","project":false,"upstream":[{"sha":"5dd8025a49c268ab6b94d978532af3ad341132a7","url":"https://git.kernel.org/stable/c/5dd8025a49c268ab6b94d978532af3ad341132a7"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5dd8025a49c268ab6b94d978532af3ad341132a7","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/5dd8025a49c268ab6b94d978532af3ad341132a7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43029","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43029.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43009","title":"bpf: Fix incorrect pruning due to atomic fetch precision tracking","status":"backported","project":false,"upstream":[{"sha":"179ee84a89114b854ac2dd1d293633a7f6c8dac1","url":"https://git.kernel.org/stable/c/179ee84a89114b854ac2dd1d293633a7f6c8dac1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7c72e5f3741d1c5cc53439137162f0e09254e6e9","label":"7c72e5f3741d","date":"2026-10-21T10:30:19+02:00","lore":["https://lore.kernel.org/r/20260331222020.401848-1-daniel@iogearbox.net"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"179ee84a89114b854ac2dd1d293633a7f6c8dac1","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43009","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43009.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31777","title":"ALSA: ctxfi: Check the error for index mapping","status":"unfixed","project":false,"upstream":[{"sha":"277c6960d4ddb94d16198afd70c92c3d4593d131","url":"https://git.kernel.org/stable/c/277c6960d4ddb94d16198afd70c92c3d4593d131"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"277c6960d4ddb94d16198afd70c92c3d4593d131","lines":162,"reason":"","source":"https://github.com/torvalds/linux/commit/277c6960d4ddb94d16198afd70c92c3d4593d131.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31777","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31777.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31729","title":"usb: typec: ucsi: validate connector number in ucsi_notify_common()","status":"backported","project":false,"upstream":[{"sha":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","url":"https://git.kernel.org/stable/c/d2d8c17ac01a1b1f638ea5d340a884ccc5015186"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f6dcbf2b024d55549959402f1db6c614e51d52cb","label":"f6dcbf2b024d","date":"2026-04-11T14:24:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/d2d8c17ac01a1b1f638ea5d340a884ccc5015186.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31729","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31729.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31710","title":"smb: client: fix dir separator in SMB1 UNIX mounts","status":"not-applicable","project":false,"upstream":[{"sha":"c4d3fc5844d685441befd0caaab648321013cdfd","url":"https://git.kernel.org/stable/c/c4d3fc5844d685441befd0caaab648321013cdfd"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c4d3fc5844d685441befd0caaab648321013cdfd","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/c4d3fc5844d685441befd0caaab648321013cdfd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31710","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31710.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31692","title":"rtnetlink: add missing netlink_ns_capable() check for peer netns","status":"unfixed","project":false,"upstream":[{"sha":"7b735ef81286007794a227ce2539419479c02a5f","url":"https://git.kernel.org/stable/c/7b735ef81286007794a227ce2539419479c02a5f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7b735ef81286007794a227ce2539419479c02a5f","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/7b735ef81286007794a227ce2539419479c02a5f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31692","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31692.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31655","title":"pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled","status":"backported","project":false,"upstream":[{"sha":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","url":"https://git.kernel.org/stable/c/e91d5f94acf68618ea3ad9c92ac28614e791ae7d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3086374e8bc7fd65f2cc62ef52351c6d662f1543","label":"3086374e8bc7","date":"2026-04-18T10:41:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31655","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31655.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31648","title":"mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()","status":"backported","project":false,"upstream":[{"sha":"f58df566524ebcdfa394329c64f47e3c9257516e","url":"https://git.kernel.org/stable/c/f58df566524ebcdfa394329c64f47e3c9257516e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/633ab680c405ac390e6bec5b74aaf46197c837b6","label":"633ab680c405","date":"2026-04-18T10:41:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f58df566524ebcdfa394329c64f47e3c9257516e","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/f58df566524ebcdfa394329c64f47e3c9257516e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31648","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31648.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31591","title":"KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish","status":"unfixed","project":false,"upstream":[{"sha":"cb923ee6a80f4e604e6242a4702b59251e61a380","url":"https://git.kernel.org/stable/c/cb923ee6a80f4e604e6242a4702b59251e61a380"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cb923ee6a80f4e604e6242a4702b59251e61a380","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/cb923ee6a80f4e604e6242a4702b59251e61a380.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31579","title":"wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit","status":"backported","project":false,"upstream":[{"sha":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","url":"https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/707607db2193591b68c0e70f814133472c185b1e","label":"707607db2193","date":"2026-10-21T10:30:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31579","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31579.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31573","title":"media: verisilicon: Fix kernel panic due to __initconst misuse","status":"backported","project":false,"upstream":[{"sha":"e8d97c270cb46a2a88739019d0f8547adc7d97da","url":"https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5d177ff5eb235de9cc0b8e877466f5a3af6f573e","label":"5d177ff5eb23","date":"2026-10-21T10:31:06+02:00","lore":["https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/","https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/"]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e8d97c270cb46a2a88739019d0f8547adc7d97da","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/e8d97c270cb46a2a88739019d0f8547adc7d97da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31573","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31573.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31537","title":"smb: server: make use of smbdirect_socket.send_io.bcredits","status":"unfixed","project":false,"upstream":[{"sha":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","url":"https://git.kernel.org/stable/c/34abd408c8ba24d7c97bd02ba874d8c714f49db1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/34abd408c8ba24d7c97bd02ba874d8c714f49db1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31537","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31537.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31536","title":"smb: server: let send_done handle a completion without IB_SEND_SIGNALED","status":"unfixed","project":false,"upstream":[{"sha":"9da82dc73cb03e85d716a2609364572367a5ff47","url":"https://git.kernel.org/stable/c/9da82dc73cb03e85d716a2609364572367a5ff47"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9da82dc73cb03e85d716a2609364572367a5ff47","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/9da82dc73cb03e85d716a2609364572367a5ff47.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31536","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31536.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31527","title":"driver core: platform: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","url":"https://git.kernel.org/stable/c/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9a6086d2a828dd2ff74cf9abcae456670febd71f","label":"9a6086d2a828","date":"2026-04-02T13:09:25+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31527","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31527.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31516","title":"xfrm: prevent policy_hthresh.work from racing with netns teardown","status":"backported","project":false,"upstream":[{"sha":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","url":"https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/56ea2257b83ee29a543f158159e3d1abc1e3e4fe","label":"56ea2257b83e","date":"2026-04-02T13:09:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/29fe3a61bcdce398ee3955101c39f89c01a8a77e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31516","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31516.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31502","title":"team: fix header_ops type confusion with non-Ethernet ports","status":"backported","project":false,"upstream":[{"sha":"425000dbf17373a4ab8be9428f5dc055ef870a56","url":"https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6d3161fa3eee64d46b766fb0db33ec7f300ef52d","label":"6d3161fa3eee","date":"2026-04-02T13:09:35+02:00","lore":["https://lore.kernel.org/all/69b46af7.050a0220.36eb34.000e.GAE@google.com/T/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"425000dbf17373a4ab8be9428f5dc055ef870a56","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31502","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31502.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31499","title":"Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()","status":"backported","project":false,"upstream":[{"sha":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","url":"https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da","label":"f7f35a4f7fd5","date":"2026-05-14T15:29:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/00fdebbbc557a2fc21321ff2eaa22fd70c078608.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31493","title":"RDMA/efa: Fix use of completion ctx after free","status":"backported","project":false,"upstream":[{"sha":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","url":"https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5","label":"7ba09d85f177","date":"2026-10-21T10:30:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","lines":179,"reason":"","source":"https://github.com/torvalds/linux/commit/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31487","title":"spi: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","url":"https://git.kernel.org/stable/c/cc34d77dd48708d810c12bfd6f5bf03304f6c824"}],"evidence":[{"url":"https://git.kernel.org/stable/c/eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0","label":"eedf220442d1","date":"2026-04-02T13:09:39+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/cc34d77dd48708d810c12bfd6f5bf03304f6c824.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31487","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31487.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31458","title":"mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]","status":"backported","project":false,"upstream":[{"sha":"1bfe9fb5ed2667fb075682408b776b5273162615","url":"https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1e8da792672481d603fa7cd0d815577220a3ee27","label":"1e8da7926724","date":"2026-04-02T13:09:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1bfe9fb5ed2667fb075682408b776b5273162615","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/1bfe9fb5ed2667fb075682408b776b5273162615.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31458","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31458.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31435","title":"netfs: Fix read abandonment during retry","status":"unfixed","project":false,"upstream":[{"sha":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","url":"https://git.kernel.org/stable/c/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31435","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31435.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31420","title":"bridge: mrp: reject zero test interval to avoid OOM panic","status":"backported","project":false,"upstream":[{"sha":"fa6e24963342de4370e3a3c9af41e38277b74cf3","url":"https://git.kernel.org/stable/c/fa6e24963342de4370e3a3c9af41e38277b74cf3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/630a15a31c2034b5b697f4aabc769b9d80d82446","label":"630a15a31c20","date":"2026-06-01T17:46:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fa6e24963342de4370e3a3c9af41e38277b74cf3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31420","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31420.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23459","title":"ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS","status":"backported","project":false,"upstream":[{"sha":"8431c602f551549f082bbfa67f3003f2d8e3e132","url":"https://git.kernel.org/stable/c/8431c602f551549f082bbfa67f3003f2d8e3e132"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e40e2d11ced8119d3e4469ebe91264bc1cf71530","label":"e40e2d11ced8","date":"2026-08-23T14:22:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"unknown","patches":[{"sha":"8431c602f551549f082bbfa67f3003f2d8e3e132","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23459","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23459.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23448","title":"net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check","status":"backported","project":false,"upstream":[{"sha":"2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a","url":"https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/789204f980730258c983102c027c375238009c80","label":"789204f98073","date":"2026-03-25T11:08:54+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23448","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23448.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23447","title":"net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check","status":"backported","project":false,"upstream":[{"sha":"77914255155e68a20aa41175edeecf8121dac391","url":"https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391"}],"evidence":[{"url":"https://git.kernel.org/stable/c/af0d1613d6751489dbf9f69aac1123f0b1e566e5","label":"af0d1613d675","date":"2026-03-25T11:08:54+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"77914255155e68a20aa41175edeecf8121dac391","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23447","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23447.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23393","title":"bridge: cfm: Fix race condition in peer_mep deletion","status":"backported","project":false,"upstream":[{"sha":"3715a00855316066cdda69d43648336367422127","url":"https://git.kernel.org/stable/c/3715a00855316066cdda69d43648336367422127"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e89dbd2736a45f0507949af4748cbbf3ff793146","label":"e89dbd2736a4","date":"2026-03-25T11:08:52+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3715a00855316066cdda69d43648336367422127","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/3715a00855316066cdda69d43648336367422127.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23393","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23393.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23371","title":"sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting","status":"backported","project":false,"upstream":[{"sha":"d658686a1331db3bb108ca079d76deb3208ed949","url":"https://git.kernel.org/stable/c/d658686a1331db3bb108ca079d76deb3208ed949"}],"evidence":[{"url":"https://git.kernel.org/stable/c/65af3633caf195d397ec4c39f51ae7615bd5a627","label":"65af3633caf1","date":"2026-10-21T10:30:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d658686a1331db3bb108ca079d76deb3208ed949","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23371","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23371.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23348","title":"cxl: Fix race of nvdimm_bus object when creating nvdimm objects","status":"unfixed","project":false,"upstream":[{"sha":"96a1fd0d84b17360840f344826897fa71049870e","url":"https://git.kernel.org/stable/c/96a1fd0d84b17360840f344826897fa71049870e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"96a1fd0d84b17360840f344826897fa71049870e","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/96a1fd0d84b17360840f344826897fa71049870e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23348","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23348.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23346","title":"arm64: io: Extract user memory type in ioremap_prot()","status":"backported","project":false,"upstream":[{"sha":"8f098037139b294050053123ab2bc0f819d08932","url":"https://git.kernel.org/stable/c/8f098037139b294050053123ab2bc0f819d08932"}],"evidence":[{"url":"https://git.kernel.org/stable/c/eeecafce5afffb4da703666ebefbd4d6e2a5abf6","label":"eeecafce5aff","date":"2026-06-09T12:25:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f098037139b294050053123ab2bc0f819d08932","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8f098037139b294050053123ab2bc0f819d08932.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23346","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23346.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23295","title":"accel/amdxdna: Fix dead lock for suspend and resume","status":"not-applicable","project":false,"upstream":[{"sha":"1aa82181a3c285c7351523d587f7981ae4c015c8","url":"https://git.kernel.org/stable/c/1aa82181a3c285c7351523d587f7981ae4c015c8"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"1aa82181a3c285c7351523d587f7981ae4c015c8","lines":144,"reason":"","source":"https://github.com/torvalds/linux/commit/1aa82181a3c285c7351523d587f7981ae4c015c8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23295","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23295.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23276","title":"net: add xmit recursion limit to tunnel xmit functions","status":"backported","project":false,"upstream":[{"sha":"6f1a9140ecda3baba3d945b9a6155af4268aafc4","url":"https://git.kernel.org/stable/c/6f1a9140ecda3baba3d945b9a6155af4268aafc4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/834c4f645726a25fd71ea50cdfb5c135f8f95d85","label":"834c4f645726","date":"2026-03-25T11:08:28+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"6f1a9140ecda3baba3d945b9a6155af4268aafc4","lines":152,"reason":"","source":"https://github.com/torvalds/linux/commit/6f1a9140ecda3baba3d945b9a6155af4268aafc4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23276","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23276.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23265","title":"f2fs: fix to do sanity check on node footer in {read,write}_end_io","status":"unfixed","project":false,"upstream":[{"sha":"50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4","url":"https://git.kernel.org/stable/c/50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4","lines":107,"reason":"","source":"https://github.com/torvalds/linux/commit/50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23265","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23265.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23240","title":"tls: Fix race condition in tls_sw_cancel_work_tx()","status":"backported","project":false,"upstream":[{"sha":"7bb09315f93dce6acc54bf59e5a95ba7365c2be4","url":"https://git.kernel.org/stable/c/7bb09315f93dce6acc54bf59e5a95ba7365c2be4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a5de36d6cee74a92c1a21b260bc507e64bc451de","label":"a5de36d6cee7","date":"2026-03-04T07:21:33-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7bb09315f93dce6acc54bf59e5a95ba7365c2be4","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7bb09315f93dce6acc54bf59e5a95ba7365c2be4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23240","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23240.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23239","title":"espintcp: Fix race condition in espintcp_close()","status":"backported","project":false,"upstream":[{"sha":"e1512c1db9e8794d8d130addd2615ec27231d994","url":"https://git.kernel.org/stable/c/e1512c1db9e8794d8d130addd2615ec27231d994"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f7ad8b1d0e421c524604d5076b73232093490d5c","label":"f7ad8b1d0e42","date":"2026-03-04T07:21:31-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e1512c1db9e8794d8d130addd2615ec27231d994","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/e1512c1db9e8794d8d130addd2615ec27231d994.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23239","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23239.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23152","title":"wifi: mac80211: correctly decode TTLM with default link map","status":"unfixed","project":false,"upstream":[{"sha":"1eab33aa63c993685dd341e03bd5b267dd7403fa","url":"https://git.kernel.org/stable/c/1eab33aa63c993685dd341e03bd5b267dd7403fa"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"1eab33aa63c993685dd341e03bd5b267dd7403fa","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/1eab33aa63c993685dd341e03bd5b267dd7403fa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23152","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23152.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23137","title":"of: unittest: Fix memory leak in unittest_data_add()","status":"backported","project":true,"upstream":[{"sha":"235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b","url":"https://git.kernel.org/stable/c/235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/58baf98d1bdab897fd796f39a16061bade229d71","label":"58baf98d1bda","date":"2026-09-14T13:31:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23102","title":"arm64/fpsimd: signal: Fix restoration of SVE context","status":"unfixed","project":false,"upstream":[{"sha":"d2907cbe9ea0a54cbe078076f9d089240ee1e2d9","url":"https://git.kernel.org/stable/c/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2907cbe9ea0a54cbe078076f9d089240ee1e2d9","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23088","title":"tracing: Fix crash on synthetic stacktrace field usage","status":"backported","project":false,"upstream":[{"sha":"90f9f5d64cae4e72defd96a2a22760173cb3c9ec","url":"https://git.kernel.org/stable/c/90f9f5d64cae4e72defd96a2a22760173cb3c9ec"}],"evidence":[{"url":"https://git.kernel.org/stable/c/327af07dff6ab5650b21491eb4f69694999ff3d1","label":"327af07dff6a","date":"2026-01-30T10:28:46+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"90f9f5d64cae4e72defd96a2a22760173cb3c9ec","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/90f9f5d64cae4e72defd96a2a22760173cb3c9ec.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23088","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23088.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23035","title":"net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv","status":"backported","project":false,"upstream":[{"sha":"4ef8512e1427111f7ba92b4a847d181ff0aeec42","url":"https://git.kernel.org/stable/c/4ef8512e1427111f7ba92b4a847d181ff0aeec42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a7625bacaa8c8c2bfcde6dd6d1397bd63ad82b02","label":"a7625bacaa8c","date":"2026-01-23T11:18:38+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4ef8512e1427111f7ba92b4a847d181ff0aeec42","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/4ef8512e1427111f7ba92b4a847d181ff0aeec42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23035","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23035.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23007","title":"block: zero non-PI portion of auto integrity buffer","status":"backported","project":false,"upstream":[{"sha":"ca22c566b89164f6e670af56ecc45f47ef3df819","url":"https://git.kernel.org/stable/c/ca22c566b89164f6e670af56ecc45f47ef3df819"}],"evidence":[{"url":"https://git.kernel.org/stable/c/765bf0a5880777c04ae98fc2a9f3b995737b3a64","label":"765bf0a58807","date":"2026-10-21T10:30:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-23007","series":"6.12.y","upstream":["ca22c566b89164f6e670af56ecc45f47ef3df819"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"bio_integrity_prep zeroes opaque metadata only for CSUM_NONE, not metadata_size > pi_tuple_size","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: block/bio-integrity.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/block/bio-integrity.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n399"},{"label":"Upstream fix ca22c566b891","url":"https://git.kernel.org/stable/c/ca22c566b89164f6e670af56ecc45f47ef3df819"}]},"size":{"status":"within-limit","patches":[{"sha":"ca22c566b89164f6e670af56ecc45f47ef3df819","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/ca22c566b89164f6e670af56ecc45f47ef3df819.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23007","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23007.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23000","title":"net/mlx5e: Fix crash on profile change rollback failure","status":"backported","project":false,"upstream":[{"sha":"4dadc4077e3f77d6d31e199a925fc7a705e7adeb","url":"https://git.kernel.org/stable/c/4dadc4077e3f77d6d31e199a925fc7a705e7adeb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dad52950b409d6923880d65a4cddb383286e17d2","label":"dad52950b409","date":"2026-01-23T11:18:37+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"4dadc4077e3f77d6d31e199a925fc7a705e7adeb","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/4dadc4077e3f77d6d31e199a925fc7a705e7adeb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23000","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23000.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-22996","title":"net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv","status":"backported","project":false,"upstream":[{"sha":"123eda2e5b1638e298e3a66bb1e64a8da92de5e1","url":"https://git.kernel.org/stable/c/123eda2e5b1638e298e3a66bb1e64a8da92de5e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dcb2ad755a16cb0ecd2dc98234d71a6e216ae7fe","label":"dcb2ad755a16","date":"2026-01-23T11:18:37+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"123eda2e5b1638e298e3a66bb1e64a8da92de5e1","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/123eda2e5b1638e298e3a66bb1e64a8da92de5e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-22996","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-22996.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71315","title":"drm/vkms: Convert to DRM's vblank timer","status":"unfixed","project":false,"upstream":[{"sha":"02e2681ffe1addde1fc8c35d05657b16bfa79613","url":"https://git.kernel.org/stable/c/02e2681ffe1addde1fc8c35d05657b16bfa79613"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"02e2681ffe1addde1fc8c35d05657b16bfa79613","lines":130,"reason":"","source":"https://github.com/torvalds/linux/commit/02e2681ffe1addde1fc8c35d05657b16bfa79613.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71302","title":"drm/panthor: fix for dma-fence safe access rules","status":"unfixed","project":false,"upstream":[{"sha":"efe24898485c5c831e629d9c6fb9350c35cb576f","url":"https://git.kernel.org/stable/c/efe24898485c5c831e629d9c6fb9350c35cb576f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"efe24898485c5c831e629d9c6fb9350c35cb576f","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/efe24898485c5c831e629d9c6fb9350c35cb576f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71302","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71302.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71272","title":"most: core: fix resource leak in most_register_interface error paths","status":"backported","project":false,"upstream":[{"sha":"1f4c9d8a1021281750c6cda126d6f8a40cc24e71","url":"https://git.kernel.org/stable/c/1f4c9d8a1021281750c6cda126d6f8a40cc24e71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a49028a796d7b94f8e3ab9bd34b18f36be235459","label":"a49028a796d7","date":"2026-03-04T07:21:23-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1f4c9d8a1021281750c6cda126d6f8a40cc24e71","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/1f4c9d8a1021281750c6cda126d6f8a40cc24e71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71272","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71272.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71225","title":"md: suspend array while updating raid_disks via sysfs","status":"backported","project":false,"upstream":[{"sha":"2cc583653bbe050bacd1cadcc9776d39bf449740","url":"https://git.kernel.org/stable/c/2cc583653bbe050bacd1cadcc9776d39bf449740"}],"evidence":[{"url":"https://git.kernel.org/stable/c/165d1359f945b72c5f90088f60d48ff46115269e","label":"165d1359f945","date":"2026-02-11T13:40:19+01:00","lore":["https://lore.kernel.org/linux-raid/20251226101816.4506-1-dannyshih@synology.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2cc583653bbe050bacd1cadcc9776d39bf449740","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/2cc583653bbe050bacd1cadcc9776d39bf449740.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71225","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71225.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71202","title":"iommu/sva: invalidate stale IOTLB entries for kernel address space","status":"unfixed","project":false,"upstream":[{"sha":"e37d5a2d60a338c5917c45296bac65da1382eda5","url":"https://git.kernel.org/stable/c/e37d5a2d60a338c5917c45296bac65da1382eda5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"e37d5a2d60a338c5917c45296bac65da1382eda5","lines":110,"reason":"","source":"https://github.com/torvalds/linux/commit/e37d5a2d60a338c5917c45296bac65da1382eda5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71202","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71202.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71160","title":"netfilter: nf_tables: avoid chain re-validation if possible","status":"backported","project":false,"upstream":[{"sha":"8e1a1bc4f5a42747c08130b8242ebebd1210b32f","url":"https://git.kernel.org/stable/c/8e1a1bc4f5a42747c08130b8242ebebd1210b32f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/14fa3d1927f1382f86e3f70a51f26005c8e3cff6","label":"14fa3d1927f1","date":"2026-01-17T16:31:28+01:00","lore":["https://lore.kernel.org/netfilter-devel/20251118221735.GA5477@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8e1a1bc4f5a42747c08130b8242ebebd1210b32f","lines":177,"reason":"","source":"https://github.com/torvalds/linux/commit/8e1a1bc4f5a42747c08130b8242ebebd1210b32f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71160","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71160.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71129","title":"LoongArch: BPF: Sign extend kfunc call arguments","status":"backported","project":false,"upstream":[{"sha":"3f5a238f24d7b75f9efe324d3539ad388f58536e","url":"https://git.kernel.org/stable/c/3f5a238f24d7b75f9efe324d3539ad388f58536e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0d666db731e95890e0eda7ea61bc925fd2be90c6","label":"0d666db731e9","date":"2026-01-08T10:14:51+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f5a238f24d7b75f9efe324d3539ad388f58536e","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/3f5a238f24d7b75f9efe324d3539ad388f58536e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71117","title":"block: Remove queue freezing from several sysfs store callbacks","status":"unfixed","project":false,"upstream":[{"sha":"935a20d1bebf6236076785fac3ff81e3931834e9","url":"https://git.kernel.org/stable/c/935a20d1bebf6236076785fac3ff81e3931834e9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"935a20d1bebf6236076785fac3ff81e3931834e9","lines":113,"reason":"","source":"https://github.com/torvalds/linux/commit/935a20d1bebf6236076785fac3ff81e3931834e9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71117","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71117.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71065","title":"f2fs: fix to avoid potential deadlock","status":"backported","project":false,"upstream":[{"sha":"ca8b201f28547e28343a6f00a6e91fa8c09572fe","url":"https://git.kernel.org/stable/c/ca8b201f28547e28343a6f00a6e91fa8c09572fe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6c3bab5c6261aa22c561ef56b7365959a90e7d91","label":"6c3bab5c6261","date":"2026-01-08T10:14:20+01:00","lore":["https://lore.kernel.org/linux-f2fs-devel/68eae49b.050a0220.ac43.0001.GAE@google.com","https://lore.kernel.org/lkml/CANypQFa-Gy9sD-N35o3PC+FystOWkNuN8pv6S75HLT0ga-Tzgw@mail.gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ca8b201f28547e28343a6f00a6e91fa8c09572fe","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/ca8b201f28547e28343a6f00a6e91fa8c09572fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71065","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71065.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68781","title":"usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal","status":"backported","project":false,"upstream":[{"sha":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","url":"https://git.kernel.org/stable/c/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/69f9a0701abc3d1f8225074c56c27e6c16a37222","label":"69f9a0701abc","date":"2026-01-08T10:14:17+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68781","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68781.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68768","title":"inet: frags: flush pending skbs in fqdir_pre_exit()","status":"backported","project":false,"upstream":[{"sha":"006a5035b495dec008805df249f92c22c89c3d2e","url":"https://git.kernel.org/stable/c/006a5035b495dec008805df249f92c22c89c3d2e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/543555954b1ee8d1903a7020324efb41b0c97428","label":"543555954b1e","date":"2026-06-09T12:25:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"006a5035b495dec008805df249f92c22c89c3d2e","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/006a5035b495dec008805df249f92c22c89c3d2e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68751","title":"s390/fpu: Fix false-positive kmsan report in fpu_vstl()","status":"unfixed","project":false,"upstream":[{"sha":"14e4e4175b64dd9216b522f6ece8af6997d063b2","url":"https://git.kernel.org/stable/c/14e4e4175b64dd9216b522f6ece8af6997d063b2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"14e4e4175b64dd9216b522f6ece8af6997d063b2","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/14e4e4175b64dd9216b522f6ece8af6997d063b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68751","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68751.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68338","title":"net: dsa: microchip: Don't free uninitialized ksz_irq","status":"backported","project":false,"upstream":[{"sha":"25b62cc5b22c45face094ae3e8717258e46d1d19","url":"https://git.kernel.org/stable/c/25b62cc5b22c45face094ae3e8717258e46d1d19"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9428654c827fa8d38b898135d26d39ee2d544246","label":"9428654c827f","date":"2025-12-07T06:25:02+09:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"25b62cc5b22c45face094ae3e8717258e46d1d19","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/25b62cc5b22c45face094ae3e8717258e46d1d19.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68338","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68338.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68334","title":"platform/x86/amd/pmc: Add support for Van Gogh SoC","status":"backported","project":false,"upstream":[{"sha":"db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb","url":"https://git.kernel.org/stable/c/db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/996092ba6df66e2ac8cf9022007a7c8a412e7733","label":"996092ba6df6","date":"2026-03-25T11:08:45+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68322","title":"parisc: Avoid crash due to unaligned access in unwinder","status":"backported","project":false,"upstream":[{"sha":"fd9f30d1038ee1624baa17a6ff11effe5f7617cb","url":"https://git.kernel.org/stable/c/fd9f30d1038ee1624baa17a6ff11effe5f7617cb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9ac1f44723f26881b9fe7e69c7bc25397b879155","label":"9ac1f44723f2","date":"2025-11-13T15:34:39-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd9f30d1038ee1624baa17a6ff11effe5f7617cb","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/fd9f30d1038ee1624baa17a6ff11effe5f7617cb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68322","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68322.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68313","title":"x86/CPU/AMD: Add RDSEED fix for Zen5","status":"backported","project":false,"upstream":[{"sha":"607b9fb2ce248cc5b633c5949e0153838992c152","url":"https://git.kernel.org/stable/c/607b9fb2ce248cc5b633c5949e0153838992c152"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e980de2ff109dacb6d9d3a77f01b27c467115ecb","label":"e980de2ff109","date":"2025-11-13T15:34:01-05:00","lore":["https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"607b9fb2ce248cc5b633c5949e0153838992c152","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/607b9fb2ce248cc5b633c5949e0153838992c152.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68304","title":"Bluetooth: hci_core: lookup hci_conn on RX path on protocol side","status":"unfixed","project":false,"upstream":[{"sha":"79a2d4678ba90bdba577dc3af88cc900d6dcd5ee","url":"https://git.kernel.org/stable/c/79a2d4678ba90bdba577dc3af88cc900d6dcd5ee"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"79a2d4678ba90bdba577dc3af88cc900d6dcd5ee","lines":327,"reason":"","source":"https://github.com/torvalds/linux/commit/79a2d4678ba90bdba577dc3af88cc900d6dcd5ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68304","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68304.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68296","title":"drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup","status":"backported","project":false,"upstream":[{"sha":"eb76d0f5553575599561010f24c277cc5b31d003","url":"https://git.kernel.org/stable/c/eb76d0f5553575599561010f24c277cc5b31d003"}],"evidence":[{"url":"https://git.kernel.org/stable/c/482330f8261b4bea8146d9bd69c1199e5dfcbb5c","label":"482330f8261b","date":"2025-12-07T06:25:03+09:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb76d0f5553575599561010f24c277cc5b31d003","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/eb76d0f5553575599561010f24c277cc5b31d003.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68296","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68296.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68251","title":"erofs: avoid infinite loops due to corrupted subpage compact indexes","status":"backported","project":false,"upstream":[{"sha":"e13d315ae077bb7c3c6027cc292401bc0f4ec683","url":"https://git.kernel.org/stable/c/e13d315ae077bb7c3c6027cc292401bc0f4ec683"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dbfac1b85d0753996ddfef636934d431b588dd1f","label":"dbfac1b85d07","date":"2026-05-23T13:04:47+02:00","lore":["https://lore.kernel.org/r/35167.1760645886@localhost"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e13d315ae077bb7c3c6027cc292401bc0f4ec683","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68251","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68251.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68174","title":"amd/amdkfd: enhance kfd process check in switch partition","status":"backported","project":false,"upstream":[{"sha":"45da20e00d5da842e17dfc633072b127504f0d0e","url":"https://git.kernel.org/stable/c/45da20e00d5da842e17dfc633072b127504f0d0e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3385a1def2df45ac04a70532dfcd20d9eeac9fbb","label":"3385a1def2df","date":"2026-10-21T10:30:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"45da20e00d5da842e17dfc633072b127504f0d0e","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/45da20e00d5da842e17dfc633072b127504f0d0e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40355","title":"sysfs: check visibility before changing group attribute ownership","status":"backported","project":false,"upstream":[{"sha":"c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33","url":"https://git.kernel.org/stable/c/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5e963b5aca9c1c23f7a040d555a9bc21c0ab8819","label":"5e963b5aca9c","date":"2026-10-21T10:30:13+02:00","lore":["https://lore.kernel.org/netdev/01070199e22de7f8-28f711ab-d3f1-46d9-b9a0-048ab05eb09b-000000@eu-central-1.amazonses.com/","https://lore.kernel.org/r/20251016101456.4087-1-fmancera@suse.de"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40354","title":"drm/amd/display: increase max link count and fix link->enc NULL pointer access","status":"backported","project":false,"upstream":[{"sha":"bec947cbe9a65783adb475a5fb47980d7b4f4796","url":"https://git.kernel.org/stable/c/bec947cbe9a65783adb475a5fb47980d7b4f4796"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f28092be4e12b7df9e4f415d25bf0d767bc2d9ed","label":"f28092be4e12","date":"2025-10-29T14:08:57+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bec947cbe9a65783adb475a5fb47980d7b4f4796","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/bec947cbe9a65783adb475a5fb47980d7b4f4796.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40354","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40354.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40339","title":"drm/amdgpu: fix nullptr err of vm_handle_moved","status":"backported","project":false,"upstream":[{"sha":"859958a7faefe5b7742b7b8cdbc170713d4bf158","url":"https://git.kernel.org/stable/c/859958a7faefe5b7742b7b8cdbc170713d4bf158"}],"evidence":[{"url":"https://git.kernel.org/stable/c/47281febebe337586569aa4c5694a7511063a42e","label":"47281febebe3","date":"2025-11-13T15:34:13-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"859958a7faefe5b7742b7b8cdbc170713d4bf158","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/859958a7faefe5b7742b7b8cdbc170713d4bf158.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40339","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40339.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40333","title":"f2fs: fix infinite loop in __insert_extent_tree()","status":"backported","project":false,"upstream":[{"sha":"23361bd54966b437e1ed3eb1a704572f4b279e58","url":"https://git.kernel.org/stable/c/23361bd54966b437e1ed3eb1a704572f4b279e58"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c0b9951bb2668d67eb4817bb23fc109abc08c075","label":"c0b9951bb266","date":"2025-11-13T15:34:26-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"23361bd54966b437e1ed3eb1a704572f4b279e58","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/23361bd54966b437e1ed3eb1a704572f4b279e58.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40311","title":"accel/habanalabs: support mapping cb with vmalloc-backed coherent memory","status":"backported","project":false,"upstream":[{"sha":"513024d5a0e34fd34247043f1876b6138ca52847","url":"https://git.kernel.org/stable/c/513024d5a0e34fd34247043f1876b6138ca52847"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d1dfe21a332d38a6a09658ec29a55940afb5fe36","label":"d1dfe21a332d","date":"2025-11-13T15:34:30-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"513024d5a0e34fd34247043f1876b6138ca52847","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40311","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40311.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40303","title":"btrfs: ensure no dirty metadata is written back for an fs with errors","status":"backported","project":false,"upstream":[{"sha":"2618849f31e7cf51fadd4a5242458501a6d5b315","url":"https://git.kernel.org/stable/c/2618849f31e7cf51fadd4a5242458501a6d5b315"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e2b3859067bf012d53c49b3f885fef40624a2c83","label":"e2b3859067bf","date":"2025-11-13T15:34:36-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2618849f31e7cf51fadd4a5242458501a6d5b315","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/2618849f31e7cf51fadd4a5242458501a6d5b315.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40303","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40303.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40266","title":"KVM: arm64: Check the untrusted offset in FF-A memory share","status":"backported","project":false,"upstream":[{"sha":"103e17aac09cdd358133f9e00998b75d6c1f1518","url":"https://git.kernel.org/stable/c/103e17aac09cdd358133f9e00998b75d6c1f1518"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bc1909ef38788f2ee3d8011d70bf029948433051","label":"bc1909ef3878","date":"2025-12-01T11:43:18+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"103e17aac09cdd358133f9e00998b75d6c1f1518","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/103e17aac09cdd358133f9e00998b75d6c1f1518.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40266","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40266.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40247","title":"drm/msm: Fix pgtable prealloc error path","status":"unfixed","project":false,"upstream":[{"sha":"830d68f2cb8ab6fb798bb9555016709a9e012af0","url":"https://git.kernel.org/stable/c/830d68f2cb8ab6fb798bb9555016709a9e012af0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"830d68f2cb8ab6fb798bb9555016709a9e012af0","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/830d68f2cb8ab6fb798bb9555016709a9e012af0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40247","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40247.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40217","title":"pidfs: validate extensible ioctls","status":"unfixed","project":false,"upstream":[{"sha":"3c17001b21b9f168c957ced9384abe969019b609","url":"https://git.kernel.org/stable/c/3c17001b21b9f168c957ced9384abe969019b609"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3c17001b21b9f168c957ced9384abe969019b609","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/3c17001b21b9f168c957ced9384abe969019b609.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40168","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().","status":"backported","project":false,"upstream":[{"sha":"235f81045c008169cc4e1955b4a64e118eebe61b","url":"https://git.kernel.org/stable/c/235f81045c008169cc4e1955b4a64e118eebe61b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/326e5cf301d0bec0a672aa834d8254c4f9df6255","label":"326e5cf301d0","date":"2026-09-02T14:30:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"235f81045c008169cc4e1955b4a64e118eebe61b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40168","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40168.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40146","title":"blk-mq: fix potential deadlock while nr_requests grown","status":"unfixed","project":false,"upstream":[{"sha":"b86433721f46d934940528f28d49c1dedb690df1","url":"https://git.kernel.org/stable/c/b86433721f46d934940528f28d49c1dedb690df1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"b86433721f46d934940528f28d49c1dedb690df1","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/b86433721f46d934940528f28d49c1dedb690df1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40146","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40146.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40139","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().","status":"backported","project":false,"upstream":[{"sha":"935d783e5de9b64587f3adb25641dd8385e64ddb","url":"https://git.kernel.org/stable/c/935d783e5de9b64587f3adb25641dd8385e64ddb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/956c57daba55cf9ed25d9f2512883b8a1a927599","label":"956c57daba55","date":"2026-09-02T14:30:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"935d783e5de9b64587f3adb25641dd8385e64ddb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40139","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40139.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40102","title":"KVM: arm64: Prevent access to vCPU events before init","status":"backported","project":false,"upstream":[{"sha":"0aa1b76fe1429629215a7c79820e4b96233ac4a3","url":"https://git.kernel.org/stable/c/0aa1b76fe1429629215a7c79820e4b96233ac4a3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c0fcd72e7eb50205dc20731033b0b1c67ecbe4dc","label":"c0fcd72e7eb5","date":"2026-09-02T14:30:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0aa1b76fe1429629215a7c79820e4b96233ac4a3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40079","title":"riscv, bpf: Sign extend struct ops return values properly","status":"backported","project":false,"upstream":[{"sha":"fd2e08128944a7679e753f920e9eda72057e427c","url":"https://git.kernel.org/stable/c/fd2e08128944a7679e753f920e9eda72057e427c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/92751937f12a7d34ad492577a251c94a55e97e72","label":"92751937f12a","date":"2025-10-15T12:00:01+02:00","lore":["https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd2e08128944a7679e753f920e9eda72057e427c","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/fd2e08128944a7679e753f920e9eda72057e427c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40064","title":"smc: Fix use-after-free in __pnet_find_base_ndev().","status":"backported","project":false,"upstream":[{"sha":"3d3466878afd8d43ec0ca2facfbc7f03e40d0f79","url":"https://git.kernel.org/stable/c/3d3466878afd8d43ec0ca2facfbc7f03e40d0f79"}],"evidence":[{"url":"https://git.kernel.org/stable/c/08aca586482e88aab9616a3e81bc36cad22674a5","label":"08aca586482e","date":"2026-09-02T14:30:57+02:00","lore":["https://lore.kernel.org/netdev/68c237c7.050a0220.3c6139.0036.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3d3466878afd8d43ec0ca2facfbc7f03e40d0f79","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40064","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40064.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40025","title":"f2fs: fix to do sanity check on node footer for non inode dnode","status":"unfixed","project":false,"upstream":[{"sha":"c18ecd99e0c707ef8f83cace861cbc3162f4fdf1","url":"https://git.kernel.org/stable/c/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c18ecd99e0c707ef8f83cace861cbc3162f4fdf1","lines":144,"reason":"","source":"https://github.com/torvalds/linux/commit/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40025","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40025.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40000","title":"wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()","status":"backported","project":false,"upstream":[{"sha":"3e31a6bc07312b448fad3b45de578471f86f0e77","url":"https://git.kernel.org/stable/c/3e31a6bc07312b448fad3b45de578471f86f0e77"}],"evidence":[{"url":"https://git.kernel.org/stable/c/895cccf639ac015f3d5f993218cf098db82ac145","label":"895cccf639ac","date":"2025-10-12T12:57:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"3e31a6bc07312b448fad3b45de578471f86f0e77","lines":172,"reason":"","source":"https://github.com/torvalds/linux/commit/3e31a6bc07312b448fad3b45de578471f86f0e77.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40000","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40000.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39990","title":"bpf: Check the helper function is valid in get_helper_proto","status":"backported","project":false,"upstream":[{"sha":"e4414b01c1cd9887bbde92f946c1ba94e40d6d64","url":"https://git.kernel.org/stable/c/e4414b01c1cd9887bbde92f946c1ba94e40d6d64"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3d429cb1278e995e22995ef117fa96d223a67e93","label":"3d429cb1278e","date":"2025-10-02T13:44:08+02:00","lore":["https://lore.kernel.org/bpf/20250814200655.945632-1-jolsa@kernel.org","https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e4414b01c1cd9887bbde92f946c1ba94e40d6d64","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/e4414b01c1cd9887bbde92f946c1ba94e40d6d64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39981","title":"Bluetooth: MGMT: Fix possible UAFs","status":"backported","project":false,"upstream":[{"sha":"302a1f674c00dd5581ab8e493ef44767c5101aab","url":"https://git.kernel.org/stable/c/302a1f674c00dd5581ab8e493ef44767c5101aab"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d71b98f253b079cbadc83266383f26fe7e9e103b","label":"d71b98f253b0","date":"2025-11-24T10:35:56+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"302a1f674c00dd5581ab8e493ef44767c5101aab","lines":615,"reason":"","source":"https://github.com/torvalds/linux/commit/302a1f674c00dd5581ab8e493ef44767c5101aab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39981","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39981.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39961","title":"iommu/amd/pgtbl: Fix possible race while increase page table level","status":"backported","project":false,"upstream":[{"sha":"1e56310b40fd2e7e0b9493da9ff488af145bdd0c","url":"https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b","label":"cd92c8ab336c","date":"2025-09-25T11:13:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1e56310b40fd2e7e0b9493da9ff488af145bdd0c","lines":76,"reason":"","source":"https://github.com/torvalds/linux/commit/1e56310b40fd2e7e0b9493da9ff488af145bdd0c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39947","title":"net/mlx5e: Harden uplink netdev access against device unbind","status":"backported","project":false,"upstream":[{"sha":"6b4be64fd9fec16418f365c2d8e47a7566e9eba5","url":"https://git.kernel.org/stable/c/6b4be64fd9fec16418f365c2d8e47a7566e9eba5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d1f3db4e7a3be29fc17f01850f162363f919370d","label":"d1f3db4e7a3b","date":"2025-09-25T11:13:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6b4be64fd9fec16418f365c2d8e47a7566e9eba5","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/6b4be64fd9fec16418f365c2d8e47a7566e9eba5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39940","title":"dm-stripe: fix a possible integer overflow","status":"backported","project":false,"upstream":[{"sha":"1071d560afb4c245c2076494226df47db5a35708","url":"https://git.kernel.org/stable/c/1071d560afb4c245c2076494226df47db5a35708"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f8f64254bca5ae58f3b679441962bda4c409f659","label":"f8f64254bca5","date":"2025-09-25T11:13:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1071d560afb4c245c2076494226df47db5a35708","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/1071d560afb4c245c2076494226df47db5a35708.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39940","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39940.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39932","title":"smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)","status":"backported","project":false,"upstream":[{"sha":"d9dcbbcf9145b68aa85c40947311a6907277e097","url":"https://git.kernel.org/stable/c/d9dcbbcf9145b68aa85c40947311a6907277e097"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6ae90a2baf923e85eb037b636aa641250bf4220f","label":"6ae90a2baf92","date":"2025-09-25T11:13:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d9dcbbcf9145b68aa85c40947311a6907277e097","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d9dcbbcf9145b68aa85c40947311a6907277e097.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39927","title":"ceph: fix race condition validating r_parent before applying state","status":"backported","project":false,"upstream":[{"sha":"15f519e9f883b316d86e2bb6b767a023aafd9d83","url":"https://git.kernel.org/stable/c/15f519e9f883b316d86e2bb6b767a023aafd9d83"}],"evidence":[{"url":"https://git.kernel.org/stable/c/db378e6f83ec705c6091c65d482d555edc2b0a72","label":"db378e6f83ec","date":"2025-09-19T16:35:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"15f519e9f883b316d86e2bb6b767a023aafd9d83","lines":556,"reason":"","source":"https://github.com/torvalds/linux/commit/15f519e9f883b316d86e2bb6b767a023aafd9d83.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39927","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39927.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39925","title":"can: j1939: implement NETDEV_UNREGISTER notification handler","status":"backported","project":false,"upstream":[{"sha":"7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a","url":"https://git.kernel.org/stable/c/7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4e154cb5e7681c2910e2dfa09f05e3469e333745","label":"4e154cb5e768","date":"2026-09-02T14:30:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39925","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39925.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39862","title":"wifi: mt76: mt7915: fix list corruption after hardware restart","status":"backported","project":false,"upstream":[{"sha":"065c79df595af21d6d1b27d642860faa1d938774","url":"https://git.kernel.org/stable/c/065c79df595af21d6d1b27d642860faa1d938774"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6826728f9fd7e7db57cd9647932eea47cbc645c6","label":"6826728f9fd7","date":"2026-10-21T10:30:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"065c79df595af21d6d1b27d642860faa1d938774","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/065c79df595af21d6d1b27d642860faa1d938774.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39834","title":"net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow","status":"backported","project":false,"upstream":[{"sha":"a630f83592cdad1253523a1b760cfe78fef6cd9c","url":"https://git.kernel.org/stable/c/a630f83592cdad1253523a1b760cfe78fef6cd9c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a2751e1af5dc8b1a64cfd463576c58617c2573ac","label":"a2751e1af5dc","date":"2026-10-21T10:30:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2025-39834","series":"6.12.y","upstream":["a630f83592cdad1253523a1b760cfe78fef6cd9c"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"Invalid enum handling in shared STC allocation exits after allocation without freeing shared_stc.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_action.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_action.c?id=e2acc2211022246c77740d5df08265cc27eedcc5"},{"label":"Upstream fix a630f83592cd","url":"https://git.kernel.org/stable/c/a630f83592cdad1253523a1b760cfe78fef6cd9c"}]},"size":{"status":"within-limit","patches":[{"sha":"a630f83592cdad1253523a1b760cfe78fef6cd9c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/a630f83592cdad1253523a1b760cfe78fef6cd9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39833","title":"mISDN: hfcpci: Fix warning when deleting uninitialized timer","status":"backported","project":false,"upstream":[{"sha":"97766512a9951b9fd6fc97f1b93211642bb0b220","url":"https://git.kernel.org/stable/c/97766512a9951b9fd6fc97f1b93211642bb0b220"}],"evidence":[{"url":"https://git.kernel.org/stable/c/544ffd62ddd093c71150e4d4c542f98153fb8e46","label":"544ffd62ddd0","date":"2026-09-02T14:30:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"97766512a9951b9fd6fc97f1b93211642bb0b220","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39833","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39833.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39830","title":"net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path","status":"backported","project":false,"upstream":[{"sha":"2c0a959bebdc1ada13cf9a8242f177c5400299e6","url":"https://git.kernel.org/stable/c/2c0a959bebdc1ada13cf9a8242f177c5400299e6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4ccdbf50dd88a2a7399409e68887dd8077f6a562","label":"4ccdbf50dd88","date":"2026-10-21T10:30:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2025-39830","series":"6.12.y","upstream":["2c0a959bebdc1ada13cf9a8242f177c5400299e6"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"HWS buddy-init allocation failure cleans buddy internals but does not free the allocated buddy object.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_pool.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_pool.c?id=e2acc2211022246c77740d5df08265cc27eedcc5"},{"label":"Upstream fix 2c0a959bebdc","url":"https://git.kernel.org/stable/c/2c0a959bebdc1ada13cf9a8242f177c5400299e6"}]},"size":{"status":"within-limit","patches":[{"sha":"2c0a959bebdc1ada13cf9a8242f177c5400299e6","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/2c0a959bebdc1ada13cf9a8242f177c5400299e6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39830","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39830.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39822","title":"io_uring/kbuf: fix signedness in this_len calculation","status":"unfixed","project":false,"upstream":[{"sha":"c64eff368ac676e8540344d27a3de47e0ad90d21","url":"https://git.kernel.org/stable/c/c64eff368ac676e8540344d27a3de47e0ad90d21"},{"sha":"c4dbca5be33c6203d2f611dbd7502f887e4cd954","url":"https://git.kernel.org/stable/c/c4dbca5be33c6203d2f611dbd7502f887e4cd954"}],"evidence":[],"submission_lore":[],"basis":"pre-introduction","review":null,"size":{"status":"within-limit","patches":[{"sha":"c64eff368ac676e8540344d27a3de47e0ad90d21","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/c64eff368ac676e8540344d27a3de47e0ad90d21.patch"},{"sha":"c4dbca5be33c6203d2f611dbd7502f887e4cd954","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/c4dbca5be33c6203d2f611dbd7502f887e4cd954.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39822","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39822.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39789","title":"crypto: x86/aegis - Add missing error checks","status":"backported","project":false,"upstream":[{"sha":"3d9eb180fbe8828cce43bce4c370124685b205c3","url":"https://git.kernel.org/stable/c/3d9eb180fbe8828cce43bce4c370124685b205c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b4ba650125d21e937f82fcafcd2738fe31209c05","label":"b4ba650125d2","date":"2026-10-21T10:30:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3d9eb180fbe8828cce43bce4c370124685b205c3","lines":97,"reason":"","source":"https://github.com/torvalds/linux/commit/3d9eb180fbe8828cce43bce4c370124685b205c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39789","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39789.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39779","title":"btrfs: subpage: keep TOWRITE tag until folio is cleaned","status":"backported","project":false,"upstream":[{"sha":"b1511360c8ac882b0c52caa263620538e8d73220","url":"https://git.kernel.org/stable/c/b1511360c8ac882b0c52caa263620538e8d73220"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3d61136945a7008fc90d013c3c67007ce0c96131","label":"3d61136945a7","date":"2025-08-28T16:31:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b1511360c8ac882b0c52caa263620538e8d73220","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/b1511360c8ac882b0c52caa263620538e8d73220.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39779","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39779.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39775","title":"mm/mremap: fix WARN with uffd that has remap events disabled","status":"backported","project":false,"upstream":[{"sha":"772e5b4a5e8360743645b9a466842d16092c4f94","url":"https://git.kernel.org/stable/c/772e5b4a5e8360743645b9a466842d16092c4f94"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1c15b4cd3a97aea013bdb18d9a55ca0384fbb8d4","label":"1c15b4cd3a97","date":"2026-10-21T10:30:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"772e5b4a5e8360743645b9a466842d16092c4f94","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/772e5b4a5e8360743645b9a466842d16092c4f94.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39762","title":"drm/amd/display: add null check","status":"unfixed","project":false,"upstream":[{"sha":"158b9201c17fc93ed4253c2f03b77fd2671669a1","url":"https://git.kernel.org/stable/c/158b9201c17fc93ed4253c2f03b77fd2671669a1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"158b9201c17fc93ed4253c2f03b77fd2671669a1","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/158b9201c17fc93ed4253c2f03b77fd2671669a1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39747","title":"drm/msm: Add error handling for krealloc in metadata setup","status":"backported","project":false,"upstream":[{"sha":"1c8c354098ea9d4376a58c96ae6b65288a6f15d8","url":"https://git.kernel.org/stable/c/1c8c354098ea9d4376a58c96ae6b65288a6f15d8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/53dc780c1e94ea782d8936b41bfaa83c663702eb","label":"53dc780c1e94","date":"2025-08-20T18:30:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c8c354098ea9d4376a58c96ae6b65288a6f15d8","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/1c8c354098ea9d4376a58c96ae6b65288a6f15d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39747","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39747.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39746","title":"wifi: ath10k: shutdown driver when hardware is unreliable","status":"backported","project":false,"upstream":[{"sha":"c256a94d1b1b15109740306f7f2a7c2173e12072","url":"https://git.kernel.org/stable/c/c256a94d1b1b15109740306f7f2a7c2173e12072"}],"evidence":[{"url":"https://git.kernel.org/stable/c/201c9b4485edc618863a60f97a2d88bddd139467","label":"201c9b4485ed","date":"2025-08-20T18:30:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c256a94d1b1b15109740306f7f2a7c2173e12072","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/c256a94d1b1b15109740306f7f2a7c2173e12072.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39746","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39746.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39732","title":"wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()","status":"backported","project":false,"upstream":[{"sha":"65c12b104cb942d588a1a093acc4537fb3d3b129","url":"https://git.kernel.org/stable/c/65c12b104cb942d588a1a093acc4537fb3d3b129"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9c0e3144924c7db701575a73af341d33184afeaf","label":"9c0e3144924c","date":"2025-08-15T12:13:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"65c12b104cb942d588a1a093acc4537fb3d3b129","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/65c12b104cb942d588a1a093acc4537fb3d3b129.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39732","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39732.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39707","title":"drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities","status":"backported","project":false,"upstream":[{"sha":"b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288","url":"https://git.kernel.org/stable/c/b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288"}],"evidence":[{"url":"https://git.kernel.org/stable/c/83cfdc2b018cd9c0f927b781d4e07c0d4a911fac","label":"83cfdc2b018c","date":"2025-08-28T16:31:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39707","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39707.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38722","title":"habanalabs: fix UAF in export_dmabuf()","status":"backported","project":false,"upstream":[{"sha":"33927f3d0ecdcff06326d6e4edb6166aed42811c","url":"https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231","label":"c07886761fd6","date":"2025-08-20T18:30:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"33927f3d0ecdcff06326d6e4edb6166aed42811c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38722","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38722.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38717","title":"net: kcm: Fix race condition in kcm_unattach()","status":"backported","project":false,"upstream":[{"sha":"52565a935213cd6a8662ddb8efe5b4219343a25d","url":"https://git.kernel.org/stable/c/52565a935213cd6a8662ddb8efe5b4219343a25d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c0bffbc92a1ca3960fb9cdb8e9f75a68468eb308","label":"c0bffbc92a1c","date":"2025-08-20T18:30:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"52565a935213cd6a8662ddb8efe5b4219343a25d","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/52565a935213cd6a8662ddb8efe5b4219343a25d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38717","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38717.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38716","title":"hfs: fix general protection fault in hfs_find_init()","status":"backported","project":false,"upstream":[{"sha":"736a0516a16268995f4898eded49bfef077af709","url":"https://git.kernel.org/stable/c/736a0516a16268995f4898eded49bfef077af709"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5d8b249527362e0ccafcaf76b3bec2a0d2aa1498","label":"5d8b24952736","date":"2025-08-20T18:30:18+02:00","lore":["https://lore.kernel.org/r/20250710213657.108285-1-slava@dubeyko.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"736a0516a16268995f4898eded49bfef077af709","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/736a0516a16268995f4898eded49bfef077af709.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38716","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38716.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38675","title":"xfrm: state: initialize state_ptrs earlier in xfrm_state_find","status":"backported","project":false,"upstream":[{"sha":"94d077c331730510d5611b438640a292097341f0","url":"https://git.kernel.org/stable/c/94d077c331730510d5611b438640a292097341f0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6bf2daafc51bcb9272c0fdff2afd38217337d0d3","label":"6bf2daafc51b","date":"2025-08-01T09:48:40+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"94d077c331730510d5611b438640a292097341f0","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/94d077c331730510d5611b438640a292097341f0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38675","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38675.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38660","title":"[ceph] parse_longname(): strrchr() expects NUL-terminated string","status":"backported","project":false,"upstream":[{"sha":"101841c38346f4ca41dc1802c867da990ffb32eb","url":"https://git.kernel.org/stable/c/101841c38346f4ca41dc1802c867da990ffb32eb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bb80f7618832d26f7e395f52f82b1dac76223e5f","label":"bb80f7618832","date":"2025-08-15T12:13:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"101841c38346f4ca41dc1802c867da990ffb32eb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38660","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38660.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38656","title":"wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()","status":"backported","project":false,"upstream":[{"sha":"cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6","url":"https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f95598a133a905fd937354ad902773d05593b8b9","label":"f95598a133a9","date":"2026-10-21T10:30:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38656","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38656.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38636","title":"rv: Use strings in da monitors tracepoints","status":"backported","project":false,"upstream":[{"sha":"7f904ff6e58d398c4336f3c19c42b338324451f7","url":"https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/665ca03e93cee01baadc7b5eaee21b9d892e0dab","label":"665ca03e93ce","date":"2026-10-21T10:30:11+02:00","lore":["https://lore.kernel.org/20250728135022.255578-4-gmonaco@redhat.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2025-38636","series":"6.12.y","upstream":["7f904ff6e58d398c4336f3c19c42b338324451f7"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"DA trace classes use fixed __array plus MAX_DA_NAME_LEN memcpy","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: include/trace/events/rv.h","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/trace/events/rv.h?id=e2acc2211022246c77740d5df08265cc27eedcc5"},{"label":"Upstream fix 7f904ff6e58d","url":"https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7"}]},"size":{"status":"unknown","patches":[{"sha":"7f904ff6e58d398c4336f3c19c42b338324451f7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38636","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38636.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38621","title":"md: make rdev_addable usable for rcu mode","status":"backported","project":true,"upstream":[{"sha":"13017b427118f4311471ee47df74872372ca8482","url":"https://git.kernel.org/stable/c/13017b427118f4311471ee47df74872372ca8482"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d713e105a6137d3f54f09d4d9e2273482057ca17","label":"d713e105a613","date":"2026-09-07T17:17:57+02:00","lore":["https://lore.kernel.org/linux-raid/20250731114530.776670-1-yangerkun@huawei.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"13017b427118f4311471ee47df74872372ca8482","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38621","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38621.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38616","title":"tls: handle data disappearing from under the TLS ULP","status":"backported","project":false,"upstream":[{"sha":"6db015fc4b5d5f63a64a193f65d98da3a7fc811d","url":"https://git.kernel.org/stable/c/6db015fc4b5d5f63a64a193f65d98da3a7fc811d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155","label":"eb0336f213fe","date":"2025-08-20T18:30:18+02:00","lore":["https://lore.kernel.org/tFjq_kf7sWIG3A7CrCg_egb8CVsT_gsmHAK0_wxDPJXfIzxFAMxqmLwp3MlU5EHiet0AwwJldaaFdgyHpeIUCS-3m3llsmRzp9xIOBR4lAI=@syst3mfailure.io"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6db015fc4b5d5f63a64a193f65d98da3a7fc811d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38616","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38616.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38591","title":"bpf: Reject narrower access to pointer ctx fields","status":"backported","project":false,"upstream":[{"sha":"e09299225d5ba3916c91ef70565f7d2187e4cca0","url":"https://git.kernel.org/stable/c/e09299225d5ba3916c91ef70565f7d2187e4cca0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/058a0da4f6d916a79b693384111bb80a90d73763","label":"058a0da4f6d9","date":"2026-01-23T11:18:50+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e09299225d5ba3916c91ef70565f7d2187e4cca0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38585","title":"staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()","status":"backported","project":false,"upstream":[{"sha":"ee4cf798202d285dcbe85e4467a094c44f5ed8e6","url":"https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","url":"https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ee4cf798202d285dcbe85e4467a094c44f5ed8e6","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/ee4cf798202d285dcbe85e4467a094c44f5ed8e6.patch"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","lines":168072,"reason":"","source":"https://github.com/torvalds/linux/commit/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38585","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38585.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38449","title":"drm/gem: Acquire references on GEM handles for framebuffers","status":"backported","project":false,"upstream":[{"sha":"5307dce878d4126e1b375587318955bd019c3741","url":"https://git.kernel.org/stable/c/5307dce878d4126e1b375587318955bd019c3741"}],"evidence":[{"url":"https://git.kernel.org/stable/c/08480e285c6a82ce689008d643e4a51db0aaef8b","label":"08480e285c6a","date":"2025-07-17T18:37:11+02:00","lore":["https://lore.kernel.org/r/20250630084001.293053-1-tzimmermann@suse.de"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"5307dce878d4126e1b375587318955bd019c3741","lines":122,"reason":"","source":"https://github.com/torvalds/linux/commit/5307dce878d4126e1b375587318955bd019c3741.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38438","title":"ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.","status":"backported","project":false,"upstream":[{"sha":"6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e","url":"https://git.kernel.org/stable/c/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/68397fda2caa90e99a7c0bcb2cf604e42ef3b91f","label":"68397fda2caa","date":"2025-07-17T18:37:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38438","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38438.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38426","title":"drm/amdgpu: Add basic validation for RAS header","status":"backported","project":false,"upstream":[{"sha":"5df0d6addb7e9b6f71f7162d1253762a5be9138e","url":"https://git.kernel.org/stable/c/5df0d6addb7e9b6f71f7162d1253762a5be9138e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0479268fdfaaff6e15d69e8a8387410f36d1b793","label":"0479268fdfaa","date":"2026-03-25T11:08:46+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5df0d6addb7e9b6f71f7162d1253762a5be9138e","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/5df0d6addb7e9b6f71f7162d1253762a5be9138e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38426","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38426.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38372","title":"RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling","status":"backported","project":false,"upstream":[{"sha":"2c6b640ea08bff1a192bf87fa45246ff1e40767c","url":"https://git.kernel.org/stable/c/2c6b640ea08bff1a192bf87fa45246ff1e40767c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9d2ef890e49963b768d4fe5a33029aacd9f6b93f","label":"9d2ef890e499","date":"2025-07-10T16:04:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c6b640ea08bff1a192bf87fa45246ff1e40767c","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/2c6b640ea08bff1a192bf87fa45246ff1e40767c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38372","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38372.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38369","title":"dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using","status":"backported","project":false,"upstream":[{"sha":"17502e7d7b7113346296f6758324798d536c31fd","url":"https://git.kernel.org/stable/c/17502e7d7b7113346296f6758324798d536c31fd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/98fd66c8ba77e3a7137575f610271014bc0e701f","label":"98fd66c8ba77","date":"2025-07-06T11:01:33+02:00","lore":["https://lore.kernel.org/r/20250509000304.1402863-1-yi.sun@intel.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"17502e7d7b7113346296f6758324798d536c31fd","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/17502e7d7b7113346296f6758324798d536c31fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38369","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38369.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38333","title":"f2fs: fix to bail out in get_new_segment()","status":"backported","project":false,"upstream":[{"sha":"bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2","url":"https://git.kernel.org/stable/c/bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f0023d7a2a86999c8e1300e911d92f995a5310a8","label":"f0023d7a2a86","date":"2025-06-27T11:11:32+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38311","title":"iavf: get rid of the crit lock","status":"unfixed","project":false,"upstream":[{"sha":"120f28a6f314fef7f282c99f196923fe44081cad","url":"https://git.kernel.org/stable/c/120f28a6f314fef7f282c99f196923fe44081cad"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"120f28a6f314fef7f282c99f196923fe44081cad","lines":513,"reason":"","source":"https://github.com/torvalds/linux/commit/120f28a6f314fef7f282c99f196923fe44081cad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38311","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38311.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38264","title":"nvme-tcp: sanitize request list handling","status":"backported","project":false,"upstream":[{"sha":"0bf04c874fcb1ae46a863034296e4b33d8fbd66c","url":"https://git.kernel.org/stable/c/0bf04c874fcb1ae46a863034296e4b33d8fbd66c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/78a4adcd3fedb0728436e8094848ebf4c6bae006","label":"78a4adcd3fed","date":"2025-07-06T11:01:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0bf04c874fcb1ae46a863034296e4b33d8fbd66c","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/0bf04c874fcb1ae46a863034296e4b33d8fbd66c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38264","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38264.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38237","title":"media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()","status":"backported","project":false,"upstream":[{"sha":"bd9f6ce7d512fa21249415c16af801a4ed5d97b6","url":"https://git.kernel.org/stable/c/bd9f6ce7d512fa21249415c16af801a4ed5d97b6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2fbe83fe23f541798bcdd7d6b56a08d4ac205bad","label":"2fbe83fe23f5","date":"2026-09-02T14:30:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"bd9f6ce7d512fa21249415c16af801a4ed5d97b6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38207","title":"mm: fix uprobe pte be overwritten when expanding vma","status":"backported","project":false,"upstream":[{"sha":"2b12d06c37fd3a394376f42f026a7478d826ed63","url":"https://git.kernel.org/stable/c/2b12d06c37fd3a394376f42f026a7478d826ed63"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7030046a9b4de8199a3cbc3de20366d95dce2142","label":"7030046a9b4d","date":"2026-10-21T10:30:09+02:00","lore":["https://lore.kernel.org/all/000000000000ada39605a5e71711@google.com/T/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b12d06c37fd3a394376f42f026a7478d826ed63","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/2b12d06c37fd3a394376f42f026a7478d826ed63.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38207","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38207.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38206","title":"exfat: fix double free in delayed_free","status":"backported","project":false,"upstream":[{"sha":"1f3d9724e16d62c7d42c67d6613b8512f2887c22","url":"https://git.kernel.org/stable/c/1f3d9724e16d62c7d42c67d6613b8512f2887c22"}],"evidence":[{"url":"https://git.kernel.org/stable/c/29abaf93357f4a7d083cf399d4306999e20db31d","label":"29abaf93357f","date":"2026-09-02T14:30:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1f3d9724e16d62c7d42c67d6613b8512f2887c22","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38206","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38206.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38205","title":"drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1","status":"backported","project":true,"upstream":[{"sha":"7e40f64896e8e3dca471e287672db5ace12ea0be","url":"https://git.kernel.org/stable/c/7e40f64896e8e3dca471e287672db5ace12ea0be"}],"evidence":[{"url":"https://git.kernel.org/stable/c/03a3dbca3b8e55b88958ce1f54aaf678ded11c79","label":"03a3dbca3b8e","date":"2026-09-07T17:17:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7e40f64896e8e3dca471e287672db5ace12ea0be","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38205","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38205.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38203","title":"jfs: Fix null-ptr-deref in jfs_ioc_trim","status":"backported","project":false,"upstream":[{"sha":"a4685408ff6c3e2af366ad9a7274f45ff3f394ee","url":"https://git.kernel.org/stable/c/a4685408ff6c3e2af366ad9a7274f45ff3f394ee"}],"evidence":[{"url":"https://git.kernel.org/stable/c/233340626cf1b1887dca181f9f811db60c73f802","label":"233340626cf1","date":"2026-09-02T14:30:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a4685408ff6c3e2af366ad9a7274f45ff3f394ee","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38203","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38203.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38199","title":"wifi: ath12k: Fix memory leak due to multiple rx_stats allocation","status":"backported","project":false,"upstream":[{"sha":"c426497fa2055c8005196922e7d29c41d7e0948a","url":"https://git.kernel.org/stable/c/c426497fa2055c8005196922e7d29c41d7e0948a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2c4b122c75581331177686f68a08981371147d37","label":"2c4b122c7558","date":"2026-10-21T10:30:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c426497fa2055c8005196922e7d29c41d7e0948a","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/c426497fa2055c8005196922e7d29c41d7e0948a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38199","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38199.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38187","title":"drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()","status":"backported","project":false,"upstream":[{"sha":"9802f0a63b641f4cddb2139c814c2e95cb825099","url":"https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099"}],"evidence":[{"url":"https://git.kernel.org/stable/c/69270d24af7694494ac4116bcad30a812ca49ca7","label":"69270d24af76","date":"2026-10-21T10:30:09+02:00","lore":["https://lore.kernel.org/r/20250527163712.3444-1-zhiw@nvidia.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2025-38187","series":"6.12.y","upstream":["9802f0a63b641f4cddb2139c814c2e95cb825099"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"r535_gsp_rpc_push() retains the vulnerable RPC chunk/message lifetime sequence and does not release the message on successful reply.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n725"},{"label":"Upstream fix 9802f0a63b64","url":"https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099"}]},"size":{"status":"within-limit","patches":[{"sha":"9802f0a63b641f4cddb2139c814c2e95cb825099","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/9802f0a63b641f4cddb2139c814c2e95cb825099.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38187","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38187.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38140","title":"dm: limit swapping tables for devices with zone write plugs","status":"backported","project":false,"upstream":[{"sha":"121218bef4c1df165181f5cd8fc3a2246bac817e","url":"https://git.kernel.org/stable/c/121218bef4c1df165181f5cd8fc3a2246bac817e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/13c0425c99c67c2296f1eec61254a4f91484eac3","label":"13c0425c99c6","date":"2026-10-21T10:30:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"121218bef4c1df165181f5cd8fc3a2246bac817e","lines":166,"reason":"","source":"https://github.com/torvalds/linux/commit/121218bef4c1df165181f5cd8fc3a2246bac817e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38140","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38140.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38137","title":"PCI/pwrctrl: Cancel outstanding rescan work when unregistering","status":"backported","project":false,"upstream":[{"sha":"8b926f237743f020518162c62b93cb7107a2b5eb","url":"https://git.kernel.org/stable/c/8b926f237743f020518162c62b93cb7107a2b5eb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a63ed775f476ba81558bba24d7538836e1ffb823","label":"a63ed775f476","date":"2026-10-21T10:30:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2025-38137","series":"6.12.y","upstream":["8b926f237743f020518162c62b93cb7107a2b5eb"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"applicable","applicability":"affected","reason":"pci_pwrctl_device_unset_ready unregisters notifier without draining rescan_work_func","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/pci/pwrctl/core.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/pci/pwrctl/core.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n106"},{"label":"Upstream fix 8b926f237743","url":"https://git.kernel.org/stable/c/8b926f237743f020518162c62b93cb7107a2b5eb"}]},"size":{"status":"within-limit","patches":[{"sha":"8b926f237743f020518162c62b93cb7107a2b5eb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/8b926f237743f020518162c62b93cb7107a2b5eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38080","title":"drm/amd/display: Increase block_sequence array size","status":"backported","project":false,"upstream":[{"sha":"3a7810c212bcf2f722671dadf4b23ff70a7d23ee","url":"https://git.kernel.org/stable/c/3a7810c212bcf2f722671dadf4b23ff70a7d23ee"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e55c5704b12eeea27e212bfab8f7e51ad3e8ac1f","label":"e55c5704b12e","date":"2025-05-29T11:02:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a7810c212bcf2f722671dadf4b23ff70a7d23ee","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3a7810c212bcf2f722671dadf4b23ff70a7d23ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38080","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38080.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38039","title":"net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled","status":"backported","project":false,"upstream":[{"sha":"689805dcc474c2accb5cffbbcea1c06ee4a54570","url":"https://git.kernel.org/stable/c/689805dcc474c2accb5cffbbcea1c06ee4a54570"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b82e496531c571caf8a2ef247f51c160bab2162e","label":"b82e496531c5","date":"2025-05-29T11:03:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"689805dcc474c2accb5cffbbcea1c06ee4a54570","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/689805dcc474c2accb5cffbbcea1c06ee4a54570.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38039","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38039.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38038","title":"cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost","status":"backported","project":false,"upstream":[{"sha":"db1cafc77aaaf871509da06f4a864e9af6d6791f","url":"https://git.kernel.org/stable/c/db1cafc77aaaf871509da06f4a864e9af6d6791f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/61e931ee145eeab8196e585ff4334870b130b744","label":"61e931ee145e","date":"2025-05-29T11:03:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"db1cafc77aaaf871509da06f4a864e9af6d6791f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/db1cafc77aaaf871509da06f4a864e9af6d6791f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38038","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38038.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38036","title":"drm/xe/vf: Perform early GT MMIO initialization to read GMDID","status":"unfixed","project":false,"upstream":[{"sha":"13265fe7426ec9ba5aa86baab913417ca361e8a4","url":"https://git.kernel.org/stable/c/13265fe7426ec9ba5aa86baab913417ca361e8a4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"13265fe7426ec9ba5aa86baab913417ca361e8a4","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/13265fe7426ec9ba5aa86baab913417ca361e8a4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38036","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38036.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38014","title":"dmaengine: idxd: Refactor remove call with idxd_cleanup() helper","status":"backported","project":false,"upstream":[{"sha":"a409e919ca321cc0e28f8abf96fde299f0072a81","url":"https://git.kernel.org/stable/c/a409e919ca321cc0e28f8abf96fde299f0072a81"}],"evidence":[{"url":"https://git.kernel.org/stable/c/23dc14c52d84b02b39d816bf16a754c0e7d48f9c","label":"23dc14c52d84","date":"2025-05-22T14:29:52+02:00","lore":["https://lore.kernel.org/r/20250404120217.48772-10-xueshuai@linux.alibaba.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a409e919ca321cc0e28f8abf96fde299f0072a81","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/a409e919ca321cc0e28f8abf96fde299f0072a81.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38014","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38014.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37907","title":"accel/ivpu: Fix locking order in ivpu_job_submit","status":"backported","project":false,"upstream":[{"sha":"ab680dc6c78aa035e944ecc8c48a1caab9f39924","url":"https://git.kernel.org/stable/c/ab680dc6c78aa035e944ecc8c48a1caab9f39924"}],"evidence":[{"url":"https://git.kernel.org/stable/c/079d2622f8c9e0c380149645fff21d35c59ce6ff","label":"079d2622f8c9","date":"2025-05-09T09:50:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ab680dc6c78aa035e944ecc8c48a1caab9f39924","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/ab680dc6c78aa035e944ecc8c48a1caab9f39924.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37907","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37907.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37880","title":"um: work around sched_yield not yielding in time-travel mode","status":"backported","project":false,"upstream":[{"sha":"887c5c12e80c8424bd471122d2e8b6b462e12874","url":"https://git.kernel.org/stable/c/887c5c12e80c8424bd471122d2e8b6b462e12874"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6aac2c54762c4b0b1cbd8c7ffa365283e171bf5d","label":"6aac2c54762c","date":"2025-05-18T08:24:57+02:00","lore":["https://lore.kernel.org/linux-um/8ce0b6056a9726e540f61bce77311278654219eb.camel@sipsolutions.net/"]}],"submission_lore":[],"basis":"Released fix reverted; CNA fixed metadata overridden","review":null,"size":{"status":"within-limit","patches":[{"sha":"887c5c12e80c8424bd471122d2e8b6b462e12874","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/887c5c12e80c8424bd471122d2e8b6b462e12874.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37880","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37880.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37870","title":"drm/amd/display: prevent hang on link training fail","status":"backported","project":false,"upstream":[{"sha":"8058061ed9d6bc259d1e678607b07d259342c08f","url":"https://git.kernel.org/stable/c/8058061ed9d6bc259d1e678607b07d259342c08f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0363c03672cd3191f037905bf981eb523a3b71b1","label":"0363c03672cd","date":"2025-04-25T10:47:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8058061ed9d6bc259d1e678607b07d259342c08f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8058061ed9d6bc259d1e678607b07d259342c08f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37834","title":"mm/vmscan: don't try to reclaim hwpoison folio","status":"backported","project":false,"upstream":[{"sha":"1b0449544c6482179ac84530b61fc192a6527bfd","url":"https://git.kernel.org/stable/c/1b0449544c6482179ac84530b61fc192a6527bfd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1c9798bf8145a92abf45aa9d38a6406d9eb8bdf0","label":"1c9798bf8145","date":"2025-05-02T07:58:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1b0449544c6482179ac84530b61fc192a6527bfd","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/1b0449544c6482179ac84530b61fc192a6527bfd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37833","title":"net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads","status":"backported","project":false,"upstream":[{"sha":"fbb429ddff5c8e479edcc7dde5a542c9295944e6","url":"https://git.kernel.org/stable/c/fbb429ddff5c8e479edcc7dde5a542c9295944e6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c187aaa9e79b4b6d86ac7ba941e579ad33df5538","label":"c187aaa9e79b","date":"2025-05-02T07:58:58+02:00","lore":["https://lore.kernel.org/all/20241117234843.19236-3-dullfire@yahoo.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fbb429ddff5c8e479edcc7dde5a542c9295944e6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37833","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37833.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37826","title":"scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()","status":"backported","project":false,"upstream":[{"sha":"08a966a917fe3d92150fa3cc15793ad5e57051eb","url":"https://git.kernel.org/stable/c/08a966a917fe3d92150fa3cc15793ad5e57051eb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/eeab6618037be84e438e9d6ed5d9a53502faf81f","label":"eeab6618037b","date":"2025-05-02T07:59:01+02:00","lore":["https://lore.kernel.org/r/20250412195909.315418-1-chenyuan0y@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"08a966a917fe3d92150fa3cc15793ad5e57051eb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/08a966a917fe3d92150fa3cc15793ad5e57051eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37802","title":"ksmbd: fix WARNING \"do not call blocking ops when !TASK_RUNNING\"","status":"backported","project":false,"upstream":[{"sha":"1df0d4c616138784e033ad337961b6e1a6bcd999","url":"https://git.kernel.org/stable/c/1df0d4c616138784e033ad337961b6e1a6bcd999"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8f805b3746d2f41702c77cba22f94f8415fadd1a","label":"8f805b3746d2","date":"2025-05-02T07:59:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1df0d4c616138784e033ad337961b6e1a6bcd999","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/1df0d4c616138784e033ad337961b6e1a6bcd999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37802","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37802.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37800","title":"driver core: fix potential NULL pointer dereference in dev_uevent()","status":"backported","project":false,"upstream":[{"sha":"18daa52418e7e4629ed1703b64777294209d2622","url":"https://git.kernel.org/stable/c/18daa52418e7e4629ed1703b64777294209d2622"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2b344e779d9afd0fcb5ee4000e4d0fc7d8d867eb","label":"2b344e779d9a","date":"2025-05-02T07:59:29+02:00","lore":["https://lore.kernel.org/r/20250311052417.1846985-3-dmitry.torokhov@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"18daa52418e7e4629ed1703b64777294209d2622","lines":79,"reason":"","source":"https://github.com/torvalds/linux/commit/18daa52418e7e4629ed1703b64777294209d2622.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37800","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37800.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37777","title":"ksmbd: fix use-after-free in __smb2_lease_break_noti()","status":"backported","project":false,"upstream":[{"sha":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","url":"https://git.kernel.org/stable/c/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1aec4d14cf81b7b3e7b69eb1cfa94144eed7138e","label":"1aec4d14cf81","date":"2025-05-02T07:58:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37777","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37777.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37776","title":"ksmbd: fix use-after-free in smb_break_all_levII_oplock()","status":"backported","project":false,"upstream":[{"sha":"18b4fac5ef17f77fed9417d22210ceafd6525fc7","url":"https://git.kernel.org/stable/c/18b4fac5ef17f77fed9417d22210ceafd6525fc7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d54ab1520d43e95f9b2e22d7a05fc9614192e5a5","label":"d54ab1520d43","date":"2025-04-25T10:47:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"18b4fac5ef17f77fed9417d22210ceafd6525fc7","lines":91,"reason":"","source":"https://github.com/torvalds/linux/commit/18b4fac5ef17f77fed9417d22210ceafd6525fc7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37776","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37776.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37750","title":"smb: client: fix UAF in decryption with multichannel","status":"backported","project":false,"upstream":[{"sha":"9502dd5c7029902f4a425bf959917a5a9e7c0e50","url":"https://git.kernel.org/stable/c/9502dd5c7029902f4a425bf959917a5a9e7c0e50"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15","label":"aa5a1e4b8829","date":"2025-04-20T10:15:08+02:00","lore":["https://lore.kernel.org/r/CAH2r5mu6Yc0-RJXM3kFyBYUB09XmXBrNodOiCVR4EDrmxq5Szg@mail.gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9502dd5c7029902f4a425bf959917a5a9e7c0e50","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37750","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37750.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23133","title":"wifi: ath11k: update channel list in reg notifier instead reg worker","status":"backported","project":false,"upstream":[{"sha":"933ab187e679e6fbdeea1835ae39efcc59c022d2","url":"https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/26618c039b78a76c373d4e02c5fbd52e3a73aead","label":"26618c039b78","date":"2025-09-09T18:58:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"933ab187e679e6fbdeea1835ae39efcc59c022d2","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/933ab187e679e6fbdeea1835ae39efcc59c022d2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23133","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23133.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23132","title":"f2fs: quota: fix to avoid warning in dquot_writeback_dquots()","status":"backported","project":false,"upstream":[{"sha":"eb85c2410d6f581e957cd03a644ff6ddbe592af9","url":"https://git.kernel.org/stable/c/eb85c2410d6f581e957cd03a644ff6ddbe592af9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9ec535db9da76dafa05c89f8b58a0b1d7dddba1c","label":"9ec535db9da7","date":"2026-10-21T10:30:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"eb85c2410d6f581e957cd03a644ff6ddbe592af9","lines":232,"reason":"","source":"https://github.com/torvalds/linux/commit/eb85c2410d6f581e957cd03a644ff6ddbe592af9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23132","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23132.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23130","title":"f2fs: fix to avoid panic once fallocation fails for pinfile","status":"backported","project":false,"upstream":[{"sha":"48ea8b200414ac69ea96f4c231f5c7ef1fbeffef","url":"https://git.kernel.org/stable/c/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2dda0930fb79b847b4bfceb737577d0f6bc24d7d","label":"2dda0930fb79","date":"2025-11-02T22:15:22+09:00","lore":["https://lore.kernel.org/linux-f2fs-devel/675cd64e.050a0220.37aaf.00bb.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"48ea8b200414ac69ea96f4c231f5c7ef1fbeffef","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23130","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23130.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23129","title":"wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path","status":"backported","project":false,"upstream":[{"sha":"68410c5bd381a81bcc92b808e7dc4e6b9ed25d11","url":"https://git.kernel.org/stable/c/68410c5bd381a81bcc92b808e7dc4e6b9ed25d11"}],"evidence":[{"url":"https://git.kernel.org/stable/c/80dc5a2ce5b75d648e08549617f5c555d07ae43c","label":"80dc5a2ce5b7","date":"2025-11-24T10:35:55+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"68410c5bd381a81bcc92b808e7dc4e6b9ed25d11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22127","title":"f2fs: fix potential deadloop in prepare_compress_overwrite()","status":"backported","project":true,"upstream":[{"sha":"3147ee567dd9004a49826ddeaf0a4b12865d4409","url":"https://git.kernel.org/stable/c/3147ee567dd9004a49826ddeaf0a4b12865d4409"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7cd460bd9e7c6e6c30a33982603f65fb5deab1e4","label":"7cd460bd9e7c","date":"2026-09-07T17:17:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3147ee567dd9004a49826ddeaf0a4b12865d4409","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22127","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22127.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22125","title":"md/raid1,raid10: don't ignore IO flags","status":"backported","project":false,"upstream":[{"sha":"e879a0d9cb086c8e52ce6c04e5bfa63825a6213c","url":"https://git.kernel.org/stable/c/e879a0d9cb086c8e52ce6c04e5bfa63825a6213c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/73506e581c0b1814cdfd2229d589f30751d7de26","label":"73506e581c0b","date":"2025-09-09T18:58:20+02:00","lore":["https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicloud.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e879a0d9cb086c8e52ce6c04e5bfa63825a6213c","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/e879a0d9cb086c8e52ce6c04e5bfa63825a6213c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22124","title":"md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb","status":"backported","project":false,"upstream":[{"sha":"6130825f34d41718c98a9b1504a79a23e379701e","url":"https://git.kernel.org/stable/c/6130825f34d41718c98a9b1504a79a23e379701e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/60196f92bbc7901eb5cfa5d456651b87ea50a4a3","label":"60196f92bbc7","date":"2025-09-09T18:58:21+02:00","lore":["https://lore.kernel.org/linux-raid/20250303033918.32136-1-glass.su@suse.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6130825f34d41718c98a9b1504a79a23e379701e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22124","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22124.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22113","title":"ext4: avoid journaling sb update on error if journal is destroying","status":"backported","project":false,"upstream":[{"sha":"ce2f26e73783b4a7c46a86e3af5b5c8de0971790","url":"https://git.kernel.org/stable/c/ce2f26e73783b4a7c46a86e3af5b5c8de0971790"}],"evidence":[{"url":"https://git.kernel.org/stable/c/eddca44ddf810e27f0c96913aa3cc92ebd679ddb","label":"eddca44ddf81","date":"2025-09-09T18:58:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ce2f26e73783b4a7c46a86e3af5b5c8de0971790","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/ce2f26e73783b4a7c46a86e3af5b5c8de0971790.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22113","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22113.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22108","title":"bnxt_en: Mask the bd_cnt field in the TX BD properly","status":"backported","project":true,"upstream":[{"sha":"107b25db61122d8f990987895c2912927b8b6e3f","url":"https://git.kernel.org/stable/c/107b25db61122d8f990987895c2912927b8b6e3f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9ee185e0f15594017a6f1a191ebe6630cfea5f74","label":"9ee185e0f155","date":"2026-09-07T17:17:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"107b25db61122d8f990987895c2912927b8b6e3f","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/107b25db61122d8f990987895c2912927b8b6e3f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22108","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22108.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22104","title":"ibmvnic: Use kernel helpers for hex dumps","status":"backported","project":false,"upstream":[{"sha":"d93a6caab5d7d9b5ce034d75b1e1e993338e3852","url":"https://git.kernel.org/stable/c/d93a6caab5d7d9b5ce034d75b1e1e993338e3852"}],"evidence":[{"url":"https://git.kernel.org/stable/c/005fee039dd845122d313ac8f2122b0d09dc5d7b","label":"005fee039dd8","date":"2026-09-02T14:30:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d93a6caab5d7d9b5ce034d75b1e1e993338e3852","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22104","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22104.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22103","title":"net: fix NULL pointer dereference in l3mdev_l3_rcv","status":"backported","project":false,"upstream":[{"sha":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","url":"https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204","label":"59599bce44af","date":"2025-09-09T18:58:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22101","title":"net: libwx: fix Tx L4 checksum","status":"backported","project":false,"upstream":[{"sha":"c7d82913d5f9e97860772ee4051eaa66b56a6273","url":"https://git.kernel.org/stable/c/c7d82913d5f9e97860772ee4051eaa66b56a6273"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6d56ea133adf0389b216ba6e47f7f35e95776713","label":"6d56ea133adf","date":"2025-07-06T11:01:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"c7d82913d5f9e97860772ee4051eaa66b56a6273","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22043","title":"ksmbd: add bounds check for durable handle context","status":"backported","project":false,"upstream":[{"sha":"542027e123fc0bfd61dd59e21ae0ee4ef2101b29","url":"https://git.kernel.org/stable/c/542027e123fc0bfd61dd59e21ae0ee4ef2101b29"}],"evidence":[{"url":"https://git.kernel.org/stable/c/29b946714d6aa77de54c71243bba39469ac43ef2","label":"29b946714d6a","date":"2025-04-10T14:39:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"542027e123fc0bfd61dd59e21ae0ee4ef2101b29","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/542027e123fc0bfd61dd59e21ae0ee4ef2101b29.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22039","title":"ksmbd: fix overflow in dacloffset bounds check","status":"backported","project":false,"upstream":[{"sha":"beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42","url":"https://git.kernel.org/stable/c/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6a9cd9ff0fa2bcc30b2bfb8bdb161eb20e44b9dc","label":"6a9cd9ff0fa2","date":"2025-04-10T14:39:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22039","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22039.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22028","title":"media: vimc: skip .s_stream() for stopped entities","status":"backported","project":false,"upstream":[{"sha":"36cef585e2a31e4ddf33a004b0584a7a572246de","url":"https://git.kernel.org/stable/c/36cef585e2a31e4ddf33a004b0584a7a572246de"}],"evidence":[{"url":"https://git.kernel.org/stable/c/845e9286ff99ee88cfdeb2b748f730003a512190","label":"845e9286ff99","date":"2025-04-10T14:39:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"36cef585e2a31e4ddf33a004b0584a7a572246de","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/36cef585e2a31e4ddf33a004b0584a7a572246de.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21985","title":"drm/amd/display: Fix out-of-bound accesses","status":"backported","project":false,"upstream":[{"sha":"8adbb2a98b00926315fd513b5fe2596b5716b82d","url":"https://git.kernel.org/stable/c/8adbb2a98b00926315fd513b5fe2596b5716b82d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/36793d90d76f667d26c6dd025571481ee0c96abc","label":"36793d90d76f","date":"2025-03-22T12:54:15-07:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8adbb2a98b00926315fd513b5fe2596b5716b82d","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/8adbb2a98b00926315fd513b5fe2596b5716b82d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21985","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21985.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21976","title":"fbdev: hyperv_fb: Allow graceful removal of framebuffer","status":"backported","project":false,"upstream":[{"sha":"ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","url":"https://git.kernel.org/stable/c/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4545e2aa121aea304d33903099c03e29ed4fe50a","label":"4545e2aa121a","date":"2025-03-22T12:54:11-07:00","lore":["https://lore.kernel.org/r/1740845791-19977-3-git-send-email-ssengar@linux.microsoft.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21976","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21976.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21949","title":"LoongArch: Set hugetlb mmap base address aligned with pmd size","status":"unfixed","project":false,"upstream":[{"sha":"3109d5ff484b7bc7b955f166974c6776d91f247b","url":"https://git.kernel.org/stable/c/3109d5ff484b7bc7b955f166974c6776d91f247b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3109d5ff484b7bc7b955f166974c6776d91f247b","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/3109d5ff484b7bc7b955f166974c6776d91f247b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21942","title":"btrfs: zoned: fix extent range end unlock in cow_file_range()","status":"backported","project":false,"upstream":[{"sha":"5a4041f2c47247575a6c2e53ce14f7b0ac946c33","url":"https://git.kernel.org/stable/c/5a4041f2c47247575a6c2e53ce14f7b0ac946c33"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5f4863cfb29a7b4fe7625ce148d0b9000b75b802","label":"5f4863cfb29a","date":"2025-07-06T11:01:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5a4041f2c47247575a6c2e53ce14f7b0ac946c33","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/5a4041f2c47247575a6c2e53ce14f7b0ac946c33.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21942","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21942.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21907","title":"mm: memory-failure: update ttu flag inside unmap_poisoned_folio","status":"backported","project":false,"upstream":[{"sha":"b81679b1633aa43c0d973adfa816d78c1ed0d032","url":"https://git.kernel.org/stable/c/b81679b1633aa43c0d973adfa816d78c1ed0d032"}],"evidence":[{"url":"https://git.kernel.org/stable/c/608cc7deb428f1122ed426060233622ebf667b6e","label":"608cc7deb428","date":"2025-03-13T13:01:59+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"b81679b1633aa43c0d973adfa816d78c1ed0d032","lines":128,"reason":"","source":"https://github.com/torvalds/linux/commit/b81679b1633aa43c0d973adfa816d78c1ed0d032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21907","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21907.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21886","title":"RDMA/mlx5: Fix implicit ODP hang on parent deregistration","status":"backported","project":false,"upstream":[{"sha":"3d8c6f26893d55fab218ad086719de1fc9bb86ba","url":"https://git.kernel.org/stable/c/3d8c6f26893d55fab218ad086719de1fc9bb86ba"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cb96ae783e7249e8e5a50c22952c0bb2983133df","label":"cb96ae783e72","date":"2025-03-07T18:25:27+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"3d8c6f26893d55fab218ad086719de1fc9bb86ba","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/3d8c6f26893d55fab218ad086719de1fc9bb86ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21886","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21886.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21870","title":"ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers","status":"backported","project":false,"upstream":[{"sha":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","url":"https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef"}],"evidence":[{"url":"https://git.kernel.org/stable/c/87c8768a96092ce75cd47fe076db5080db7ac515","label":"87c8768a9609","date":"2025-02-27T04:30:16-08:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21836","title":"io_uring/kbuf: reallocate buf lists on upgrade","status":"backported","project":false,"upstream":[{"sha":"8802766324e1f5d414a81ac43365c20142e85603","url":"https://git.kernel.org/stable/c/8802766324e1f5d414a81ac43365c20142e85603"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7d0dc28dae836caf7645fef62a10befc624dd17b","label":"7d0dc28dae83","date":"2025-02-21T14:01:47+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8802766324e1f5d414a81ac43365c20142e85603","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/8802766324e1f5d414a81ac43365c20142e85603.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21836","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21836.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21825","title":"bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT","status":"backported","project":false,"upstream":[{"sha":"58f038e6d209d2dd862fcf5de55407855856794d","url":"https://git.kernel.org/stable/c/58f038e6d209d2dd862fcf5de55407855856794d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/33e47d9573075342a41783a55c8c67bc71246fc1","label":"33e47d957307","date":"2025-02-08T09:57:36+01:00","lore":["https://lore.kernel.org/bpf/20241106084527.4gPrMnHt@linutronix.de","https://lore.kernel.org/r/20250117101816.2101857-5-houtao@huaweicloud.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"58f038e6d209d2dd862fcf5de55407855856794d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/58f038e6d209d2dd862fcf5de55407855856794d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21825","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21825.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21817","title":"block: mark GFP_NOIO around sysfs ->store()","status":"backported","project":true,"upstream":[{"sha":"7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c","url":"https://git.kernel.org/stable/c/7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a09280c39ea54080daf19cfaf4a3121a8d17d5cd","label":"a09280c39ea5","date":"2026-09-07T17:17:57+02:00","lore":["https://lore.kernel.org/linux-block/Z4RkemI9f6N5zoEF@fedora/T/#mc774c65eeca5c024d29695f9ac6152b87763f305","https://lore.kernel.org/r/20250113015833.698458-1-ming.lei@redhat.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21817","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21817.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21752","title":"btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents","status":"unfixed","project":false,"upstream":[{"sha":"dc14ba10781bd2629835696b7cc1febf914768e9","url":"https://git.kernel.org/stable/c/dc14ba10781bd2629835696b7cc1febf914768e9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"dc14ba10781bd2629835696b7cc1febf914768e9","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/dc14ba10781bd2629835696b7cc1febf914768e9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21732","title":"RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error","status":"backported","project":false,"upstream":[{"sha":"abb604a1a9c87255c7a6f3b784410a9707baf467","url":"https://git.kernel.org/stable/c/abb604a1a9c87255c7a6f3b784410a9707baf467"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b13d32786acabf70a7b04ed24b7468fc3c82977c","label":"b13d32786aca","date":"2025-02-17T10:05:44+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"abb604a1a9c87255c7a6f3b784410a9707baf467","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/abb604a1a9c87255c7a6f3b784410a9707baf467.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21732","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21732.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21693","title":"mm: zswap: properly synchronize freeing resources during CPU hotunplug","status":"backported","project":false,"upstream":[{"sha":"12dcb0ef540629a281533f9dedc1b6b8e14cfb65","url":"https://git.kernel.org/stable/c/12dcb0ef540629a281533f9dedc1b6b8e14cfb65"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8d29ff5d50304daa41dc3cfdda4a9d1e46cf5be1","label":"8d29ff5d5030","date":"2025-02-01T18:39:36+01:00","lore":["https://lore.kernel.org/lkml/20241113213007.GB1564047@cmpxchg.org/","https://lore.kernel.org/lkml/CAEkJfYMtSdM5HceNsXUDf5haghD5+o2e7Qv4OcuruL4tPg6OaQ@mail.gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"12dcb0ef540629a281533f9dedc1b6b8e14cfb65","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/12dcb0ef540629a281533f9dedc1b6b8e14cfb65.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21693","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21693.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21651","title":"net: hns3: don't auto enable misc vector","status":"backported","project":false,"upstream":[{"sha":"98b1e3b27734139c76295754b6c317aa4df6d32e","url":"https://git.kernel.org/stable/c/98b1e3b27734139c76295754b6c317aa4df6d32e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bcf430d3bb5525fc89a92a0c451c725ba1aa4306","label":"bcf430d3bb55","date":"2025-01-17T13:40:40+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"98b1e3b27734139c76295754b6c317aa4df6d32e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21651","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21651.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21649","title":"net: hns3: fix kernel crash when 1588 is sent on HIP08 devices","status":"backported","project":false,"upstream":[{"sha":"9741e72b2286de8b38de9db685588ac421a95c87","url":"https://git.kernel.org/stable/c/9741e72b2286de8b38de9db685588ac421a95c87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f19ab3ef96d9626e5f1bdc56d3574c355e83d623","label":"f19ab3ef96d9","date":"2025-01-17T13:40:40+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9741e72b2286de8b38de9db685588ac421a95c87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21649","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21649.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21634","title":"cgroup/cpuset: remove kernfs active break","status":"backported","project":false,"upstream":[{"sha":"3cb97a927fffe443e1e7e8eddbfebfdb062e86ed","url":"https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed"}],"evidence":[{"url":"https://git.kernel.org/stable/c/11cb1d643a74665a4e14749414f48f82cbc15c64","label":"11cb1d643a74","date":"2025-01-17T13:40:49+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3cb97a927fffe443e1e7e8eddbfebfdb062e86ed","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58241","title":"Bluetooth: hci_core: Disable works on hci_unregister_dev","status":"backported","project":false,"upstream":[{"sha":"989fa5171f005ecf63440057218d8aeb1795287d","url":"https://git.kernel.org/stable/c/989fa5171f005ecf63440057218d8aeb1795287d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"989fa5171f005ecf63440057218d8aeb1795287d","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/989fa5171f005ecf63440057218d8aeb1795287d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58241","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58241.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58237","title":"bpf: consider that tail calls invalidate packet pointers","status":"backported","project":false,"upstream":[{"sha":"1a4607ffba35bf2a630aab299e34dd3f6e658d70","url":"https://git.kernel.org/stable/c/1a4607ffba35bf2a630aab299e34dd3f6e658d70"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1c2244437f9ad3dd91215f920401a14f2542dbfc","label":"1c2244437f9a","date":"2025-01-09T13:33:47+01:00","lore":["https://lore.kernel.org/r/20241210041100.1898468-8-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a4607ffba35bf2a630aab299e34dd3f6e658d70","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/1a4607ffba35bf2a630aab299e34dd3f6e658d70.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58100","title":"bpf: check changes_pkt_data property for extension programs","status":"backported","project":false,"upstream":[{"sha":"81f6d0530ba031b5f038a091619bf2ff29568852","url":"https://git.kernel.org/stable/c/81f6d0530ba031b5f038a091619bf2ff29568852"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3846e2bea565ee1c5195dcc625fda9868fb0e3b3","label":"3846e2bea565","date":"2025-04-25T10:48:07+02:00","lore":["https://lore.kernel.org/r/20241210041100.1898468-6-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"81f6d0530ba031b5f038a091619bf2ff29568852","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/81f6d0530ba031b5f038a091619bf2ff29568852.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58100","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58100.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58098","title":"bpf: track changes_pkt_data property for global functions","status":"backported","project":false,"upstream":[{"sha":"51081a3f25c742da5a659d7fc6fd77ebfdd555be","url":"https://git.kernel.org/stable/c/51081a3f25c742da5a659d7fc6fd77ebfdd555be"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1d572c60488b52882b719ed273767ee3b280413d","label":"1d572c60488b","date":"2025-04-25T10:48:07+02:00","lore":["https://lore.kernel.org/bpf/0498CA22-5779-4767-9C0C-A9515CEA711F@gmail.com/","https://lore.kernel.org/r/20241210041100.1898468-4-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"51081a3f25c742da5a659d7fc6fd77ebfdd555be","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/51081a3f25c742da5a659d7fc6fd77ebfdd555be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58098","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58098.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58097","title":"wifi: ath11k: fix RCU stall while reaping monitor destination ring","status":"backported","project":false,"upstream":[{"sha":"16c6c35c03ea73054a1f6d3302a4ce4a331b427d","url":"https://git.kernel.org/stable/c/16c6c35c03ea73054a1f6d3302a4ce4a331b427d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9f1a002f0171d27f3554e529f3c70df438f05dfe","label":"9f1a002f0171","date":"2026-01-30T10:28:48+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"16c6c35c03ea73054a1f6d3302a4ce4a331b427d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58095","title":"jfs: add check read-only before txBeginAnon() call","status":"backported","project":false,"upstream":[{"sha":"0176e69743ecc02961f2ae1ea42439cd2bf9ed58","url":"https://git.kernel.org/stable/c/0176e69743ecc02961f2ae1ea42439cd2bf9ed58"}],"evidence":[{"url":"https://git.kernel.org/stable/c/939dba7a6404d4ac88e2539cb21ac659f5757fd9","label":"939dba7a6404","date":"2026-09-02T14:30:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0176e69743ecc02961f2ae1ea42439cd2bf9ed58","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58095","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58095.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58094","title":"jfs: add check read-only before truncation in jfs_truncate_nolock()","status":"backported","project":false,"upstream":[{"sha":"b5799dd77054c1ec49b0088b006c9908e256843b","url":"https://git.kernel.org/stable/c/b5799dd77054c1ec49b0088b006c9908e256843b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/77038187890ea82d237b05c8a9c4e08a38b1efcb","label":"77038187890e","date":"2026-09-02T14:30:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"b5799dd77054c1ec49b0088b006c9908e256843b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58094","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58094.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58089","title":"btrfs: fix double accounting race when btrfs_run_delalloc_range() failed","status":"backported","project":false,"upstream":[{"sha":"72dad8e377afa50435940adfb697e070d3556670","url":"https://git.kernel.org/stable/c/72dad8e377afa50435940adfb697e070d3556670"}],"evidence":[{"url":"https://git.kernel.org/stable/c/21333148b5c9e52f41fafcedec3810b56a5e0e40","label":"21333148b5c9","date":"2025-02-27T04:30:14-08:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"72dad8e377afa50435940adfb697e070d3556670","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/72dad8e377afa50435940adfb697e070d3556670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58053","title":"rxrpc: Fix handling of received connection abort","status":"backported","project":false,"upstream":[{"sha":"0e56ebde245e4799ce74d38419426f2a80d39950","url":"https://git.kernel.org/stable/c/0e56ebde245e4799ce74d38419426f2a80d39950"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5842ce7b120c65624052a8da04460d35b26caac0","label":"5842ce7b120c","date":"2025-02-08T09:57:03+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0e56ebde245e4799ce74d38419426f2a80d39950","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/0e56ebde245e4799ce74d38419426f2a80d39950.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58053","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58053.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58015","title":"wifi: ath12k: Fix for out-of bound access error","status":"unfixed","project":false,"upstream":[{"sha":"eb8c0534713865d190856f10bfc97cf0b88475b1","url":"https://git.kernel.org/stable/c/eb8c0534713865d190856f10bfc97cf0b88475b1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb8c0534713865d190856f10bfc97cf0b88475b1","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/eb8c0534713865d190856f10bfc97cf0b88475b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58012","title":"ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params","status":"backported","project":false,"upstream":[{"sha":"569922b82ca660f8b24e705f6cf674e6b1f99cc7","url":"https://git.kernel.org/stable/c/569922b82ca660f8b24e705f6cf674e6b1f99cc7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e012a77e4d7632cf615ba9625b1600ed8985c3b5","label":"e012a77e4d76","date":"2025-02-17T10:04:54+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"569922b82ca660f8b24e705f6cf674e6b1f99cc7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58012","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58012.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57984","title":"i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition","status":"backported","project":false,"upstream":[{"sha":"b75439c945b94dd8a2b645355bdb56f948052601","url":"https://git.kernel.org/stable/c/b75439c945b94dd8a2b645355bdb56f948052601"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9b0063098fcde17cd2894f2c96459b23388507ca","label":"9b0063098fcd","date":"2025-02-08T09:57:50+01:00","lore":["https://lore.kernel.org/r/bfc49c9527be5b513e7ceafeba314ca40a5be4bc.1732703537.git.xiaopei01@kylinos.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b75439c945b94dd8a2b645355bdb56f948052601","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b75439c945b94dd8a2b645355bdb56f948052601.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57984","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57984.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57975","title":"btrfs: do proper folio cleanup when run_delalloc_nocow() failed","status":"backported","project":false,"upstream":[{"sha":"c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","url":"https://git.kernel.org/stable/c/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5ae72abbf91eb172ce3a838a4dc34be3c9707296","label":"5ae72abbf91e","date":"2025-02-08T09:58:19+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","lines":150,"reason":"","source":"https://github.com/torvalds/linux/commit/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57872","title":"scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()","status":"backported","project":false,"upstream":[{"sha":"897df60c16d54ad515a3d0887edab5c63da06d1f","url":"https://git.kernel.org/stable/c/897df60c16d54ad515a3d0887edab5c63da06d1f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cd188519d2467ab4c2141587b0551ba030abff0e","label":"cd188519d246","date":"2024-12-14T20:04:10+01:00","lore":["https://lore.kernel.org/r/20241111-ufs_bug_fix-v1-5-45ad8b62f02e@linaro.org"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"897df60c16d54ad515a3d0887edab5c63da06d1f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/897df60c16d54ad515a3d0887edab5c63da06d1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57857","title":"RDMA/siw: Remove direct link to net_device","status":"backported","project":false,"upstream":[{"sha":"16b87037b48889d21854c8e97aec8a1baf2642b3","url":"https://git.kernel.org/stable/c/16b87037b48889d21854c8e97aec8a1baf2642b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4eafeb4f021c50d13f199239d913b37de3c83135","label":"4eafeb4f021c","date":"2025-01-09T13:33:35+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"16b87037b48889d21854c8e97aec8a1baf2642b3","lines":204,"reason":"","source":"https://github.com/torvalds/linux/commit/16b87037b48889d21854c8e97aec8a1baf2642b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57857","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57857.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57809","title":"PCI: imx6: Fix suspend/resume support on i.MX6QDL","status":"backported","project":false,"upstream":[{"sha":"0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3","url":"https://git.kernel.org/stable/c/0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ac43ea3d27a8f9beadf3af66c9ea4a566ebfff1f","label":"ac43ea3d27a8","date":"2024-12-09T10:41:04+01:00","lore":["https://lore.kernel.org/r/20241030103250.83640-1-eichest@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57809","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57809.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57795","title":"RDMA/rxe: Remove the direct link to net_device","status":"backported","project":false,"upstream":[{"sha":"2ac5415022d16d63d912a39a06f32f1f51140261","url":"https://git.kernel.org/stable/c/2ac5415022d16d63d912a39a06f32f1f51140261"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9f6f54e6a6863131442b40e14d1792b090c7ce21","label":"9f6f54e6a686","date":"2025-01-09T13:33:39+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2ac5415022d16d63d912a39a06f32f1f51140261","lines":260,"reason":"","source":"https://github.com/torvalds/linux/commit/2ac5415022d16d63d912a39a06f32f1f51140261.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57795","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57795.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56775","title":"drm/amd/display: Fix handling of plane refcount","status":"backported","project":false,"upstream":[{"sha":"27227a234c1487cb7a684615f0749c455218833a","url":"https://git.kernel.org/stable/c/27227a234c1487cb7a684615f0749c455218833a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8cb2f6793845f135b28361ba8e96901cae3e5790","label":"8cb2f6793845","date":"2024-12-09T10:41:15+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"27227a234c1487cb7a684615f0749c455218833a","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/27227a234c1487cb7a684615f0749c455218833a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56591","title":"Bluetooth: hci_conn: Use disable_delayed_work_sync","status":"backported","project":false,"upstream":[{"sha":"2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df","url":"https://git.kernel.org/stable/c/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c55a4c5a04bae40dcdc1e1c19d8eb79a06fb3397","label":"c55a4c5a04ba","date":"2024-12-14T20:03:56+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56544","title":"udmabuf: change folios array from kmalloc to kvmalloc","status":"backported","project":false,"upstream":[{"sha":"1c0844c6184e658064e14c4335885785ad3bf84b","url":"https://git.kernel.org/stable/c/1c0844c6184e658064e14c4335885785ad3bf84b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/85bb72397cb63649fe493c96e27e1d0e4ed2ff63","label":"85bb72397cb6","date":"2024-12-05T14:01:37+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c0844c6184e658064e14c4335885785ad3bf84b","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/1c0844c6184e658064e14c4335885785ad3bf84b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56544","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56544.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56538","title":"drm: zynqmp_kms: Unplug DRM device before removal","status":"backported","project":false,"upstream":[{"sha":"2e07c88914fc5289c21820b1aa94f058feb38197","url":"https://git.kernel.org/stable/c/2e07c88914fc5289c21820b1aa94f058feb38197"}],"evidence":[{"url":"https://git.kernel.org/stable/c/692f52aedccbf79b212a1e14e3735192b4c24a7d","label":"692f52aedccb","date":"2024-12-05T14:01:50+01:00","lore":["https://lore.kernel.org/dri-devel/4d8f4c9b-2efb-4774-9a37-2f257f79b2c9@linux.dev/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2e07c88914fc5289c21820b1aa94f058feb38197","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53687","title":"riscv: Fix IPIs usage in kfence_protect_page()","status":"backported","project":false,"upstream":[{"sha":"b3431a8bb336cece8adc452437befa7d4534b2fd","url":"https://git.kernel.org/stable/c/b3431a8bb336cece8adc452437befa7d4534b2fd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3abfc4130c4222099c69d023fed97f1180a8ad7b","label":"3abfc4130c42","date":"2024-12-19T18:13:01+01:00","lore":["https://lore.kernel.org/r/20241209074125.52322-1-alexghiti@rivosinc.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b3431a8bb336cece8adc452437befa7d4534b2fd","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/b3431a8bb336cece8adc452437befa7d4534b2fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53687","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53687.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53219","title":"virtiofs: use pages instead of pointer for kernel direct IO","status":"backported","project":false,"upstream":[{"sha":"41748675c0bf252b3c5f600a95830f0936d366c1","url":"https://git.kernel.org/stable/c/41748675c0bf252b3c5f600a95830f0936d366c1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2bc07714dc955a91d2923a440ea02c3cb3376b10","label":"2bc07714dc95","date":"2024-12-05T14:02:21+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"41748675c0bf252b3c5f600a95830f0936d366c1","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/41748675c0bf252b3c5f600a95830f0936d366c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53219","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53219.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53218","title":"f2fs: fix race in concurrent f2fs_stop_gc_thread","status":"backported","project":false,"upstream":[{"sha":"7b0033dbc48340a1c1c3f12448ba17d6587ca092","url":"https://git.kernel.org/stable/c/7b0033dbc48340a1c1c3f12448ba17d6587ca092"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c631207897a9b3d41167ceca58e07f8f94720e42","label":"c631207897a9","date":"2024-12-05T14:02:23+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7b0033dbc48340a1c1c3f12448ba17d6587ca092","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/7b0033dbc48340a1c1c3f12448ba17d6587ca092.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53218","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53218.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53201","title":"drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe","status":"backported","project":false,"upstream":[{"sha":"6a057072ddd127255350357dd880903e8fa23f36","url":"https://git.kernel.org/stable/c/6a057072ddd127255350357dd880903e8fa23f36"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3609259326171cd5b98462636580fb2ae5c87d40","label":"360925932617","date":"2024-12-05T14:02:39+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6a057072ddd127255350357dd880903e8fa23f36","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/6a057072ddd127255350357dd880903e8fa23f36.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53201","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53201.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53187","title":"io_uring: check for overflows in io_pin_pages","status":"backported","project":false,"upstream":[{"sha":"0c0a4eae26ac78379d0c1db053de168a8febc6c9","url":"https://git.kernel.org/stable/c/0c0a4eae26ac78379d0c1db053de168a8febc6c9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aaa90844afd499c9142d0199dfda74439314c013","label":"aaa90844afd4","date":"2024-12-05T14:02:50+01:00","lore":["https://lore.kernel.org/r/1b7520ddb168e1d537d64be47414a0629d0d8f8f.1732581026.git.asml.silence@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0c0a4eae26ac78379d0c1db053de168a8febc6c9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53187","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53187.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53176","title":"smb: During unmount, ensure all cached dir instances drop their dentry","status":"backported","project":false,"upstream":[{"sha":"3fa640d035e5ae526769615c35cb9ed4be6e3662","url":"https://git.kernel.org/stable/c/3fa640d035e5ae526769615c35cb9ed4be6e3662"}],"evidence":[{"url":"https://git.kernel.org/stable/c/548812afd96982a76a93ba76c0582ea670c40d9e","label":"548812afd969","date":"2024-12-05T14:03:00+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"3fa640d035e5ae526769615c35cb9ed4be6e3662","lines":357,"reason":"","source":"https://github.com/torvalds/linux/commit/3fa640d035e5ae526769615c35cb9ed4be6e3662.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53176","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53176.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53134","title":"pmdomain: imx93-blk-ctrl: correct remove path","status":"backported","project":false,"upstream":[{"sha":"f7c7c5aa556378a2c8da72c1f7f238b6648f95fb","url":"https://git.kernel.org/stable/c/f7c7c5aa556378a2c8da72c1f7f238b6648f95fb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"f7c7c5aa556378a2c8da72c1f7f238b6648f95fb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53134","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53134.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53114","title":"x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client","status":"backported","project":false,"upstream":[{"sha":"a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0","url":"https://git.kernel.org/stable/c/a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53114","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53114.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53089","title":"LoongArch: KVM: Mark hrtimer to expire in hard interrupt context","status":"backported","project":false,"upstream":[{"sha":"73adbd92f3223dc0c3506822b71c6b259d5d537b","url":"https://git.kernel.org/stable/c/73adbd92f3223dc0c3506822b71c6b259d5d537b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"73adbd92f3223dc0c3506822b71c6b259d5d537b","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/73adbd92f3223dc0c3506822b71c6b259d5d537b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53085","title":"tpm: Lock TPM chip in tpm_pm_suspend() first","status":"backported","project":false,"upstream":[{"sha":"9265fed6db601ee2ec47577815387458ef4f047a","url":"https://git.kernel.org/stable/c/9265fed6db601ee2ec47577815387458ef4f047a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"9265fed6db601ee2ec47577815387458ef4f047a","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/9265fed6db601ee2ec47577815387458ef4f047a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53079","title":"mm/thp: fix deferred split unqueue naming and locking","status":"backported","project":false,"upstream":[{"sha":"f8f931bba0f92052cf842b7e30917b1afcc77d5a","url":"https://git.kernel.org/stable/c/f8f931bba0f92052cf842b7e30917b1afcc77d5a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"f8f931bba0f92052cf842b7e30917b1afcc77d5a","lines":214,"reason":"","source":"https://github.com/torvalds/linux/commit/f8f931bba0f92052cf842b7e30917b1afcc77d5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53056","title":"drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()","status":"backported","project":false,"upstream":[{"sha":"4018651ba5c409034149f297d3dd3328b91561fd","url":"https://git.kernel.org/stable/c/4018651ba5c409034149f297d3dd3328b91561fd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"4018651ba5c409034149f297d3dd3328b91561fd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53056","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53056.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53051","title":"drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability","status":"backported","project":false,"upstream":[{"sha":"31b42af516afa1e184d1a9f9dd4096c54044269a","url":"https://git.kernel.org/stable/c/31b42af516afa1e184d1a9f9dd4096c54044269a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"31b42af516afa1e184d1a9f9dd4096c54044269a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53051","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53051.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53050","title":"drm/i915/hdcp: Add encoder check in hdcp2_get_capability","status":"backported","project":false,"upstream":[{"sha":"d34f4f058edf1235c103ca9c921dc54820d14d40","url":"https://git.kernel.org/stable/c/d34f4f058edf1235c103ca9c921dc54820d14d40"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d34f4f058edf1235c103ca9c921dc54820d14d40","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53050","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53050.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50289","title":"media: av7110: fix a spectre vulnerability","status":"backported","project":false,"upstream":[{"sha":"458ea1c0be991573ec436aa0afa23baacfae101a","url":"https://git.kernel.org/stable/c/458ea1c0be991573ec436aa0afa23baacfae101a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"458ea1c0be991573ec436aa0afa23baacfae101a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50282","title":"drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()","status":"backported","project":false,"upstream":[{"sha":"4d75b9468021c73108b4439794d69e892b1d24e3","url":"https://git.kernel.org/stable/c/4d75b9468021c73108b4439794d69e892b1d24e3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4d75b9468021c73108b4439794d69e892b1d24e3","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/4d75b9468021c73108b4439794d69e892b1d24e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50282","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50282.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50225","title":"btrfs: fix error propagation of split bios","status":"backported","project":false,"upstream":[{"sha":"d48e1dea3931de64c26717adc2b89743c7ab6594","url":"https://git.kernel.org/stable/c/d48e1dea3931de64c26717adc2b89743c7ab6594"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d48e1dea3931de64c26717adc2b89743c7ab6594","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/d48e1dea3931de64c26717adc2b89743c7ab6594.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50225","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50225.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50217","title":"btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()","status":"backported","project":false,"upstream":[{"sha":"aec8e6bf839101784f3ef037dcdb9432c3f32343","url":"https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"aec8e6bf839101784f3ef037dcdb9432c3f32343","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/aec8e6bf839101784f3ef037dcdb9432c3f32343.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50211","title":"udf: refactor inode_bmap() to handle error","status":"backported","project":false,"upstream":[{"sha":"c226964ec786f3797ed389a16392ce4357697d24","url":"https://git.kernel.org/stable/c/c226964ec786f3797ed389a16392ce4357697d24"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c226964ec786f3797ed389a16392ce4357697d24","lines":173,"reason":"","source":"https://github.com/torvalds/linux/commit/c226964ec786f3797ed389a16392ce4357697d24.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50166","title":"fsl/fman: Fix refcount handling of fman-related devices","status":"backported","project":false,"upstream":[{"sha":"1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1","url":"https://git.kernel.org/stable/c/1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1","lines":151,"reason":"","source":"https://github.com/torvalds/linux/commit/1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50166","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50166.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50111","title":"LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context","status":"backported","project":false,"upstream":[{"sha":"69cc6fad5df4ce652d969be69acc60e269e5eea1","url":"https://git.kernel.org/stable/c/69cc6fad5df4ce652d969be69acc60e269e5eea1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"69cc6fad5df4ce652d969be69acc60e269e5eea1","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/69cc6fad5df4ce652d969be69acc60e269e5eea1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50111","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50111.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50102","title":"x86: fix user address masking non-canonical speculation issue","status":"backported","project":false,"upstream":[{"sha":"86e6b1547b3d013bc392adf775b89318441403c2","url":"https://git.kernel.org/stable/c/86e6b1547b3d013bc392adf775b89318441403c2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"86e6b1547b3d013bc392adf775b89318441403c2","lines":116,"reason":"","source":"https://github.com/torvalds/linux/commit/86e6b1547b3d013bc392adf775b89318441403c2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50057","title":"usb: typec: tipd: Free IRQ only if it was requested before","status":"backported","project":false,"upstream":[{"sha":"db63d9868f7f310de44ba7bea584e2454f8b4ed0","url":"https://git.kernel.org/stable/c/db63d9868f7f310de44ba7bea584e2454f8b4ed0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"db63d9868f7f310de44ba7bea584e2454f8b4ed0","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/db63d9868f7f310de44ba7bea584e2454f8b4ed0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50057","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50057.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50043","title":"nfsd: fix possible badness in FREE_STATEID","status":"backported","project":false,"upstream":[{"sha":"c88c150a467fcb670a1608e2272beeee3e86df6e","url":"https://git.kernel.org/stable/c/c88c150a467fcb670a1608e2272beeee3e86df6e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c88c150a467fcb670a1608e2272beeee3e86df6e","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/c88c150a467fcb670a1608e2272beeee3e86df6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50028","title":"thermal: core: Reference count the zone in thermal_zone_get_by_id()","status":"backported","project":false,"upstream":[{"sha":"a42a5839f400e929c489bb1b58f54596c4535167","url":"https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a42a5839f400e929c489bb1b58f54596c4535167","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/a42a5839f400e929c489bb1b58f54596c4535167.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50017","title":"x86/mm/ident_map: Use gbpages only where full GB page should be mapped.","status":"backported","project":false,"upstream":[{"sha":"cc31744a294584a36bf764a0ffa3255a8e69f036","url":"https://git.kernel.org/stable/c/cc31744a294584a36bf764a0ffa3255a8e69f036"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"cc31744a294584a36bf764a0ffa3255a8e69f036","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49988","title":"ksmbd: add refcnt to ksmbd_conn struct","status":"backported","project":false,"upstream":[{"sha":"ee426bfb9d09b29987369b897fe9b6485ac2be27","url":"https://git.kernel.org/stable/c/ee426bfb9d09b29987369b897fe9b6485ac2be27"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"ee426bfb9d09b29987369b897fe9b6485ac2be27","lines":186,"reason":"","source":"https://github.com/torvalds/linux/commit/ee426bfb9d09b29987369b897fe9b6485ac2be27.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49970","title":"drm/amd/display: Implement bounds check for stream encoder creation in DCN401","status":"backported","project":false,"upstream":[{"sha":"bdf606810210e8e07a0cdf1af3c467291363b295","url":"https://git.kernel.org/stable/c/bdf606810210e8e07a0cdf1af3c467291363b295"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"bdf606810210e8e07a0cdf1af3c467291363b295","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49970","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49970.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49923","title":"drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags","status":"backported","project":false,"upstream":[{"sha":"5559598742fb4538e4c51c48ef70563c49c2af23","url":"https://git.kernel.org/stable/c/5559598742fb4538e4c51c48ef70563c49c2af23"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5559598742fb4538e4c51c48ef70563c49c2af23","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49923","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49923.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49922","title":"drm/amd/display: Check null pointers before using them","status":"backported","project":false,"upstream":[{"sha":"1ff12bcd7deaeed25efb5120433c6a45dd5504a8","url":"https://git.kernel.org/stable/c/1ff12bcd7deaeed25efb5120433c6a45dd5504a8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1ff12bcd7deaeed25efb5120433c6a45dd5504a8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49922","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49922.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49919","title":"drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer","status":"backported","project":false,"upstream":[{"sha":"f22f4754aaa47d8c59f166ba3042182859e5dff7","url":"https://git.kernel.org/stable/c/f22f4754aaa47d8c59f166ba3042182859e5dff7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"f22f4754aaa47d8c59f166ba3042182859e5dff7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49919","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49919.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49918","title":"drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer","status":"backported","project":false,"upstream":[{"sha":"ac2140449184a26eac99585b7f69814bd3ba8f2d","url":"https://git.kernel.org/stable/c/ac2140449184a26eac99585b7f69814bd3ba8f2d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ac2140449184a26eac99585b7f69814bd3ba8f2d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49916","title":"drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw","status":"backported","project":false,"upstream":[{"sha":"4b6377f0e96085cbec96eb7f0b282430ccdd3d75","url":"https://git.kernel.org/stable/c/4b6377f0e96085cbec96eb7f0b282430ccdd3d75"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b6377f0e96085cbec96eb7f0b282430ccdd3d75","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/4b6377f0e96085cbec96eb7f0b282430ccdd3d75.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49916","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49916.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49914","title":"drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe","status":"backported","project":false,"upstream":[{"sha":"8e4ed3cf1642df0c4456443d865cff61a9598aa8","url":"https://git.kernel.org/stable/c/8e4ed3cf1642df0c4456443d865cff61a9598aa8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"8e4ed3cf1642df0c4456443d865cff61a9598aa8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49910","title":"drm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func","status":"backported","project":false,"upstream":[{"sha":"dd340acd42c24a3f28dd22fae6bf38662334264c","url":"https://git.kernel.org/stable/c/dd340acd42c24a3f28dd22fae6bf38662334264c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"dd340acd42c24a3f28dd22fae6bf38662334264c","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/dd340acd42c24a3f28dd22fae6bf38662334264c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49910","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49910.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49908","title":"drm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2)","status":"backported","project":false,"upstream":[{"sha":"0fe20258b4989b9112b5e9470df33a0939403fd4","url":"https://git.kernel.org/stable/c/0fe20258b4989b9112b5e9470df33a0939403fd4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fe20258b4989b9112b5e9470df33a0939403fd4","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/0fe20258b4989b9112b5e9470df33a0939403fd4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49908","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49908.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49906","title":"drm/amd/display: Check null pointer before try to access it","status":"backported","project":false,"upstream":[{"sha":"1b686053c06ffb9f4524b288110cf2a831ff7a25","url":"https://git.kernel.org/stable/c/1b686053c06ffb9f4524b288110cf2a831ff7a25"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1b686053c06ffb9f4524b288110cf2a831ff7a25","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49893","title":"drm/amd/display: Check stream_status before it is used","status":"backported","project":false,"upstream":[{"sha":"58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9","url":"https://git.kernel.org/stable/c/58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49893","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49893.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47752","title":"media: mediatek: vcodec: Fix H264 stateless decoder smatch warning","status":"backported","project":false,"upstream":[{"sha":"7878d3a385efab560dce793b595447867fb163f2","url":"https://git.kernel.org/stable/c/7878d3a385efab560dce793b595447867fb163f2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7878d3a385efab560dce793b595447867fb163f2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47703","title":"bpf, lsm: Add check for BPF LSM return value","status":"backported","project":false,"upstream":[{"sha":"5d99e198be279045e6ecefe220f5c52f8ce9bfd5","url":"https://git.kernel.org/stable/c/5d99e198be279045e6ecefe220f5c52f8ce9bfd5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"5d99e198be279045e6ecefe220f5c52f8ce9bfd5","lines":200,"reason":"","source":"https://github.com/torvalds/linux/commit/5d99e198be279045e6ecefe220f5c52f8ce9bfd5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47703","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47703.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47702","title":"bpf: Fail verification for sign-extension of packet data/data_end/data_meta","status":"backported","project":false,"upstream":[{"sha":"92de36080c93296ef9005690705cba260b9bd68a","url":"https://git.kernel.org/stable/c/92de36080c93296ef9005690705cba260b9bd68a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"92de36080c93296ef9005690705cba260b9bd68a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47702","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47702.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47691","title":"f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()","status":"backported","project":false,"upstream":[{"sha":"c7f114d864ac91515bb07ac271e9824a20f5ed95","url":"https://git.kernel.org/stable/c/c7f114d864ac91515bb07ac271e9824a20f5ed95"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7f114d864ac91515bb07ac271e9824a20f5ed95","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/c7f114d864ac91515bb07ac271e9824a20f5ed95.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47691","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47691.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47683","title":"drm/amd/display: Skip Recompute DSC Params if no Stream on Link","status":"backported","project":false,"upstream":[{"sha":"8151a6c13111b465dbabe07c19f572f7cbd16fef","url":"https://git.kernel.org/stable/c/8151a6c13111b465dbabe07c19f572f7cbd16fef"},{"sha":"50e376f1fe3bf571d0645ddf48ad37eb58323919","url":"https://git.kernel.org/stable/c/50e376f1fe3bf571d0645ddf48ad37eb58323919"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8151a6c13111b465dbabe07c19f572f7cbd16fef","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/8151a6c13111b465dbabe07c19f572f7cbd16fef.patch"},{"sha":"50e376f1fe3bf571d0645ddf48ad37eb58323919","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/50e376f1fe3bf571d0645ddf48ad37eb58323919.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47683","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47683.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47662","title":"drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection","status":"backported","project":false,"upstream":[{"sha":"466423c6dd8af23ebb3a69d43434d01aed0db356","url":"https://git.kernel.org/stable/c/466423c6dd8af23ebb3a69d43434d01aed0db356"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"466423c6dd8af23ebb3a69d43434d01aed0db356","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/466423c6dd8af23ebb3a69d43434d01aed0db356.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47662","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47662.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47661","title":"drm/amd/display: Avoid overflow from uint32_t to uint8_t","status":"backported","project":false,"upstream":[{"sha":"d6b54900c564e35989cf6813e4071504fa0a90e0","url":"https://git.kernel.org/stable/c/d6b54900c564e35989cf6813e4071504fa0a90e0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d6b54900c564e35989cf6813e4071504fa0a90e0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46870","title":"drm/amd/display: Disable DMCUB timeout for DCN35","status":"backported","project":false,"upstream":[{"sha":"7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f","url":"https://git.kernel.org/stable/c/7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46842","title":"scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info","status":"backported","project":false,"upstream":[{"sha":"ede596b1434b57c0b3fd5c02b326efe5c54f6e48","url":"https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ede596b1434b57c0b3fd5c02b326efe5c54f6e48","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46842","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46842.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46834","title":"ethtool: fail closed if we can't get max channel used in indirection tables","status":"backported","project":false,"upstream":[{"sha":"2899d58462ba868287d6ff3acad3675e7adf934f","url":"https://git.kernel.org/stable/c/2899d58462ba868287d6ff3acad3675e7adf934f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2899d58462ba868287d6ff3acad3675e7adf934f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46813","title":"drm/amd/display: Check link_index before accessing dc->links[]","status":"backported","project":false,"upstream":[{"sha":"8aa2864044b9d13e95fe224f32e808afbf79ecdf","url":"https://git.kernel.org/stable/c/8aa2864044b9d13e95fe224f32e808afbf79ecdf"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"8aa2864044b9d13e95fe224f32e808afbf79ecdf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46813","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46813.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46808","title":"drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range","status":"backported","project":false,"upstream":[{"sha":"5524fa301ba649f8cf00848f91468e0ba7e4f24c","url":"https://git.kernel.org/stable/c/5524fa301ba649f8cf00848f91468e0ba7e4f24c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5524fa301ba649f8cf00848f91468e0ba7e4f24c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46806","title":"drm/amdgpu: Fix the warning division or modulo by zero","status":"backported","project":false,"upstream":[{"sha":"1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c","url":"https://git.kernel.org/stable/c/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46776","title":"drm/amd/display: Run DC_LOG_DC after checking link->link_enc","status":"backported","project":false,"upstream":[{"sha":"3a82f62b0d9d7687eac47603bb6cd14a50fa718b","url":"https://git.kernel.org/stable/c/3a82f62b0d9d7687eac47603bb6cd14a50fa718b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a82f62b0d9d7687eac47603bb6cd14a50fa718b","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/3a82f62b0d9d7687eac47603bb6cd14a50fa718b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46776","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46776.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46775","title":"drm/amd/display: Validate function returns","status":"backported","project":false,"upstream":[{"sha":"673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c","url":"https://git.kernel.org/stable/c/673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46760","title":"wifi: rtw88: usb: schedule rx work after everything is set up","status":"backported","project":false,"upstream":[{"sha":"adc539784c98a7cc602cbf557debfc2e7b9be8b3","url":"https://git.kernel.org/stable/c/adc539784c98a7cc602cbf557debfc2e7b9be8b3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"adc539784c98a7cc602cbf557debfc2e7b9be8b3","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/adc539784c98a7cc602cbf557debfc2e7b9be8b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46760","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46760.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46754","title":"bpf: Remove tst_run from lwt_seg6local_prog_ops.","status":"backported","project":false,"upstream":[{"sha":"c13fda93aca118b8e5cd202e339046728ee7dddb","url":"https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"c13fda93aca118b8e5cd202e339046728ee7dddb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46754","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46754.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46730","title":"drm/amd/display: Ensure array index tg_inst won't be -1","status":"backported","project":false,"upstream":[{"sha":"687fe329f18ab0ab0496b20ed2cb003d4879d931","url":"https://git.kernel.org/stable/c/687fe329f18ab0ab0496b20ed2cb003d4879d931"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"687fe329f18ab0ab0496b20ed2cb003d4879d931","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46730","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46730.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46729","title":"drm/amd/display: Fix incorrect size calculation for loop","status":"backported","project":false,"upstream":[{"sha":"3941a3aa4b653b69876d894d08f3fff1cc965267","url":"https://git.kernel.org/stable/c/3941a3aa4b653b69876d894d08f3fff1cc965267"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3941a3aa4b653b69876d894d08f3fff1cc965267","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3941a3aa4b653b69876d894d08f3fff1cc965267.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46729","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46729.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46728","title":"drm/amd/display: Check index for aux_rd_interval before using","status":"backported","project":false,"upstream":[{"sha":"9ba2ea6337b4f159aecb177555a6a81da92d302e","url":"https://git.kernel.org/stable/c/9ba2ea6337b4f159aecb177555a6a81da92d302e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9ba2ea6337b4f159aecb177555a6a81da92d302e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46728","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46728.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46727","title":"drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update","status":"backported","project":false,"upstream":[{"sha":"871cd9d881fa791d3f82885000713de07041c0ae","url":"https://git.kernel.org/stable/c/871cd9d881fa791d3f82885000713de07041c0ae"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"871cd9d881fa791d3f82885000713de07041c0ae","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/871cd9d881fa791d3f82885000713de07041c0ae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46727","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46727.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46701","title":"libfs: fix infinite directory reads for offset dir","status":"backported","project":false,"upstream":[{"sha":"64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a","url":"https://git.kernel.org/stable/c/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46701","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46701.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46698","title":"video/aperture: optionally match the device in sysfb_disable()","status":"backported","project":false,"upstream":[{"sha":"b49420d6a1aeb399e5b107fc6eb8584d0860fbd7","url":"https://git.kernel.org/stable/c/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"b49420d6a1aeb399e5b107fc6eb8584d0860fbd7","lines":108,"reason":"","source":"https://github.com/torvalds/linux/commit/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46698","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46698.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46682","title":"nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open","status":"backported","project":false,"upstream":[{"sha":"a204501e1743d695ca2930ed25a2be9f8ced96d3","url":"https://git.kernel.org/stable/c/a204501e1743d695ca2930ed25a2be9f8ced96d3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a204501e1743d695ca2930ed25a2be9f8ced96d3","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/a204501e1743d695ca2930ed25a2be9f8ced96d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46682","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46682.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46678","title":"bonding: change ipsec_lock from spin lock to mutex","status":"backported","project":false,"upstream":[{"sha":"2aeeef906d5a526dc60cf4af92eda69836c39b1f","url":"https://git.kernel.org/stable/c/2aeeef906d5a526dc60cf4af92eda69836c39b1f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"2aeeef906d5a526dc60cf4af92eda69836c39b1f","lines":199,"reason":"","source":"https://github.com/torvalds/linux/commit/2aeeef906d5a526dc60cf4af92eda69836c39b1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46678","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46678.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-45015","title":"drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()","status":"backported","project":false,"upstream":[{"sha":"aedf02e46eb549dac8db4821a6b9f0c6bf6e3990","url":"https://git.kernel.org/stable/c/aedf02e46eb549dac8db4821a6b9f0c6bf6e3990"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"aedf02e46eb549dac8db4821a6b9f0c6bf6e3990","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/aedf02e46eb549dac8db4821a6b9f0c6bf6e3990.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-45015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-45015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43901","title":"drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401","status":"backported","project":false,"upstream":[{"sha":"5af757124792817f8eb1bd0c80ad60fab519586b","url":"https://git.kernel.org/stable/c/5af757124792817f8eb1bd0c80ad60fab519586b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5af757124792817f8eb1bd0c80ad60fab519586b","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/5af757124792817f8eb1bd0c80ad60fab519586b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43899","title":"drm/amd/display: Fix null pointer deref in dcn20_resource.c","status":"backported","project":false,"upstream":[{"sha":"ecbf60782662f0a388493685b85a645a0ba1613c","url":"https://git.kernel.org/stable/c/ecbf60782662f0a388493685b85a645a0ba1613c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ecbf60782662f0a388493685b85a645a0ba1613c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43888","title":"mm: list_lru: fix UAF for memory cgroup","status":"backported","project":false,"upstream":[{"sha":"5161b48712dcd08ec427c450399d4d1483e21dea","url":"https://git.kernel.org/stable/c/5161b48712dcd08ec427c450399d4d1483e21dea"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5161b48712dcd08ec427c450399d4d1483e21dea","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/5161b48712dcd08ec427c450399d4d1483e21dea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43888","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43888.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43872","title":"RDMA/hns: Fix soft lockup under heavy CEQE load","status":"backported","project":false,"upstream":[{"sha":"2fdf34038369c0a27811e7b4680662a14ada1d6b","url":"https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"2fdf34038369c0a27811e7b4680662a14ada1d6b","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/2fdf34038369c0a27811e7b4680662a14ada1d6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43824","title":"PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()","status":"backported","project":false,"upstream":[{"sha":"5a5095a8bd1bd349cce1c879e5e44407a34dda8a","url":"https://git.kernel.org/stable/c/5a5095a8bd1bd349cce1c879e5e44407a34dda8a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5a5095a8bd1bd349cce1c879e5e44407a34dda8a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43824","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43824.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43819","title":"kvm: s390: Reject memory region operations for ucontrol VMs","status":"backported","project":false,"upstream":[{"sha":"7816e58967d0e6cadce05c8540b47ed027dc2499","url":"https://git.kernel.org/stable/c/7816e58967d0e6cadce05c8540b47ed027dc2499"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7816e58967d0e6cadce05c8540b47ed027dc2499","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43819","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43819.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42317","title":"mm/huge_memory: avoid PMD-size page cache if needed","status":"backported","project":false,"upstream":[{"sha":"d659b715e94ac039803d7601505d3473393fc0be","url":"https://git.kernel.org/stable/c/d659b715e94ac039803d7601505d3473393fc0be"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d659b715e94ac039803d7601505d3473393fc0be","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/d659b715e94ac039803d7601505d3473393fc0be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42239","title":"bpf: Fail bpf_timer_cancel when callback is being cancelled","status":"backported","project":false,"upstream":[{"sha":"d4523831f07a267a943f0dde844bf8ead7495f13","url":"https://git.kernel.org/stable/c/d4523831f07a267a943f0dde844bf8ead7495f13"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d4523831f07a267a943f0dde844bf8ead7495f13","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42239","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42239.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42162","title":"gve: Account for stopped queues when reading NIC stats","status":"backported","project":false,"upstream":[{"sha":"af9bcf910b1f86244f39e15e701b2dc564b469a6","url":"https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"af9bcf910b1f86244f39e15e701b2dc564b469a6","lines":107,"reason":"","source":"https://github.com/torvalds/linux/commit/af9bcf910b1f86244f39e15e701b2dc564b469a6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42162","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42162.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42158","title":"s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings","status":"backported","project":false,"upstream":[{"sha":"22e6824622e8a8889df0f8fc4ed5aea0e702a694","url":"https://git.kernel.org/stable/c/22e6824622e8a8889df0f8fc4ed5aea0e702a694"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"22e6824622e8a8889df0f8fc4ed5aea0e702a694","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/22e6824622e8a8889df0f8fc4ed5aea0e702a694.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42158","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42158.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42123","title":"drm/amdgpu: fix double free err_addr pointer warnings","status":"backported","project":false,"upstream":[{"sha":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","url":"https://git.kernel.org/stable/c/506c245f3f1cd989cb89811a7f06e04ff8813a0d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42118","title":"drm/amd/display: Do not return negative stream id for array","status":"backported","project":false,"upstream":[{"sha":"3ac31c9a707dd1c7c890b95333182f955e9dcb57","url":"https://git.kernel.org/stable/c/3ac31c9a707dd1c7c890b95333182f955e9dcb57"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3ac31c9a707dd1c7c890b95333182f955e9dcb57","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/3ac31c9a707dd1c7c890b95333182f955e9dcb57.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41932","title":"sched: fix warning in sched_setaffinity","status":"backported","project":false,"upstream":[{"sha":"70ee7947a29029736a1a06c73a48ff37674a851b","url":"https://git.kernel.org/stable/c/70ee7947a29029736a1a06c73a48ff37674a851b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5c3fb75f538cfcb886f6dfeb497d99fc2f263ee6","label":"5c3fb75f538c","date":"2024-12-14T20:04:11+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"70ee7947a29029736a1a06c73a48ff37674a851b","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/70ee7947a29029736a1a06c73a48ff37674a851b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41085","title":"cxl/mem: Fix no cxl_nvd during pmem region auto-assembling","status":"backported","project":false,"upstream":[{"sha":"84ec985944ef34a34a1605b93ce401aa8737af96","url":"https://git.kernel.org/stable/c/84ec985944ef34a34a1605b93ce401aa8737af96"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"84ec985944ef34a34a1605b93ce401aa8737af96","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41082","title":"nvme-fabrics: use reserved tag for reg read/write command","status":"backported","project":false,"upstream":[{"sha":"7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa","url":"https://git.kernel.org/stable/c/7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41082","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41082.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41045","title":"bpf: Defer work in bpf_timer_cancel_and_free","status":"backported","project":false,"upstream":[{"sha":"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69","url":"https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41045","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41045.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41023","title":"sched/deadline: Fix task_struct reference leak","status":"backported","project":false,"upstream":[{"sha":"b58652db66c910c2245f5bee7deca41c12d707b9","url":"https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"b58652db66c910c2245f5bee7deca41c12d707b9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41023","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41023.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40999","title":"net: ena: Add validation for completion descriptors consistency","status":"backported","project":false,"upstream":[{"sha":"b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7","url":"https://git.kernel.org/stable/c/b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40979","title":"wifi: ath12k: fix kernel crash during resume","status":"backported","project":false,"upstream":[{"sha":"303c017821d88ebad887814114d4e5966d320b28","url":"https://git.kernel.org/stable/c/303c017821d88ebad887814114d4e5966d320b28"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"303c017821d88ebad887814114d4e5966d320b28","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40979","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40979.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40975","title":"platform/x86: x86-android-tablets: Unregister devices in reverse order","status":"backported","project":false,"upstream":[{"sha":"3de0f2627ef849735f155c1818247f58404dddfe","url":"https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3de0f2627ef849735f155c1818247f58404dddfe","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40969","title":"f2fs: don't set RO when shutting down f2fs","status":"backported","project":false,"upstream":[{"sha":"3bdb7f161697e2d5123b89fe1778ef17a44858e7","url":"https://git.kernel.org/stable/c/3bdb7f161697e2d5123b89fe1778ef17a44858e7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3bdb7f161697e2d5123b89fe1778ef17a44858e7","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/3bdb7f161697e2d5123b89fe1778ef17a44858e7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40969","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40969.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40965","title":"i2c: lpi2c: Avoid calling clk_get_rate during transfer","status":"backported","project":false,"upstream":[{"sha":"4268254a39484fc11ba991ae148bacbe75d9cc0a","url":"https://git.kernel.org/stable/c/4268254a39484fc11ba991ae148bacbe75d9cc0a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4268254a39484fc11ba991ae148bacbe75d9cc0a","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/4268254a39484fc11ba991ae148bacbe75d9cc0a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40965","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40965.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40918","title":"parisc: Try to fix random segmentation faults in package builds","status":"backported","project":false,"upstream":[{"sha":"72d95924ee35c8cd16ef52f912483ee938a34d49","url":"https://git.kernel.org/stable/c/72d95924ee35c8cd16ef52f912483ee938a34d49"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"72d95924ee35c8cd16ef52f912483ee938a34d49","lines":655,"reason":"","source":"https://github.com/torvalds/linux/commit/72d95924ee35c8cd16ef52f912483ee938a34d49.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-39508","title":"io_uring/io-wq: Use set_bit() and test_bit() at worker->flags","status":"backported","project":false,"upstream":[{"sha":"8a565304927fbd28c9f028c492b5c1714002cbab","url":"https://git.kernel.org/stable/c/8a565304927fbd28c9f028c492b5c1714002cbab"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"8a565304927fbd28c9f028c492b5c1714002cbab","lines":137,"reason":"","source":"https://github.com/torvalds/linux/commit/8a565304927fbd28c9f028c492b5c1714002cbab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-39508","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-39508.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-39478","title":"crypto: starfive - Do not free stack buffer","status":"backported","project":false,"upstream":[{"sha":"d7f01649f4eaf1878472d3d3f480ae1e50d98f6c","url":"https://git.kernel.org/stable/c/d7f01649f4eaf1878472d3d3f480ae1e50d98f6c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d7f01649f4eaf1878472d3d3f480ae1e50d98f6c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-39478","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-39478.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-38608","title":"net/mlx5e: Fix netif state handling","status":"backported","project":false,"upstream":[{"sha":"3d5918477f94e4c2f064567875c475468e264644","url":"https://git.kernel.org/stable/c/3d5918477f94e4c2f064567875c475468e264644"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3d5918477f94e4c2f064567875c475468e264644","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-38608","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-38608.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-38595","title":"net/mlx5: Fix peer devlink set for SF representor devlink port","status":"backported","project":false,"upstream":[{"sha":"3c453e8cc672de1f9c662948dba43176bc68d7f0","url":"https://git.kernel.org/stable/c/3c453e8cc672de1f9c662948dba43176bc68d7f0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3c453e8cc672de1f9c662948dba43176bc68d7f0","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/3c453e8cc672de1f9c662948dba43176bc68d7f0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-38595","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-38595.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36951","title":"drm/amdkfd: range check cp bad op exception interrupts","status":"backported","project":false,"upstream":[{"sha":"0cac183b98d8a8c692c98e8dba37df15a9e9210d","url":"https://git.kernel.org/stable/c/0cac183b98d8a8c692c98e8dba37df15a9e9210d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0cac183b98d8a8c692c98e8dba37df15a9e9210d","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/0cac183b98d8a8c692c98e8dba37df15a9e9210d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36951","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36951.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36949","title":"amd/amdkfd: sync all devices to wait all processes being evicted","status":"backported","project":false,"upstream":[{"sha":"d06af584be5a769d124b7302b32a033e9559761d","url":"https://git.kernel.org/stable/c/d06af584be5a769d124b7302b32a033e9559761d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d06af584be5a769d124b7302b32a033e9559761d","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/d06af584be5a769d124b7302b32a033e9559761d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36024","title":"drm/amd/display: Disable idle reallow as part of command/gpint execution","status":"backported","project":false,"upstream":[{"sha":"6226a5aa77370329e01ee8abe50a95e60618ce97","url":"https://git.kernel.org/stable/c/6226a5aa77370329e01ee8abe50a95e60618ce97"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6226a5aa77370329e01ee8abe50a95e60618ce97","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/6226a5aa77370329e01ee8abe50a95e60618ce97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36024","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36024.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35961","title":"net/mlx5: Register devlink first under devlink lock","status":"backported","project":false,"upstream":[{"sha":"c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8","url":"https://git.kernel.org/stable/c/c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8","lines":106,"reason":"","source":"https://github.com/torvalds/linux/commit/c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35942","title":"pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain","status":"backported","project":false,"upstream":[{"sha":"697624ee8ad557ab5417f985d2c804241a7ad30d","url":"https://git.kernel.org/stable/c/697624ee8ad557ab5417f985d2c804241a7ad30d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"697624ee8ad557ab5417f985d2c804241a7ad30d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35942","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35942.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35931","title":"drm/amdgpu: Skip do PCI error slot reset during RAS recovery","status":"backported","project":false,"upstream":[{"sha":"601429cca96b4af3be44172c3b64e4228515dbe1","url":"https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"601429cca96b4af3be44172c3b64e4228515dbe1","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/601429cca96b4af3be44172c3b64e4228515dbe1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35931","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35931.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35887","title":"ax25: fix use-after-free bugs caused by ax25_ds_del_timer","status":"backported","project":false,"upstream":[{"sha":"fd819ad3ecf6f3c232a06b27423ce9ed8c20da89","url":"https://git.kernel.org/stable/c/fd819ad3ecf6f3c232a06b27423ce9ed8c20da89"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"fd819ad3ecf6f3c232a06b27423ce9ed8c20da89","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35887","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35887.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35843","title":"iommu/vt-d: Use device rbtree in iopf reporting path","status":"backported","project":false,"upstream":[{"sha":"def054b01a867822254e1dda13d587f5c7a99e2a","url":"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"def054b01a867822254e1dda13d587f5c7a99e2a","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/def054b01a867822254e1dda13d587f5c7a99e2a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35843","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35843.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35808","title":"md/dm-raid: don't call md_reap_sync_thread() directly","status":"backported","project":false,"upstream":[{"sha":"cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","url":"https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35799","title":"drm/amd/display: Prevent crash when disable stream","status":"backported","project":false,"upstream":[{"sha":"72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c","url":"https://git.kernel.org/stable/c/72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35794","title":"dm-raid: really frozen sync_thread during suspend","status":"backported","project":false,"upstream":[{"sha":"16c4770c75b1223998adbeb7286f9a15c65fba73","url":"https://git.kernel.org/stable/c/16c4770c75b1223998adbeb7286f9a15c65fba73"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"16c4770c75b1223998adbeb7286f9a15c65fba73","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/16c4770c75b1223998adbeb7286f9a15c65fba73.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35794","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35794.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27079","title":"iommu/vt-d: Fix NULL domain on device release","status":"backported","project":false,"upstream":[{"sha":"81e921fd321614c2ad8ac333b041aae1da7a1c6d","url":"https://git.kernel.org/stable/c/81e921fd321614c2ad8ac333b041aae1da7a1c6d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"81e921fd321614c2ad8ac333b041aae1da7a1c6d","lines":121,"reason":"","source":"https://github.com/torvalds/linux/commit/81e921fd321614c2ad8ac333b041aae1da7a1c6d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27012","title":"netfilter: nf_tables: restore set elements when delete set fails","status":"backported","project":false,"upstream":[{"sha":"e79b47a8615d42c68aaeb68971593333667382ed","url":"https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"e79b47a8615d42c68aaeb68971593333667382ed","lines":201,"reason":"","source":"https://github.com/torvalds/linux/commit/e79b47a8615d42c68aaeb68971593333667382ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27012","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27012.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27010","title":"net/sched: Fix mirred deadlock on device recursion","status":"backported","project":false,"upstream":[{"sha":"0f022d32c3eca477fbf79a205243a6123ed0fe11","url":"https://git.kernel.org/stable/c/0f022d32c3eca477fbf79a205243a6123ed0fe11"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0f022d32c3eca477fbf79a205243a6123ed0fe11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26962","title":"dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape","status":"backported","project":false,"upstream":[{"sha":"41425f96d7aa59bc865f60f5dda3d7697b555677","url":"https://git.kernel.org/stable/c/41425f96d7aa59bc865f60f5dda3d7697b555677"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"41425f96d7aa59bc865f60f5dda3d7697b555677","lines":217,"reason":"","source":"https://github.com/torvalds/linux/commit/41425f96d7aa59bc865f60f5dda3d7697b555677.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26962","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26962.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26948","title":"drm/amd/display: Add a dc_state NULL check in dc_state_release","status":"backported","project":false,"upstream":[{"sha":"334b56cea5d9df5989be6cf1a5898114fa70ad98","url":"https://git.kernel.org/stable/c/334b56cea5d9df5989be6cf1a5898114fa70ad98"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"334b56cea5d9df5989be6cf1a5898114fa70ad98","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26948","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26948.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26944","title":"btrfs: zoned: fix use-after-free in do_zone_finish()","status":"backported","project":false,"upstream":[{"sha":"1ec17ef59168a1a6f1105f5dc517f783839a5302","url":"https://git.kernel.org/stable/c/1ec17ef59168a1a6f1105f5dc517f783839a5302"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1ec17ef59168a1a6f1105f5dc517f783839a5302","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/1ec17ef59168a1a6f1105f5dc517f783839a5302.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26914","title":"drm/amd/display: fix incorrect mpc_combine array size","status":"backported","project":false,"upstream":[{"sha":"39079fe8e660851abbafa90cd55cbf029210661f","url":"https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"39079fe8e660851abbafa90cd55cbf029210661f","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/39079fe8e660851abbafa90cd55cbf029210661f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26913","title":"drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue","status":"backported","project":false,"upstream":[{"sha":"faf51b201bc42adf500945732abb6220c707d6f3","url":"https://git.kernel.org/stable/c/faf51b201bc42adf500945732abb6220c707d6f3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"faf51b201bc42adf500945732abb6220c707d6f3","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/faf51b201bc42adf500945732abb6220c707d6f3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26913","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26913.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26836","title":"platform/x86: think-lmi: Fix password opcode ordering for workstations","status":"backported","project":false,"upstream":[{"sha":"6f7d0f5fd8e440c3446560100ac4ff9a55eec340","url":"https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f7d0f5fd8e440c3446560100ac4ff9a55eec340","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/6f7d0f5fd8e440c3446560100ac4ff9a55eec340.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26836","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26836.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26768","title":"LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]","status":"backported","project":false,"upstream":[{"sha":"4551b30525cf3d2f026b92401ffe241eb04dfebe","url":"https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4551b30525cf3d2f026b92401ffe241eb04dfebe","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/4551b30525cf3d2f026b92401ffe241eb04dfebe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26758","title":"md: Don't ignore suspended array in md_check_recovery()","status":"backported","project":false,"upstream":[{"sha":"1baae052cccd08daf9a9d64c3f959d8cdb689757","url":"https://git.kernel.org/stable/c/1baae052cccd08daf9a9d64c3f959d8cdb689757"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1baae052cccd08daf9a9d64c3f959d8cdb689757","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/1baae052cccd08daf9a9d64c3f959d8cdb689757.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26758","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26758.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26757","title":"md: Don't ignore read-only array in md_check_recovery()","status":"backported","project":false,"upstream":[{"sha":"55a48ad2db64737f7ffc0407634218cc6e4c513b","url":"https://git.kernel.org/stable/c/55a48ad2db64737f7ffc0407634218cc6e4c513b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"55a48ad2db64737f7ffc0407634218cc6e4c513b","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/55a48ad2db64737f7ffc0407634218cc6e4c513b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26757","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26757.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26756","title":"md: Don't register sync_thread for reshape directly","status":"backported","project":false,"upstream":[{"sha":"ad39c08186f8a0f221337985036ba86731d6aafe","url":"https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad39c08186f8a0f221337985036ba86731d6aafe","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/ad39c08186f8a0f221337985036ba86731d6aafe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26756","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26756.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26691","title":"KVM: arm64: Fix circular locking dependency","status":"backported","project":false,"upstream":[{"sha":"10c02aad111df02088d1a81792a709f6a7eca6cc","url":"https://git.kernel.org/stable/c/10c02aad111df02088d1a81792a709f6a7eca6cc"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"10c02aad111df02088d1a81792a709f6a7eca6cc","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/10c02aad111df02088d1a81792a709f6a7eca6cc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26691","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26691.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26672","title":"drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'","status":"backported","project":false,"upstream":[{"sha":"4f32504a2f85a7b40fe149436881381f48e9c0c0","url":"https://git.kernel.org/stable/c/4f32504a2f85a7b40fe149436881381f48e9c0c0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4f32504a2f85a7b40fe149436881381f48e9c0c0","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/4f32504a2f85a7b40fe149436881381f48e9c0c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26672","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26672.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26662","title":"drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'","status":"backported","project":false,"upstream":[{"sha":"e96fddb32931d007db12b1fce9b5e8e4c080401b","url":"https://git.kernel.org/stable/c/e96fddb32931d007db12b1fce9b5e8e4c080401b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e96fddb32931d007db12b1fce9b5e8e4c080401b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26662","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26662.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26661","title":"drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'","status":"backported","project":false,"upstream":[{"sha":"66951d98d9bf45ba25acf37fe0747253fafdf298","url":"https://git.kernel.org/stable/c/66951d98d9bf45ba25acf37fe0747253fafdf298"},{"sha":"17ba9cde11c2bfebbd70867b0a2ac4a22e573379","url":"https://git.kernel.org/stable/c/17ba9cde11c2bfebbd70867b0a2ac4a22e573379"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"66951d98d9bf45ba25acf37fe0747253fafdf298","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/66951d98d9bf45ba25acf37fe0747253fafdf298.patch"},{"sha":"17ba9cde11c2bfebbd70867b0a2ac4a22e573379","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/17ba9cde11c2bfebbd70867b0a2ac4a22e573379.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54280","title":"cifs: fix potential race when tree connecting ipc","status":"backported","project":false,"upstream":[{"sha":"ee20d7c6100752eaf2409d783f4f1449c29ea33d","url":"https://git.kernel.org/stable/c/ee20d7c6100752eaf2409d783f4f1449c29ea33d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ee20d7c6100752eaf2409d783f4f1449c29ea33d","lines":81,"reason":"","source":"https://github.com/torvalds/linux/commit/ee20d7c6100752eaf2409d783f4f1449c29ea33d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54280","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54280.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54263","title":"drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP","status":"backported","project":false,"upstream":[{"sha":"ea293f823a8805735d9e00124df81a8f448ed1ae","url":"https://git.kernel.org/stable/c/ea293f823a8805735d9e00124df81a8f448ed1ae"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ea293f823a8805735d9e00124df81a8f448ed1ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54263","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54263.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54233","title":"ASoC: SOF: avoid a NULL dereference with unsupported widgets","status":"backported","project":false,"upstream":[{"sha":"e3720f92e0237921da537e47a0b24e27899203f8","url":"https://git.kernel.org/stable/c/e3720f92e0237921da537e47a0b24e27899203f8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e3720f92e0237921da537e47a0b24e27899203f8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54233","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54233.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54227","title":"blk-mq: fix tags leak when shrink nr_hw_queues","status":"backported","project":false,"upstream":[{"sha":"e1dd7bc93029024af5688253b0c05181d6e01f8e","url":"https://git.kernel.org/stable/c/e1dd7bc93029024af5688253b0c05181d6e01f8e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e1dd7bc93029024af5688253b0c05181d6e01f8e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54227","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54227.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54141","title":"wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018","status":"backported","project":false,"upstream":[{"sha":"ce282d8de71f07f0056ea319541141152c65f552","url":"https://git.kernel.org/stable/c/ce282d8de71f07f0056ea319541141152c65f552"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ce282d8de71f07f0056ea319541141152c65f552","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54141","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54141.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54030","title":"io_uring/net: don't overflow multishot recv","status":"backported","project":false,"upstream":[{"sha":"b2e74db55dd93d6db22a813c9a775b5dbf87c560","url":"https://git.kernel.org/stable/c/b2e74db55dd93d6db22a813c9a775b5dbf87c560"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b2e74db55dd93d6db22a813c9a775b5dbf87c560","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b2e74db55dd93d6db22a813c9a775b5dbf87c560.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54030","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54030.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53999","title":"net/mlx5e: TC, Fix internal port memory leak","status":"backported","project":false,"upstream":[{"sha":"ac5da544a3c2047cbfd715acd9cec8380d7fe5c6","url":"https://git.kernel.org/stable/c/ac5da544a3c2047cbfd715acd9cec8380d7fe5c6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ac5da544a3c2047cbfd715acd9cec8380d7fe5c6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53857","title":"bpf: bpf_sk_storage: Fix invalid wait context lockdep report","status":"backported","project":false,"upstream":[{"sha":"a96a44aba556c42b432929d37d60158aca21ad4c","url":"https://git.kernel.org/stable/c/a96a44aba556c42b432929d37d60158aca21ad4c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a96a44aba556c42b432929d37d60158aca21ad4c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53857","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53857.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53851","title":"drm/msm/dp: Drop aux devices together with DP controller","status":"backported","project":false,"upstream":[{"sha":"a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d","url":"https://git.kernel.org/stable/c/a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53851","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53851.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53762","title":"Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync","status":"backported","project":false,"upstream":[{"sha":"94d9ba9f9888b748d4abd2aa1547af56ae85f772","url":"https://git.kernel.org/stable/c/94d9ba9f9888b748d4abd2aa1547af56ae85f772"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"94d9ba9f9888b748d4abd2aa1547af56ae85f772","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53627","title":"scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list","status":"backported","project":false,"upstream":[{"sha":"71fb36b5ff113a7674710b9d6063241eada84ff7","url":"https://git.kernel.org/stable/c/71fb36b5ff113a7674710b9d6063241eada84ff7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"71fb36b5ff113a7674710b9d6063241eada84ff7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53627","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53627.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53574","title":"wifi: rtw88: delete timer and free skb queue when unloading","status":"backported","project":false,"upstream":[{"sha":"634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216","url":"https://git.kernel.org/stable/c/634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53574","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53574.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53538","title":"btrfs: insert tree mod log move in push_node_left","status":"backported","project":false,"upstream":[{"sha":"5cead5422a0e3d13b0bcee986c0f5c4ebb94100b","url":"https://git.kernel.org/stable/c/5cead5422a0e3d13b0bcee986c0f5c4ebb94100b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5cead5422a0e3d13b0bcee986c0f5c4ebb94100b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53529","title":"wifi: rtw88: Fix memory leak in rtw88_usb","status":"backported","project":false,"upstream":[{"sha":"59a3a312009723e3e5082899655fdcc420e2b47a","url":"https://git.kernel.org/stable/c/59a3a312009723e3e5082899655fdcc420e2b47a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"59a3a312009723e3e5082899655fdcc420e2b47a","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/59a3a312009723e3e5082899655fdcc420e2b47a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53529","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53529.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53460","title":"wifi: rtw88: fix memory leak in rtw_usb_probe()","status":"backported","project":false,"upstream":[{"sha":"48181d285623198c33bb9698992502687b258efa","url":"https://git.kernel.org/stable/c/48181d285623198c33bb9698992502687b258efa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"48181d285623198c33bb9698992502687b258efa","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/48181d285623198c33bb9698992502687b258efa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53460","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53460.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53429","title":"btrfs: don't check PageError in __extent_writepage","status":"backported","project":false,"upstream":[{"sha":"3e92499e3b004baffb479d61e191b41b604ece9a","url":"https://git.kernel.org/stable/c/3e92499e3b004baffb479d61e191b41b604ece9a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3e92499e3b004baffb479d61e191b41b604ece9a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53429","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53429.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53367","title":"accel/habanalabs: fix mem leak in capture user mappings","status":"backported","project":false,"upstream":[{"sha":"314a7ffd7c196b27eedd50cb7553029e17789b55","url":"https://git.kernel.org/stable/c/314a7ffd7c196b27eedd50cb7553029e17789b55"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"314a7ffd7c196b27eedd50cb7553029e17789b55","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/314a7ffd7c196b27eedd50cb7553029e17789b55.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53367","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53367.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53353","title":"accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()","status":"backported","project":false,"upstream":[{"sha":"2e8e9a895c4589f124a37fc84d123b5114406e94","url":"https://git.kernel.org/stable/c/2e8e9a895c4589f124a37fc84d123b5114406e94"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2e8e9a895c4589f124a37fc84d123b5114406e94","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53353","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53353.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53336","title":"media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings","status":"backported","project":false,"upstream":[{"sha":"284be5693163343e1cf17c03917eecd1d6681bcf","url":"https://git.kernel.org/stable/c/284be5693163343e1cf17c03917eecd1d6681bcf"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"284be5693163343e1cf17c03917eecd1d6681bcf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53336","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53336.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53231","title":"erofs: Fix detection of atomic context","status":"backported","project":false,"upstream":[{"sha":"12d0a24afd9ea58e581ea64d64e066f2027b28d9","url":"https://git.kernel.org/stable/c/12d0a24afd9ea58e581ea64d64e066f2027b28d9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"12d0a24afd9ea58e581ea64d64e066f2027b28d9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53231","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53231.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53218","title":"rxrpc: Make it so that a waiting process can be aborted","status":"backported","project":false,"upstream":[{"sha":"0eb362d254814ce04848730bf32e75b8ee1a4d6c","url":"https://git.kernel.org/stable/c/0eb362d254814ce04848730bf32e75b8ee1a4d6c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0eb362d254814ce04848730bf32e75b8ee1a4d6c","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/0eb362d254814ce04848730bf32e75b8ee1a4d6c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53218","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53218.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52920","title":"bpf: support non-r10 register spill/fill to/from stack in precision tracking","status":"backported","project":false,"upstream":[{"sha":"41f6f64e6999a837048b1bd13a2f8742964eca6b","url":"https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"41f6f64e6999a837048b1bd13a2f8742964eca6b","lines":496,"reason":"","source":"https://github.com/torvalds/linux/commit/41f6f64e6999a837048b1bd13a2f8742964eca6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52888","title":"media: mediatek: vcodec: Only free buffer VA that is not NULL","status":"backported","project":false,"upstream":[{"sha":"eb005c801ec70ff4307727bd3bd6e8280169ef32","url":"https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"eb005c801ec70ff4307727bd3bd6e8280169ef32","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52888","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52888.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52797","title":"drivers: perf: Check find_first_bit() return value","status":"backported","project":false,"upstream":[{"sha":"c6e316ac05532febb0c966fa9b55f5258ed037be","url":"https://git.kernel.org/stable/c/c6e316ac05532febb0c966fa9b55f5258ed037be"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6e316ac05532febb0c966fa9b55f5258ed037be","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/c6e316ac05532febb0c966fa9b55f5258ed037be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52676","title":"bpf: Guard stack limits against 32bit overflow","status":"backported","project":false,"upstream":[{"sha":"1d38a9ee81570c4bd61f557832dead4d6f816760","url":"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1d38a9ee81570c4bd61f557832dead4d6f816760","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52676","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52676.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52671","title":"drm/amd/display: Fix hang/underflow when transitioning to ODM4:1","status":"backported","project":false,"upstream":[{"sha":"e7b2b108cdeab76a7e7324459e50b0c1214c0386","url":"https://git.kernel.org/stable/c/e7b2b108cdeab76a7e7324459e50b0c1214c0386"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e7b2b108cdeab76a7e7324459e50b0c1214c0386","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52671","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52671.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52648","title":"drm/vmwgfx: Unmap the surface before resetting it on a plane state","status":"backported","project":false,"upstream":[{"sha":"27571c64f1855881753e6f33c3186573afbab7ba","url":"https://git.kernel.org/stable/c/27571c64f1855881753e6f33c3186573afbab7ba"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"27571c64f1855881753e6f33c3186573afbab7ba","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/27571c64f1855881753e6f33c3186573afbab7ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52648","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52648.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52629","title":"sh: push-switch: Reorder cleanup operations to avoid use-after-free bug","status":"backported","project":false,"upstream":[{"sha":"246f80a0b17f8f582b2c0996db02998239057c65","url":"https://git.kernel.org/stable/c/246f80a0b17f8f582b2c0996db02998239057c65"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"246f80a0b17f8f582b2c0996db02998239057c65","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52629","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52629.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52625","title":"drm/amd/display: Refactor DMCUB enter/exit idle interface","status":"backported","project":false,"upstream":[{"sha":"8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa","url":"https://git.kernel.org/stable/c/8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa","lines":118,"reason":"","source":"https://github.com/torvalds/linux/commit/8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52625","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52625.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52624","title":"drm/amd/display: Wake DMCUB before executing GPINT commands","status":"backported","project":false,"upstream":[{"sha":"e5ffd1263dd5b44929c676171802e7b6af483f21","url":"https://git.kernel.org/stable/c/e5ffd1263dd5b44929c676171802e7b6af483f21"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"e5ffd1263dd5b44929c676171802e7b6af483f21","lines":213,"reason":"","source":"https://github.com/torvalds/linux/commit/e5ffd1263dd5b44929c676171802e7b6af483f21.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52624","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52624.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52590","title":"ocfs2: Avoid touching renamed directory if parent does not change","status":"backported","project":false,"upstream":[{"sha":"9d618d19b29c2943527e3a43da0a35aea91062fc","url":"https://git.kernel.org/stable/c/9d618d19b29c2943527e3a43da0a35aea91062fc"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9d618d19b29c2943527e3a43da0a35aea91062fc","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52590","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52590.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2021-47645","title":"media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com","status":"not-applicable","project":false,"upstream":[{"sha":"e3b86f4e558cea9eed71d894df2f19b10d60a207","url":"https://git.kernel.org/stable/c/e3b86f4e558cea9eed71d894df2f19b10d60a207"},{"sha":"8dce4b265a5357731058f69645840dabc718c687","url":"https://git.kernel.org/stable/c/8dce4b265a5357731058f69645840dabc718c687"}],"evidence":[],"submission_lore":[],"basis":"The relocated Zoran driver already uses the corrected even buffer index and checks for a NULL buffer in zoran_reap_stat_com. Both effective fix changes are present. The separate 2019 driver-removal commit is not required for this restored driver implementation.","review":{"id":"CVE-2021-47645","series":"6.12.y","upstream":["e3b86f4e558cea9eed71d894df2f19b10d60a207","8dce4b265a5357731058f69645840dabc718c687"],"checked_sha":"e2acc2211022246c77740d5df08265cc27eedcc5","checked_version":"6.12.111","kind":"already-fixed","applicability":"fixed","reason":"The relocated Zoran driver already uses the corrected even buffer index and checks for a NULL buffer in zoran_reap_stat_com. Both effective fix changes are present. The separate 2019 driver-removal commit is not required for this restored driver implementation.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/media/pci/zoran/zoran_device.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/media/pci/zoran/zoran_device.c?id=e2acc2211022246c77740d5df08265cc27eedcc5#n794"},{"label":"Upstream fix 8dce4b265a53","url":"https://git.kernel.org/stable/c/8dce4b265a5357731058f69645840dabc718c687"},{"label":"Upstream fix e3b86f4e558c","url":"https://git.kernel.org/stable/c/e3b86f4e558cea9eed71d894df2f19b10d60a207"}]},"size":{"status":"over-limit","patches":[{"sha":"e3b86f4e558cea9eed71d894df2f19b10d60a207","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/e3b86f4e558cea9eed71d894df2f19b10d60a207.patch"},{"sha":"8dce4b265a5357731058f69645840dabc718c687","lines":11302,"reason":"","source":"https://github.com/torvalds/linux/commit/8dce4b265a5357731058f69645840dabc718c687.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2021-47645","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2021/CVE-2021-47645.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"}],"counts":{"backported":30,"queued":0,"unfixed":231,"unknown":4,"not-applicable":41},"triage_counts":{"over-limit":54,"within-limit":177,"size-unknown":0,"already-fixed":1,"applicable":25,"ineffective-fix":0,"needs-review":0,"no-op":0,"not-applicable":6}},{"series":"6.18.y","ref":"FETCH_HEAD","sha":"1253a6aa5d104312bf0992afacc15220ae35bdf9","committed_at":"2026-10-26T16:09:28+01:00","version":"6.18.59","records":[{"id":"CVE-2026-100073","title":"ext4: fix transaction overflow during writeback","status":"unfixed","project":false,"upstream":[{"sha":"46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","url":"https://git.kernel.org/stable/c/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-100073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-100073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-100072","title":"ACPI: platform: Use acpi_bus_get_primary_device()","status":"unfixed","project":false,"upstream":[{"sha":"a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","url":"https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-100072","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-100072.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99215","title":"power: supply: core: prevent unregistering a power supply while a callback runs","status":"backported","project":false,"upstream":[{"sha":"5b4bd13e0552926648a46c2c9a12a24dfaee3715","url":"https://git.kernel.org/stable/c/5b4bd13e0552926648a46c2c9a12a24dfaee3715"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2ac0256a28e15c4888fa394d1fe66cf7b1d58090","label":"2ac0256a28e1","date":"2026-10-26T16:09:17+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5b4bd13e0552926648a46c2c9a12a24dfaee3715","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/5b4bd13e0552926648a46c2c9a12a24dfaee3715.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99215","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99215.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99211","title":"netlink: reset skb headers before unicast and multicast filtering","status":"backported","project":false,"upstream":[{"sha":"8bf659bd54e1f00e34cf5244b1d289c506fa47c0","url":"https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/06791594274f87c29f1a9f1961d700272716a49d","label":"06791594274f","date":"2026-10-26T16:09:18+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8bf659bd54e1f00e34cf5244b1d289c506fa47c0","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/8bf659bd54e1f00e34cf5244b1d289c506fa47c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99209","title":"drm/xe: skip eviction of a BO with no resource","status":"backported","project":false,"upstream":[{"sha":"448e76cbdc6652ccd3ba337b7a6e1f028859f2ed","url":"https://git.kernel.org/stable/c/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6046bb9cb2859e3d9bf939e4d6527f3827e1096f","label":"6046bb9cb285","date":"2026-10-26T16:09:18+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"448e76cbdc6652ccd3ba337b7a6e1f028859f2ed","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99209","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99209.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99208","title":"drm/xe/oa: Zero OA buffer at allocation","status":"backported","project":false,"upstream":[{"sha":"fd8662823caa114a63f07222d2aa448f6ac5e864","url":"https://git.kernel.org/stable/c/fd8662823caa114a63f07222d2aa448f6ac5e864"}],"evidence":[{"url":"https://git.kernel.org/stable/c/21f41b6daf0dbe2cdaaf9f54af6e23fd3c9190b9","label":"21f41b6daf0d","date":"2026-10-26T16:09:18+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd8662823caa114a63f07222d2aa448f6ac5e864","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/fd8662823caa114a63f07222d2aa448f6ac5e864.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99208","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99208.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99191","title":"calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()","status":"backported","project":false,"upstream":[{"sha":"8070ed578b6b9134e045627fb745c887a806d46e","url":"https://git.kernel.org/stable/c/8070ed578b6b9134e045627fb745c887a806d46e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1c9fcfca51e3c5cd46dd72a4da74d56eff183513","label":"1c9fcfca51e3","date":"2026-10-26T16:09:19+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8070ed578b6b9134e045627fb745c887a806d46e","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/8070ed578b6b9134e045627fb745c887a806d46e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99191","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99191.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99189","title":"gpio: mxc: fix race between chained IRQ handler install and probe completion","status":"backported","project":false,"upstream":[{"sha":"38d44f78f041ffe60c8e2443b99434a199e7541d","url":"https://git.kernel.org/stable/c/38d44f78f041ffe60c8e2443b99434a199e7541d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/261802c14e1a3281987ea8f106701e5ed9652f68","label":"261802c14e1a","date":"2026-10-26T16:09:20+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"38d44f78f041ffe60c8e2443b99434a199e7541d","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/38d44f78f041ffe60c8e2443b99434a199e7541d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99189","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99189.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99183","title":"accel/rocket: search every core slot when looking up a scheduler","status":"unfixed","project":false,"upstream":[{"sha":"89c2c777df17eb0201c8e22afabbf3691f2a28fe","url":"https://git.kernel.org/stable/c/89c2c777df17eb0201c8e22afabbf3691f2a28fe"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"89c2c777df17eb0201c8e22afabbf3691f2a28fe","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/89c2c777df17eb0201c8e22afabbf3691f2a28fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99183","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99183.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99178","title":"x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context","status":"backported","project":false,"upstream":[{"sha":"81d99abe2bd81379abfb595e403bbbee6fbfc624","url":"https://git.kernel.org/stable/c/81d99abe2bd81379abfb595e403bbbee6fbfc624"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b77e9622bbade9812e2090c66d25c372f515e921","label":"b77e9622bbad","date":"2026-10-26T16:09:20+01:00","lore":["https://lore.kernel.org/all/20211126123145.2772-1-jiangshanlai@gmail.com/","https://lore.kernel.org/all/ed71d0967113a35f670a9625a058b8e6e0b2f104.1583547991.git.luto@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"81d99abe2bd81379abfb595e403bbbee6fbfc624","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/81d99abe2bd81379abfb595e403bbbee6fbfc624.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99178","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99178.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99172","title":"ipc: drop the mqueue mount with kern_unmount() on setup failure","status":"unfixed","project":false,"upstream":[{"sha":"f0e48172a59e517e613b73f73cc35f24fd123aeb","url":"https://git.kernel.org/stable/c/f0e48172a59e517e613b73f73cc35f24fd123aeb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0e48172a59e517e613b73f73cc35f24fd123aeb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f0e48172a59e517e613b73f73cc35f24fd123aeb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99172","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99172.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99146","title":"drm/i915/dmc: Add sanity check for DMC load address","status":"backported","project":false,"upstream":[{"sha":"7dedc5bb11f95e96fe80757c924d8d9aa7327759","url":"https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ef82b4d5cb4a3fe77c7f99008d78b8c64709e258","label":"ef82b4d5cb4a","date":"2026-10-26T16:09:23+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7dedc5bb11f95e96fe80757c924d8d9aa7327759","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/7dedc5bb11f95e96fe80757c924d8d9aa7327759.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99146","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99146.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99125","title":"s390/pai: Handle multiple PMU stop callback invocations","status":"unknown","project":false,"upstream":[{"sha":"f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40","url":"https://git.kernel.org/stable/c/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99122","title":"vsock/vmci: validate packet source for connected sockets","status":"backported","project":false,"upstream":[{"sha":"ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7","url":"https://git.kernel.org/stable/c/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c027f8b429dbb2157fc1b503df196e272d947c89","label":"c027f8b429db","date":"2026-10-26T16:09:28+01:00","lore":["https://lore.kernel.org/netdev/20260814121255.6B5001F000E9@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99122","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99122.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99109","title":"smb: client: reject SetEA requests that do not fit the request buffer","status":"unfixed","project":false,"upstream":[{"sha":"4aa2c106aef4bf3dfd97c30842db0767b26e8428","url":"https://git.kernel.org/stable/c/4aa2c106aef4bf3dfd97c30842db0767b26e8428"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4aa2c106aef4bf3dfd97c30842db0767b26e8428","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/4aa2c106aef4bf3dfd97c30842db0767b26e8428.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99109","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99109.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99101","title":"ntfs: move attribute payload before shrinking its record","status":"unknown","project":false,"upstream":[{"sha":"0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","url":"https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99090","title":"drm/amdgpu: serialize vblank counter reads against GPU reset","status":"backported","project":false,"upstream":[{"sha":"1a6023edfbb5673f55fab6348f135fb3b1428ea5","url":"https://git.kernel.org/stable/c/1a6023edfbb5673f55fab6348f135fb3b1428ea5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8d6f773d7479034a574ecc3b585bcd07d46b4824","label":"8d6f773d7479","date":"2026-10-15T11:57:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a6023edfbb5673f55fab6348f135fb3b1428ea5","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/1a6023edfbb5673f55fab6348f135fb3b1428ea5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99090","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99090.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99087","title":"dm-integrity: fix NULL pointer dereference when the 'R' flag is used","status":"backported","project":false,"upstream":[{"sha":"7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84","url":"https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2e25842f0e4423e0efb243f56153d842ed6b933f","label":"2e25842f0e44","date":"2026-10-21T10:32:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99087","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99087.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99086","title":"dm-integrity: validate the superblock on resume","status":"backported","project":false,"upstream":[{"sha":"fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2","url":"https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada","label":"454b67fcc28c","date":"2026-10-21T10:32:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2","lines":80,"reason":"","source":"https://github.com/torvalds/linux/commit/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99086","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99086.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99076","title":"ipv6: udp: Create exceptions before socket matching","status":"unfixed","project":false,"upstream":[{"sha":"ac76cab50e899a7346408b8d3c3a4192c2eefb9f","url":"https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac76cab50e899a7346408b8d3c3a4192c2eefb9f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/ac76cab50e899a7346408b8d3c3a4192c2eefb9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99076","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99076.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99026","title":"net: team: free skb when broadcast has no txable port","status":"backported","project":false,"upstream":[{"sha":"489114c9ecae44e523361a4b3e610ee5ebd9189c","url":"https://git.kernel.org/stable/c/489114c9ecae44e523361a4b3e610ee5ebd9189c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/961563117626f4681623077ec0cfd86f86da0d49","label":"961563117626","date":"2026-10-15T11:57:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"489114c9ecae44e523361a4b3e610ee5ebd9189c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/489114c9ecae44e523361a4b3e610ee5ebd9189c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99021","title":"regulator: of: fill in supply names in of_regulator_bulk_get_all()","status":"backported","project":false,"upstream":[{"sha":"e2151c29cec73f6cc70abf1c7cbc7b9b202489f5","url":"https://git.kernel.org/stable/c/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/82ac8c4939bdbd064b4f54a580fbe4baf0d60e41","label":"82ac8c4939bd","date":"2026-10-15T11:58:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e2151c29cec73f6cc70abf1c7cbc7b9b202489f5","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99021","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99021.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98999","title":"drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin","status":"backported","project":false,"upstream":[{"sha":"cf238c067eaae1cbfb00738e29219b9568d2313e","url":"https://git.kernel.org/stable/c/cf238c067eaae1cbfb00738e29219b9568d2313e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3a11adcfd9a2de74d405bd3e8c4d7a1b328e4684","label":"3a11adcfd9a2","date":"2026-10-15T11:57:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf238c067eaae1cbfb00738e29219b9568d2313e","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/cf238c067eaae1cbfb00738e29219b9568d2313e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98996","title":"fs: don't silently unmount busy mounts","status":"backported","project":false,"upstream":[{"sha":"6857e209015f95be7a8f19a9cd5dac345b9b9859","url":"https://git.kernel.org/stable/c/6857e209015f95be7a8f19a9cd5dac345b9b9859"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bf2c8dec26fb792876b5e9bde7030c45d8be3908","label":"bf2c8dec26fb","date":"2026-10-15T11:57:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"6857e209015f95be7a8f19a9cd5dac345b9b9859","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/6857e209015f95be7a8f19a9cd5dac345b9b9859.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98996","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98996.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98989","title":"namespace: check a recursive bind mount for mount namespace loops","status":"backported","project":false,"upstream":[{"sha":"c640a01a78e42302879006ed7b7d5a9a943ba815","url":"https://git.kernel.org/stable/c/c640a01a78e42302879006ed7b7d5a9a943ba815"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a0ba48256f5dff6f75a45f8ce39fe57f21df1022","label":"a0ba48256f5d","date":"2026-10-15T11:57:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c640a01a78e42302879006ed7b7d5a9a943ba815","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c640a01a78e42302879006ed7b7d5a9a943ba815.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98983","title":"unshare: don't drop active namespace references that were never taken","status":"unfixed","project":false,"upstream":[{"sha":"0b6f31a3c0b16066f812e94b52a704174a6f23cd","url":"https://git.kernel.org/stable/c/0b6f31a3c0b16066f812e94b52a704174a6f23cd"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0b6f31a3c0b16066f812e94b52a704174a6f23cd","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/0b6f31a3c0b16066f812e94b52a704174a6f23cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98983","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98983.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98980","title":"namei: don't reveal overmounted entries in refwalk","status":"backported","project":false,"upstream":[{"sha":"8189ab688f5a2c745dc90b63374da02f213d6994","url":"https://git.kernel.org/stable/c/8189ab688f5a2c745dc90b63374da02f213d6994"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5f97df8ca7fadf5b53954f50073445ba193902c0","label":"5f97df8ca7fa","date":"2026-10-15T11:57:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8189ab688f5a2c745dc90b63374da02f213d6994","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/8189ab688f5a2c745dc90b63374da02f213d6994.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98980","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98980.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98978","title":"namespace: never expire a locked mount","status":"backported","project":false,"upstream":[{"sha":"f78ddcc872248c7aa1d7e904928441a0be4c6d5d","url":"https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6b8dc3713a76346d212abab46cbfc8d7070f534c","label":"6b8dc3713a76","date":"2026-10-15T11:57:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f78ddcc872248c7aa1d7e904928441a0be4c6d5d","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/f78ddcc872248c7aa1d7e904928441a0be4c6d5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98978","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98978.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98975","title":"xfs: stop exchanging reflink flags when exchanging mappings","status":"backported","project":false,"upstream":[{"sha":"d84d6c1a7f1e2de9e601703a326a4c1b7b421943","url":"https://git.kernel.org/stable/c/d84d6c1a7f1e2de9e601703a326a4c1b7b421943"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7d3b9b2c9dc57f93f36c716ab752548cb4db9900","label":"7d3b9b2c9dc5","date":"2026-10-15T11:58:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d84d6c1a7f1e2de9e601703a326a4c1b7b421943","lines":160,"reason":"","source":"https://github.com/torvalds/linux/commit/d84d6c1a7f1e2de9e601703a326a4c1b7b421943.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98972","title":"cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()","status":"unfixed","project":false,"upstream":[{"sha":"e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469","url":"https://git.kernel.org/stable/c/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98972","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98972.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98966","title":"bonding: fix the program leak when XDP is replaced","status":"unfixed","project":false,"upstream":[{"sha":"184b5ddf82d45d6f75cc83719a2e453392512bd2","url":"https://git.kernel.org/stable/c/184b5ddf82d45d6f75cc83719a2e453392512bd2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"184b5ddf82d45d6f75cc83719a2e453392512bd2","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/184b5ddf82d45d6f75cc83719a2e453392512bd2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98966","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98966.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98960","title":"btrfs: don't stash io_uring encoded data across -EAGAIN","status":"unfixed","project":false,"upstream":[{"sha":"51562a8cb11628d3a5e105b4c347ec5473e5745f","url":"https://git.kernel.org/stable/c/51562a8cb11628d3a5e105b4c347ec5473e5745f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"51562a8cb11628d3a5e105b4c347ec5473e5745f","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/51562a8cb11628d3a5e105b4c347ec5473e5745f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98960","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98960.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98959","title":"btrfs: fix xattr replace when multiple xattrs are packed in the same item","status":"backported","project":false,"upstream":[{"sha":"858bee1c77857aabcc2327cd32dd8266332de332","url":"https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a97114b9b00ed3d05156f3b2ddbf797296260389","label":"a97114b9b00e","date":"2026-10-15T11:58:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"858bee1c77857aabcc2327cd32dd8266332de332","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/858bee1c77857aabcc2327cd32dd8266332de332.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98959","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98959.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98958","title":"wifi: mt76: account non-AQL frames per peer rather than per link","status":"backported","project":false,"upstream":[{"sha":"752770d7a58c821c17909c3ca67f9f14ab146a40","url":"https://git.kernel.org/stable/c/752770d7a58c821c17909c3ca67f9f14ab146a40"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9f28f504650869d41f7b3e98e4bc4547af4d5670","label":"9f28f5046508","date":"2026-10-15T11:58:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"752770d7a58c821c17909c3ca67f9f14ab146a40","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/752770d7a58c821c17909c3ca67f9f14ab146a40.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98958","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98958.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98957","title":"wifi: mt76: mt7915: disable rx napi when removing device","status":"backported","project":false,"upstream":[{"sha":"916c484d29d82f45c281da2786fcd6a1284430ce","url":"https://git.kernel.org/stable/c/916c484d29d82f45c281da2786fcd6a1284430ce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0f9afe238eeb79829f0f92f376ba3a20781caccd","label":"0f9afe238eeb","date":"2026-10-15T11:58:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"916c484d29d82f45c281da2786fcd6a1284430ce","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/916c484d29d82f45c281da2786fcd6a1284430ce.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98957","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98957.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98954","title":"net: always dissect GSO packets in __virtio_net_hdr_to_skb()","status":"unfixed","project":false,"upstream":[{"sha":"44378d02c5aaae24b60a75fbbb539b4aa4db503d","url":"https://git.kernel.org/stable/c/44378d02c5aaae24b60a75fbbb539b4aa4db503d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"44378d02c5aaae24b60a75fbbb539b4aa4db503d","lines":139,"reason":"","source":"https://github.com/torvalds/linux/commit/44378d02c5aaae24b60a75fbbb539b4aa4db503d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98954","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98954.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98951","title":"riscv: ptrace: Zero-initialize regset buffers before copyin","status":"unfixed","project":false,"upstream":[{"sha":"59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97","url":"https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98951","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98951.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98947","title":"vsock: Fix memory leak in vmci_transport_recv_dgram_cb()","status":"backported","project":false,"upstream":[{"sha":"7c24a4e87e219072e5e106f6791146cbf3b056b3","url":"https://git.kernel.org/stable/c/7c24a4e87e219072e5e106f6791146cbf3b056b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4835dbcde5cc3ae37e0d0796052056b35fcae8bf","label":"4835dbcde5cc","date":"2026-10-15T11:58:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c24a4e87e219072e5e106f6791146cbf3b056b3","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7c24a4e87e219072e5e106f6791146cbf3b056b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98946","title":"drm/vc4: Disable the V3D interrupt across runtime suspend","status":"unfixed","project":false,"upstream":[{"sha":"6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f","url":"https://git.kernel.org/stable/c/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f","lines":67,"reason":"","source":"https://github.com/torvalds/linux/commit/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98946","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98946.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98938","title":"rust: irq: pass RegistrationInner as cookie to request_irq","status":"unfixed","project":false,"upstream":[{"sha":"9a7931e847f338a687e96cde9f37e0cff83ddd84","url":"https://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"9a7931e847f338a687e96cde9f37e0cff83ddd84","lines":185,"reason":"","source":"https://github.com/torvalds/linux/commit/9a7931e847f338a687e96cde9f37e0cff83ddd84.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98937","title":"perf/core: Check kernel access when kernel callchains are requested","status":"backported","project":false,"upstream":[{"sha":"a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f","url":"https://git.kernel.org/stable/c/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2581b43e162cfc43e6f5d8dd8d2b38f3441550de","label":"2581b43e162c","date":"2026-10-11T15:26:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98937","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98937.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98932","title":"EDAC/altera: Fix use-after-free in error paths","status":"backported","project":false,"upstream":[{"sha":"eef3b67f9c6782127163b631c9043011a68016e2","url":"https://git.kernel.org/stable/c/eef3b67f9c6782127163b631c9043011a68016e2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/865f3bdebbc9b34012358c377c9b15154f95f33b","label":"865f3bdebbc9","date":"2026-10-11T15:25:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"eef3b67f9c6782127163b631c9043011a68016e2","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/eef3b67f9c6782127163b631c9043011a68016e2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98930","title":"KVM: s390: Fix IRQ injection with SIGP Stop and Store Status","status":"backported","project":false,"upstream":[{"sha":"d343407b728a80b74be3c24b59f15e60289ea527","url":"https://git.kernel.org/stable/c/d343407b728a80b74be3c24b59f15e60289ea527"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a379ac504fcb8c6fc2aa36203f5489b9581eb2e0","label":"a379ac504fcb","date":"2026-10-03T12:38:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d343407b728a80b74be3c24b59f15e60289ea527","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/d343407b728a80b74be3c24b59f15e60289ea527.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98930","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98930.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98929","title":"macsec: initialize SecY before registering the netdevice","status":"backported","project":false,"upstream":[{"sha":"c2de369c5c5b8599ca10fd5ca8d11fcd845c1331","url":"https://git.kernel.org/stable/c/c2de369c5c5b8599ca10fd5ca8d11fcd845c1331"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2b42adf3b8ee9a0e1d2629aca3c5a02a1c438066","label":"2b42adf3b8ee","date":"2026-10-03T12:38:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c2de369c5c5b8599ca10fd5ca8d11fcd845c1331","lines":141,"reason":"","source":"https://github.com/torvalds/linux/commit/c2de369c5c5b8599ca10fd5ca8d11fcd845c1331.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98926","title":"drm/amd/display: Remove sink usage from DPMS","status":"unfixed","project":false,"upstream":[{"sha":"8fa813b7fd1eccbed13e126166cf764f1f11a7d3","url":"https://git.kernel.org/stable/c/8fa813b7fd1eccbed13e126166cf764f1f11a7d3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8fa813b7fd1eccbed13e126166cf764f1f11a7d3","lines":384,"reason":"","source":"https://github.com/torvalds/linux/commit/8fa813b7fd1eccbed13e126166cf764f1f11a7d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98926","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98926.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98924","title":"fs: avoid repeated scans in evict_inodes()","status":"backported","project":false,"upstream":[{"sha":"7459c021874246c196f397686e100702f059b9e7","url":"https://git.kernel.org/stable/c/7459c021874246c196f397686e100702f059b9e7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e4f3e476cd4066a815ef68cd6caa1828b9c167d5","label":"e4f3e476cd40","date":"2026-10-03T12:38:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7459c021874246c196f397686e100702f059b9e7","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/7459c021874246c196f397686e100702f059b9e7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98924","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98924.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98920","title":"netfs: Fix missing alloc tagging of direct mempool allocations","status":"backported","project":false,"upstream":[{"sha":"b78b728e21c32ec4c330b299f657fb1eb02dffc2","url":"https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5c03da745171485fd181f17b69213464f6d05f3d","label":"5c03da745171","date":"2026-10-15T11:58:19+02:00","lore":["https://lore.kernel.org/all/0b004319-9ef7-437c-a4dd-174d6a9a83db@mailbox.org/"]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b78b728e21c32ec4c330b299f657fb1eb02dffc2","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/b78b728e21c32ec4c330b299f657fb1eb02dffc2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98917","title":"parisc: Increase kernel stack size to 32kb","status":"backported","project":false,"upstream":[{"sha":"94b7e3a7e871ae27d4935c76959dfc61829f27f9","url":"https://git.kernel.org/stable/c/94b7e3a7e871ae27d4935c76959dfc61829f27f9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5023c70853ad9829c53d8e9def5ee969b4e1b931","label":"5023c70853ad","date":"2026-10-03T12:38:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"94b7e3a7e871ae27d4935c76959dfc61829f27f9","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/94b7e3a7e871ae27d4935c76959dfc61829f27f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98917","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98917.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98916","title":"wifi: nl80211: check link is beaconing for color change","status":"backported","project":false,"upstream":[{"sha":"55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4","url":"https://git.kernel.org/stable/c/55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e50965c702cfd41eb83464565f6272d4d4bfc00c","label":"e50965c702cf","date":"2026-09-21T15:04:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98916","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98916.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98914","title":"drm/amdgpu: cap ATOM command table nesting depth","status":"backported","project":false,"upstream":[{"sha":"27ef1795bc4e47cae838e0a3ced531c549f9b23d","url":"https://git.kernel.org/stable/c/27ef1795bc4e47cae838e0a3ced531c549f9b23d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b1d2b29d3115b36efba0976cb5ca3d794c58eead","label":"b1d2b29d3115","date":"2026-09-21T15:04:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"27ef1795bc4e47cae838e0a3ced531c549f9b23d","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/27ef1795bc4e47cae838e0a3ced531c549f9b23d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98906","title":"net: lan966x: restore RX state on reload failure","status":"backported","project":false,"upstream":[{"sha":"aa97f11a76e545ed73cc455bcdd1ece4b480b507","url":"https://git.kernel.org/stable/c/aa97f11a76e545ed73cc455bcdd1ece4b480b507"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b5a6462f4646687c922931133a2478da94addc87","label":"b5a6462f4646","date":"2026-09-21T15:04:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa97f11a76e545ed73cc455bcdd1ece4b480b507","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/aa97f11a76e545ed73cc455bcdd1ece4b480b507.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98904","title":"mailbox: imx: Use devm_pm_runtime_enable()","status":"backported","project":false,"upstream":[{"sha":"1f602619e408b6e9655ee76656a2a5ab6e89c5e4","url":"https://git.kernel.org/stable/c/1f602619e408b6e9655ee76656a2a5ab6e89c5e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/adcaa21d50c3a4c884f4d0b7a95fa3bd7a07cf84","label":"adcaa21d50c3","date":"2026-09-21T15:04:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1f602619e408b6e9655ee76656a2a5ab6e89c5e4","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/1f602619e408b6e9655ee76656a2a5ab6e89c5e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98904","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98904.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98903","title":"mailbox: imx: Add a channel shutdown field","status":"backported","project":false,"upstream":[{"sha":"5ccea7eacb7786c358833634f45700365f6c1d99","url":"https://git.kernel.org/stable/c/5ccea7eacb7786c358833634f45700365f6c1d99"}],"evidence":[{"url":"https://git.kernel.org/stable/c/944d8509c2220a2313d4a094a646507929fb6f8d","label":"944d8509c222","date":"2026-09-21T15:04:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5ccea7eacb7786c358833634f45700365f6c1d99","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/5ccea7eacb7786c358833634f45700365f6c1d99.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98903","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98903.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98901","title":"ksmbd: fix lease break and ack state handling","status":"backported","project":false,"upstream":[{"sha":"5015191096db311759fef98769270336cd8b1324","url":"https://git.kernel.org/stable/c/5015191096db311759fef98769270336cd8b1324"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fba4653a0b4dc2f6d42600abe21fb326292f70ff","label":"fba4653a0b4d","date":"2026-09-21T15:04:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"5015191096db311759fef98769270336cd8b1324","lines":184,"reason":"","source":"https://github.com/torvalds/linux/commit/5015191096db311759fef98769270336cd8b1324.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98897","title":"ksmbd: don't hold ci->m_lock while waiting for a lease break ack","status":"backported","project":false,"upstream":[{"sha":"27a9bc968d4ae809a3f5ca2f2b136856ee613cb4","url":"https://git.kernel.org/stable/c/27a9bc968d4ae809a3f5ca2f2b136856ee613cb4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/868c9038ffd4af39766d087f68c8f543a3f66635","label":"868c9038ffd4","date":"2026-09-21T15:05:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"27a9bc968d4ae809a3f5ca2f2b136856ee613cb4","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/27a9bc968d4ae809a3f5ca2f2b136856ee613cb4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98897","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98897.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98880","title":"ntfs3: handle set_blocksize failures","status":"backported","project":false,"upstream":[{"sha":"24f7d1824b7581ae3daf9d443c5dfeabd89df6d8","url":"https://git.kernel.org/stable/c/24f7d1824b7581ae3daf9d443c5dfeabd89df6d8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/78e10082f3e919b8863958feac5f269d3ade9469","label":"78e10082f3e9","date":"2026-09-21T15:04:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"24f7d1824b7581ae3daf9d443c5dfeabd89df6d8","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/24f7d1824b7581ae3daf9d443c5dfeabd89df6d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98880","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98880.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98875","title":"drm/nouveau/gsp: add SEC2 to GA100 chip table","status":"backported","project":false,"upstream":[{"sha":"604d0efb17cc0dd197e089134736ac2698d5fca7","url":"https://git.kernel.org/stable/c/604d0efb17cc0dd197e089134736ac2698d5fca7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f29267ace04283e76f92a74d9a7f4fcfcb32f484","label":"f29267ace042","date":"2026-09-21T15:04:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"604d0efb17cc0dd197e089134736ac2698d5fca7","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/604d0efb17cc0dd197e089134736ac2698d5fca7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98875","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98875.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98869","title":"bpf: Infer zext_dst based on static register liveness analysis","status":"unfixed","project":false,"upstream":[{"sha":"7ce090afbf725e25fff29caacce1eaf8459b1117","url":"https://git.kernel.org/stable/c/7ce090afbf725e25fff29caacce1eaf8459b1117"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"7ce090afbf725e25fff29caacce1eaf8459b1117","lines":429,"reason":"","source":"https://github.com/torvalds/linux/commit/7ce090afbf725e25fff29caacce1eaf8459b1117.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98869","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98869.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98863","title":"KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails","status":"backported","project":false,"upstream":[{"sha":"10180a277549339020b08000206092c07e0bff5a","url":"https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/525694a6021ec6c8f7ce1f38acdf2dd77698fec1","label":"525694a6021e","date":"2026-10-11T15:26:12+02:00","lore":["https://lore.kernel.org/all/20260813043932.3214460-1-rkskek9254@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"10180a277549339020b08000206092c07e0bff5a","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/10180a277549339020b08000206092c07e0bff5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98863","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98863.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98859","title":"HID: multitouch: stop the release timer from being rearmed on remove","status":"backported","project":false,"upstream":[{"sha":"5acb2dace582f061aab5e14c399ac9480315f44b","url":"https://git.kernel.org/stable/c/5acb2dace582f061aab5e14c399ac9480315f44b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0c19a6c1d25fd5ed66d1f80dc6f6e56cc1f0a787","label":"0c19a6c1d25f","date":"2026-10-11T15:25:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5acb2dace582f061aab5e14c399ac9480315f44b","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/5acb2dace582f061aab5e14c399ac9480315f44b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98859","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98859.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98853","title":"net: gso: limit recursive IP-in-IP segmentation","status":"queued","project":false,"upstream":[{"sha":"006c8b834aed8b02bd8fb9fb05e9e7ead37d1763","url":"https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763"}],"evidence":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.18/net-gso-limit-recursive-ip-in-ip-segmentation.patch?id=7f27b6ac0da11e40e4e828813263489e51221ab0","label":"queue patch","date":null,"lore":["https://lore.kernel.org/all/cover.1790157745.git.zihanx@nebusec.ai/"]}],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"006c8b834aed8b02bd8fb9fb05e9e7ead37d1763","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98853","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98853.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98852","title":"net: extend IPv6 exthdr detection of tunneled packets","status":"backported","project":false,"upstream":[{"sha":"5f0764cb1c81a9712bce605d38efe6d844a70b29","url":"https://git.kernel.org/stable/c/5f0764cb1c81a9712bce605d38efe6d844a70b29"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aa480f05aed7a9eee87d4a6fc90647fe9679c670","label":"aa480f05aed7","date":"2026-10-11T15:26:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"5f0764cb1c81a9712bce605d38efe6d844a70b29","lines":67,"reason":"","source":"https://github.com/torvalds/linux/commit/5f0764cb1c81a9712bce605d38efe6d844a70b29.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98852","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98852.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98843","title":"netfs: zero gaps in read-gaps folio to avoid writing back stale data","status":"backported","project":false,"upstream":[{"sha":"8db55c5cd831a786a1a2a2d391aa80354535a353","url":"https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353"}],"evidence":[{"url":"https://git.kernel.org/stable/c/512eaf01ffabf4258e945016b50df5aed940b705","label":"512eaf01ffab","date":"2026-10-11T15:25:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8db55c5cd831a786a1a2a2d391aa80354535a353","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/8db55c5cd831a786a1a2a2d391aa80354535a353.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98843","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98843.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98839","title":"vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()","status":"backported","project":false,"upstream":[{"sha":"39495ef5d6f8019e62d65807f217a7ca8232727a","url":"https://git.kernel.org/stable/c/39495ef5d6f8019e62d65807f217a7ca8232727a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/037d7e3ca5c593092f4b0d471eb869a85cbddde0","label":"037d7e3ca5c5","date":"2026-10-11T15:25:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"39495ef5d6f8019e62d65807f217a7ca8232727a","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/39495ef5d6f8019e62d65807f217a7ca8232727a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98839","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98839.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98834","title":"mtd: core: avoid double-free of OTP NVMEM device","status":"unfixed","project":false,"upstream":[{"sha":"26300879cd8e4612dce66bb8f6ff7cd35fcf3e59","url":"https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"26300879cd8e4612dce66bb8f6ff7cd35fcf3e59","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98829","title":"wifi: mac80211: drop oversized fragments to avoid extra_len overflow","status":"backported","project":false,"upstream":[{"sha":"5e4f3509793b4db2c0835340224743db680e861f","url":"https://git.kernel.org/stable/c/5e4f3509793b4db2c0835340224743db680e861f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9338b2dea74cb0fc80a4c958b68e687610ba2261","label":"9338b2dea74c","date":"2026-10-11T15:25:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5e4f3509793b4db2c0835340224743db680e861f","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/5e4f3509793b4db2c0835340224743db680e861f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98829","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98829.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98828","title":"wifi: ath9k: reject short WMI command responses","status":"backported","project":false,"upstream":[{"sha":"93ce8ea70451e800601bc9444aa33043de15d67b","url":"https://git.kernel.org/stable/c/93ce8ea70451e800601bc9444aa33043de15d67b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e0c21130c1c7791ba73b19a3a9ea767c8cd43745","label":"e0c21130c1c7","date":"2026-10-11T15:25:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"93ce8ea70451e800601bc9444aa33043de15d67b","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/93ce8ea70451e800601bc9444aa33043de15d67b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98828","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98828.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98827","title":"wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE","status":"backported","project":false,"upstream":[{"sha":"aeaca27c1db3106967ffbb2b517d98c835f6d500","url":"https://git.kernel.org/stable/c/aeaca27c1db3106967ffbb2b517d98c835f6d500"}],"evidence":[{"url":"https://git.kernel.org/stable/c/345ce265cf604e84b5b560c21beaf4c6f269ab14","label":"345ce265cf60","date":"2026-10-11T15:25:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aeaca27c1db3106967ffbb2b517d98c835f6d500","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/aeaca27c1db3106967ffbb2b517d98c835f6d500.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98827","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98827.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98826","title":"rtc: ac100: Fix clock provider use-after-free on probe failure","status":"backported","project":false,"upstream":[{"sha":"fcf0b58e976e83adf246b014518e49c662b96f5e","url":"https://git.kernel.org/stable/c/fcf0b58e976e83adf246b014518e49c662b96f5e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9cff19ddd7f90c1f572a0f83cfc41de8f8dcbcd8","label":"9cff19ddd7f9","date":"2026-10-11T15:25:47+02:00","lore":["https://lore.kernel.org/linux-rtc/20260905184936.155E11F00A3A@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fcf0b58e976e83adf246b014518e49c662b96f5e","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/fcf0b58e976e83adf246b014518e49c662b96f5e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98824","title":"wifi: mac80211: validate TX status rate metadata","status":"unfixed","project":false,"upstream":[{"sha":"6bdcdb31318c10e6369cff8e5b32c37397e98091","url":"https://git.kernel.org/stable/c/6bdcdb31318c10e6369cff8e5b32c37397e98091"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"6bdcdb31318c10e6369cff8e5b32c37397e98091","lines":165,"reason":"","source":"https://github.com/torvalds/linux/commit/6bdcdb31318c10e6369cff8e5b32c37397e98091.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98824","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98824.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98822","title":"wifi: mac80211: prevent AP VLAN tx from other interfaces","status":"backported","project":false,"upstream":[{"sha":"7f93ca31f7fd9b42e7d692f59514436d448ac908","url":"https://git.kernel.org/stable/c/7f93ca31f7fd9b42e7d692f59514436d448ac908"}],"evidence":[{"url":"https://git.kernel.org/stable/c/88e96d902efeefbffc34450969f40dc61a0c8a42","label":"88e96d902efe","date":"2026-10-11T15:25:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f93ca31f7fd9b42e7d692f59514436d448ac908","lines":80,"reason":"","source":"https://github.com/torvalds/linux/commit/7f93ca31f7fd9b42e7d692f59514436d448ac908.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98822","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98822.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98820","title":"blk-mq: set RQF_USE_SCHED when the operation is known","status":"backported","project":false,"upstream":[{"sha":"ab6c756f28c741d704a7c3e04814bfc3adf6f818","url":"https://git.kernel.org/stable/c/ab6c756f28c741d704a7c3e04814bfc3adf6f818"}],"evidence":[{"url":"https://git.kernel.org/stable/c/790730e4d95de8356a573d4b4864486bba731863","label":"790730e4d95d","date":"2026-10-11T15:25:47+02:00","lore":["https://lore.kernel.org/linux-block/20260916151655.2588-1-15815827059@163.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ab6c756f28c741d704a7c3e04814bfc3adf6f818","lines":134,"reason":"","source":"https://github.com/torvalds/linux/commit/ab6c756f28c741d704a7c3e04814bfc3adf6f818.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98820","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98820.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98818","title":"mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()","status":"unfixed","project":false,"upstream":[{"sha":"af2fb3ee6679b517e2fdbd3ba16ec276a8b74312","url":"https://git.kernel.org/stable/c/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"af2fb3ee6679b517e2fdbd3ba16ec276a8b74312","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98818","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98818.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98816","title":"bpf: Fix overflow of jump offset in constant blinding","status":"unfixed","project":false,"upstream":[{"sha":"ad139384ecddb6f3e7e3c3c12765aafae0e39670","url":"https://git.kernel.org/stable/c/ad139384ecddb6f3e7e3c3c12765aafae0e39670"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad139384ecddb6f3e7e3c3c12765aafae0e39670","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/ad139384ecddb6f3e7e3c3c12765aafae0e39670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98816","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98816.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98815","title":"nvme: fix cdev lifetime","status":"unfixed","project":false,"upstream":[{"sha":"9952f3882ecba709092379b71e02b09762b26f96","url":"https://git.kernel.org/stable/c/9952f3882ecba709092379b71e02b09762b26f96"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9952f3882ecba709092379b71e02b09762b26f96","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/9952f3882ecba709092379b71e02b09762b26f96.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98815","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98815.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98814","title":"nvme: fix command effects log lifetime for multipath heads","status":"unfixed","project":false,"upstream":[{"sha":"72ece656abd4de8645a421fb482d7a11e6533a45","url":"https://git.kernel.org/stable/c/72ece656abd4de8645a421fb482d7a11e6533a45"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"72ece656abd4de8645a421fb482d7a11e6533a45","lines":126,"reason":"","source":"https://github.com/torvalds/linux/commit/72ece656abd4de8645a421fb482d7a11e6533a45.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98814","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98814.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98813","title":"bpf: Hold map BTF for the memory allocator destructor record","status":"unfixed","project":false,"upstream":[{"sha":"ab39974240a0cff765f3bb9cce81d8001ffdb144","url":"https://git.kernel.org/stable/c/ab39974240a0cff765f3bb9cce81d8001ffdb144"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ab39974240a0cff765f3bb9cce81d8001ffdb144","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/ab39974240a0cff765f3bb9cce81d8001ffdb144.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98813","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98813.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98810","title":"wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()","status":"unfixed","project":false,"upstream":[{"sha":"6f63e919fe1e335b8abcb3a28bfd4804a98d875a","url":"https://git.kernel.org/stable/c/6f63e919fe1e335b8abcb3a28bfd4804a98d875a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f63e919fe1e335b8abcb3a28bfd4804a98d875a","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/6f63e919fe1e335b8abcb3a28bfd4804a98d875a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98810","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98810.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98808","title":"net: systemport: Fix buffer overflow in bcm_sysport_get_stats()","status":"backported","project":false,"upstream":[{"sha":"eb7b84af0ec5c71b4920e999611b466b3784496c","url":"https://git.kernel.org/stable/c/eb7b84af0ec5c71b4920e999611b466b3784496c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/96d8b26be5bc451188acdcee055948da45adbde0","label":"96d8b26be5bc","date":"2026-10-11T15:25:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb7b84af0ec5c71b4920e999611b466b3784496c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/eb7b84af0ec5c71b4920e999611b466b3784496c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98807","title":"net/mlx5: Fix slab-out-of-bounds when handling team device events","status":"backported","project":false,"upstream":[{"sha":"04c824940d52871c49866a4ac67b504146f7cf35","url":"https://git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3a6e67ff267af2053a793825c3b7844741fed461","label":"3a6e67ff267a","date":"2026-10-11T15:25:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"04c824940d52871c49866a4ac67b504146f7cf35","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/04c824940d52871c49866a4ac67b504146f7cf35.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98807.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98806","title":"octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled","status":"unfixed","project":false,"upstream":[{"sha":"056994563935e049093f100efaad7e63ad113814","url":"https://git.kernel.org/stable/c/056994563935e049093f100efaad7e63ad113814"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"056994563935e049093f100efaad7e63ad113814","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/056994563935e049093f100efaad7e63ad113814.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98803","title":"net: stmmac: fix rx Scatter-Gather support","status":"backported","project":false,"upstream":[{"sha":"88095728511e0df9c89528944f5a1762ad298983","url":"https://git.kernel.org/stable/c/88095728511e0df9c89528944f5a1762ad298983"}],"evidence":[{"url":"https://git.kernel.org/stable/c/358d5ac5a5d57ce21c3814c4e3e8f3fbcb7304b4","label":"358d5ac5a5d5","date":"2026-10-11T15:25:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"88095728511e0df9c89528944f5a1762ad298983","lines":180,"reason":"","source":"https://github.com/torvalds/linux/commit/88095728511e0df9c89528944f5a1762ad298983.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98803","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98803.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98802","title":"seg6: ensure packet data is writable before modifying SRH and IPv6 DA","status":"unfixed","project":false,"upstream":[{"sha":"8ae3f4067ba4ae3a15581392f6dac422e3d3def0","url":"https://git.kernel.org/stable/c/8ae3f4067ba4ae3a15581392f6dac422e3d3def0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8ae3f4067ba4ae3a15581392f6dac422e3d3def0","lines":292,"reason":"","source":"https://github.com/torvalds/linux/commit/8ae3f4067ba4ae3a15581392f6dac422e3d3def0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98802","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98802.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98801","title":"net: restrict SO_RESERVE_MEM to TCP sockets and cap max value","status":"backported","project":false,"upstream":[{"sha":"37e02c42a00be692c06343e11779aadc45f45971","url":"https://git.kernel.org/stable/c/37e02c42a00be692c06343e11779aadc45f45971"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5069ce898148bd799395c5a464e006cbb840f188","label":"5069ce898148","date":"2026-10-11T15:25:49+02:00","lore":["https://lore.kernel.org/netdev/5a88421d-10ef-4fca-9acb-85a27a3c1173@huawei.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"37e02c42a00be692c06343e11779aadc45f45971","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/37e02c42a00be692c06343e11779aadc45f45971.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98801","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98801.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98800","title":"bpf: Wait for an RCU tasks grace period before freeing trampoline progs","status":"unfixed","project":false,"upstream":[{"sha":"0fb5751a6e411b1b466c06e50021818d9391df98","url":"https://git.kernel.org/stable/c/0fb5751a6e411b1b466c06e50021818d9391df98"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fb5751a6e411b1b466c06e50021818d9391df98","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/0fb5751a6e411b1b466c06e50021818d9391df98.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98800","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98800.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98799","title":"bpf: Skip detached progs in trampoline images that are still in use","status":"unfixed","project":false,"upstream":[{"sha":"17637e1a581a22466ac3620a91e099683ff9cc6f","url":"https://git.kernel.org/stable/c/17637e1a581a22466ac3620a91e099683ff9cc6f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"17637e1a581a22466ac3620a91e099683ff9cc6f","lines":955,"reason":"","source":"https://github.com/torvalds/linux/commit/17637e1a581a22466ac3620a91e099683ff9cc6f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98797","title":"net: cap skb->queue_mapping when the tx queue is picked","status":"backported","project":false,"upstream":[{"sha":"ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d","url":"https://git.kernel.org/stable/c/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2f581814e4e3ea6a5e98f49813dc4c68444a0c4a","label":"2f581814e4e3","date":"2026-10-11T15:25:49+02:00","lore":["https://lore.kernel.org/netdev/179008581937.2160803.7117814290574262942@kernel.org/","https://lore.kernel.org/netdev/179033713973.2160803.4914570693994398206@kernel.org/","https://lore.kernel.org/netdev/20260925180407.63647514@kernel.org/","https://lore.kernel.org/netdev/CANn89i+k-mZKDQVtvws_MEXeuMTAdaCcOXFZE-RfhcGTu90sjA@mail.gmail.com/","https://lore.kernel.org/netdev/CANn89iLwYx8nCVf0pCEk_MmEiyC6kQaMwCQT9WkQVeeNzNQHqQ@mail.gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98796","title":"net: ethernet: mtk_eth_soc: allocate dummy netdev sooner","status":"backported","project":false,"upstream":[{"sha":"6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b","url":"https://git.kernel.org/stable/c/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/82be3d08de9e14d5aed72377f051adb4f09fd540","label":"82be3d08de9e","date":"2026-10-11T15:25:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98796","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98796.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98795","title":"net: sparx5: skip ptp deinit if init was skipped","status":"backported","project":false,"upstream":[{"sha":"0d2c49915bc3aea4521cda5e4d42f24f63b94585","url":"https://git.kernel.org/stable/c/0d2c49915bc3aea4521cda5e4d42f24f63b94585"}],"evidence":[{"url":"https://git.kernel.org/stable/c/35c706d6eb1963735814c5f5bb2674a96eacf3cc","label":"35c706d6eb19","date":"2026-10-11T15:25:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0d2c49915bc3aea4521cda5e4d42f24f63b94585","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/0d2c49915bc3aea4521cda5e4d42f24f63b94585.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98795","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98795.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98792","title":"netfilter: flowtable: generalize pending status bit","status":"backported","project":false,"upstream":[{"sha":"7c549fb7eecd01fdba7c0d12c01da876ef8a3214","url":"https://git.kernel.org/stable/c/7c549fb7eecd01fdba7c0d12c01da876ef8a3214"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4033e1a9262c57dfbfc594a591a50fcba63c531a","label":"4033e1a9262c","date":"2026-10-11T15:25:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c549fb7eecd01fdba7c0d12c01da876ef8a3214","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/7c549fb7eecd01fdba7c0d12c01da876ef8a3214.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98792","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98792.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98789","title":"bpf: Fix objects stuck in free_by_rcu_ttrace","status":"unfixed","project":false,"upstream":[{"sha":"fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043","url":"https://git.kernel.org/stable/c/fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98789","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98789.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98788","title":"futex: Fix private hash use-after-free on resize","status":"unfixed","project":false,"upstream":[{"sha":"f35e3b5784221654f9cdbd6222275a7fa203f6c3","url":"https://git.kernel.org/stable/c/f35e3b5784221654f9cdbd6222275a7fa203f6c3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"f35e3b5784221654f9cdbd6222275a7fa203f6c3","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/f35e3b5784221654f9cdbd6222275a7fa203f6c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98788","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98788.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98786","title":"drm/amd/display: guard dc_sink dereferences in MST mode validation","status":"unfixed","project":false,"upstream":[{"sha":"217f64f348c90cba62164e7ff38e0ccf78a5ca09","url":"https://git.kernel.org/stable/c/217f64f348c90cba62164e7ff38e0ccf78a5ca09"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"217f64f348c90cba62164e7ff38e0ccf78a5ca09","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/217f64f348c90cba62164e7ff38e0ccf78a5ca09.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98786","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98786.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98758","title":"usb: typec: ucsi: glink: fix use-after-free of ucsi on remove","status":"backported","project":false,"upstream":[{"sha":"63b269ec537dc0fd26d0bd64872c26860d108c9d","url":"https://git.kernel.org/stable/c/63b269ec537dc0fd26d0bd64872c26860d108c9d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/41934f92e7a54d4080ac0b17aacc83224946785c","label":"41934f92e7a5","date":"2026-10-11T15:25:55+02:00","lore":["https://lore.kernel.org/r/20260227190430.889-1-nathan.c.rebello@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"63b269ec537dc0fd26d0bd64872c26860d108c9d","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/63b269ec537dc0fd26d0bd64872c26860d108c9d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98758","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98758.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98747","title":"serial: core: fix NULL pointer dereference in serial_core_unregister_port()","status":"unfixed","project":false,"upstream":[{"sha":"499485a67fbacf4d9afbdb43522388c64f853428","url":"https://git.kernel.org/stable/c/499485a67fbacf4d9afbdb43522388c64f853428"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"499485a67fbacf4d9afbdb43522388c64f853428","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/499485a67fbacf4d9afbdb43522388c64f853428.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98747","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98747.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98740","title":"EDAC/altera: Drop __init from ECC setup paths for re-probe safety","status":"backported","project":false,"upstream":[{"sha":"b62a264163ca51bee04785c581344751812395df","url":"https://git.kernel.org/stable/c/b62a264163ca51bee04785c581344751812395df"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9846b85c2eb8b749c3f14bdcc31b1070f6aabba8","label":"9846b85c2eb8","date":"2026-10-11T15:25:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b62a264163ca51bee04785c581344751812395df","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/b62a264163ca51bee04785c581344751812395df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98740","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98740.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98738","title":"Bluetooth: Serialize SMP remote OOB data access","status":"backported","project":false,"upstream":[{"sha":"81a2345f1984f0b36d3226571bc196316a01b648","url":"https://git.kernel.org/stable/c/81a2345f1984f0b36d3226571bc196316a01b648"}],"evidence":[{"url":"https://git.kernel.org/stable/c/889c61e3d0f1091a958e4b2a24b20bab23d915c4","label":"889c61e3d0f1","date":"2026-10-11T15:26:08+02:00","lore":["https://lore.kernel.org/r/00660cd3-7d71-13a4-f617-229e6defb701@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"81a2345f1984f0b36d3226571bc196316a01b648","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/81a2345f1984f0b36d3226571bc196316a01b648.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98738","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98738.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98737","title":"Bluetooth: hci_sync: Fix inquiry cache use-after-free","status":"backported","project":false,"upstream":[{"sha":"8ed67535fdff40ca652bcd4ac7da68d11d01bd34","url":"https://git.kernel.org/stable/c/8ed67535fdff40ca652bcd4ac7da68d11d01bd34"}],"evidence":[{"url":"https://git.kernel.org/stable/c/333257e6e4a7bcaaea82fd357121d0f1e6b76c7b","label":"333257e6e4a7","date":"2026-10-11T15:25:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ed67535fdff40ca652bcd4ac7da68d11d01bd34","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/8ed67535fdff40ca652bcd4ac7da68d11d01bd34.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98737","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98737.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98734","title":"Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown","status":"backported","project":false,"upstream":[{"sha":"848a7a91c7f03675d3bd8db6f7721cbf9cb50e21","url":"https://git.kernel.org/stable/c/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1681f97afdf92e8557f2f3118ddc898471b5d299","label":"1681f97afdf9","date":"2026-10-11T15:25:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"848a7a91c7f03675d3bd8db6f7721cbf9cb50e21","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98734","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98734.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98720","title":"KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified","status":"backported","project":false,"upstream":[{"sha":"2abb25273c82061dd4670690c81c319c03740bf6","url":"https://git.kernel.org/stable/c/2abb25273c82061dd4670690c81c319c03740bf6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f6189e26d0237e47e2f04f9cb1e43fd19a9b2f3a","label":"f6189e26d023","date":"2026-10-11T15:26:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2abb25273c82061dd4670690c81c319c03740bf6","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/2abb25273c82061dd4670690c81c319c03740bf6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98720","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98720.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98715","title":"KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN","status":"unfixed","project":false,"upstream":[{"sha":"60d93c27859fb3ec5b5a689e24de303f166477d0","url":"https://git.kernel.org/stable/c/60d93c27859fb3ec5b5a689e24de303f166477d0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"60d93c27859fb3ec5b5a689e24de303f166477d0","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/60d93c27859fb3ec5b5a689e24de303f166477d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98715","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98715.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98714","title":"KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded","status":"unfixed","project":false,"upstream":[{"sha":"e27fc915c8f575ab5630e27d97465c2077d4b9d1","url":"https://git.kernel.org/stable/c/e27fc915c8f575ab5630e27d97465c2077d4b9d1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e27fc915c8f575ab5630e27d97465c2077d4b9d1","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/e27fc915c8f575ab5630e27d97465c2077d4b9d1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98714","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98714.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98692","title":"thunderbolt: Make the DP tunnel activation callback mandatory","status":"unfixed","project":false,"upstream":[{"sha":"12f5d8b85a66a0ac08d082517d92ce136f8c0d42","url":"https://git.kernel.org/stable/c/12f5d8b85a66a0ac08d082517d92ce136f8c0d42"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"12f5d8b85a66a0ac08d082517d92ce136f8c0d42","lines":243,"reason":"","source":"https://github.com/torvalds/linux/commit/12f5d8b85a66a0ac08d082517d92ce136f8c0d42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98692","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98692.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98685","title":"smb: client: discard post-EOF pagecache when extending a file via clone range","status":"unfixed","project":false,"upstream":[{"sha":"4721587f96cb8de8164f3fd203093a0875560999","url":"https://git.kernel.org/stable/c/4721587f96cb8de8164f3fd203093a0875560999"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4721587f96cb8de8164f3fd203093a0875560999","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/4721587f96cb8de8164f3fd203093a0875560999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98685","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98685.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98684","title":"smb: client: flush and commit data before querying allocated ranges","status":"backported","project":false,"upstream":[{"sha":"aa994489bd835547c191827acc460192e147032d","url":"https://git.kernel.org/stable/c/aa994489bd835547c191827acc460192e147032d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f82242fe3109a3ef72f429540b5bdde08fbfb0e4","label":"f82242fe3109","date":"2026-10-11T15:26:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa994489bd835547c191827acc460192e147032d","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/aa994489bd835547c191827acc460192e147032d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98684","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98684.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98683","title":"smb: client: flush dirty data before zeroing a range","status":"backported","project":false,"upstream":[{"sha":"8f8d32c1044f70e46e87550e039a15ff20a4b21c","url":"https://git.kernel.org/stable/c/8f8d32c1044f70e46e87550e039a15ff20a4b21c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cecf4114069fc19629d284710fd783d56bbca862","label":"cecf4114069f","date":"2026-10-11T15:26:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f8d32c1044f70e46e87550e039a15ff20a4b21c","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/8f8d32c1044f70e46e87550e039a15ff20a4b21c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98683","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98683.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98682","title":"smb: client: drain and invalidate before server-side copy/clone","status":"unfixed","project":false,"upstream":[{"sha":"c9b1194e8ec99d95db25db45edd2fbf690f043ab","url":"https://git.kernel.org/stable/c/c9b1194e8ec99d95db25db45edd2fbf690f043ab"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c9b1194e8ec99d95db25db45edd2fbf690f043ab","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/c9b1194e8ec99d95db25db45edd2fbf690f043ab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98682","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98682.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98674","title":"iio: adc: adi-axi-adc: Initialize state mutex","status":"backported","project":false,"upstream":[{"sha":"549b71ce050637dd32678371ad76c445a2f8c9aa","url":"https://git.kernel.org/stable/c/549b71ce050637dd32678371ad76c445a2f8c9aa"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b473ee29aa0d39e7a7568b9675b15db2b0ae6057","label":"b473ee29aa0d","date":"2026-10-11T15:26:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"549b71ce050637dd32678371ad76c445a2f8c9aa","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/549b71ce050637dd32678371ad76c445a2f8c9aa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98674","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98674.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98665","title":"iio: health: max30102: fix NULL dereference in interrupt handler","status":"backported","project":false,"upstream":[{"sha":"f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d","url":"https://git.kernel.org/stable/c/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/60699102827fdb51f9591414165359c8e867f302","label":"60699102827f","date":"2026-10-11T15:26:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98665","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98665.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98661","title":"iio: light: rohm-bu27034: Fix infinite delay on error","status":"backported","project":false,"upstream":[{"sha":"8065a6c02f629187131f3136bedb26f9080e3cca","url":"https://git.kernel.org/stable/c/8065a6c02f629187131f3136bedb26f9080e3cca"}],"evidence":[{"url":"https://git.kernel.org/stable/c/10a958e76c737c19576e1097c49f210eb99b94bf","label":"10a958e76c73","date":"2026-10-11T15:26:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8065a6c02f629187131f3136bedb26f9080e3cca","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/8065a6c02f629187131f3136bedb26f9080e3cca.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98652","title":"KVM: s390: Add missing srcu in kvm_s390_set_irq_state()","status":"unknown","project":false,"upstream":[{"sha":"f3a557067d57ce6ae98d485c8009b223e16f5f36","url":"https://git.kernel.org/stable/c/f3a557067d57ce6ae98d485c8009b223e16f5f36"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"f3a557067d57ce6ae98d485c8009b223e16f5f36","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/f3a557067d57ce6ae98d485c8009b223e16f5f36.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98652","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98652.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98642","title":"bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk","status":"backported","project":false,"upstream":[{"sha":"1c21452d02eec2f008e2c5535820f85adbd7587a","url":"https://git.kernel.org/stable/c/1c21452d02eec2f008e2c5535820f85adbd7587a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1d6581b544a88cf4348c2fb60dcb50ad63f012da","label":"1d6581b544a8","date":"2026-10-03T12:38:35+02:00","lore":["https://lore.kernel.org/r/20260905021139.4116529-1-pulehui@huaweicloud.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c21452d02eec2f008e2c5535820f85adbd7587a","lines":94,"reason":"","source":"https://github.com/torvalds/linux/commit/1c21452d02eec2f008e2c5535820f85adbd7587a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98642","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98642.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98634","title":"scsi: sd_zbc: Reject disks with too many zones","status":"backported","project":false,"upstream":[{"sha":"b6ec0f79745967c751c85df373062c8d15e45fc4","url":"https://git.kernel.org/stable/c/b6ec0f79745967c751c85df373062c8d15e45fc4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0af16d8be3ec7ff28bb56a0da79c9aed66ac2c3b","label":"0af16d8be3ec","date":"2026-10-03T12:38:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b6ec0f79745967c751c85df373062c8d15e45fc4","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/b6ec0f79745967c751c85df373062c8d15e45fc4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98628","title":"bpf: Make post-verification instruction rewrites killable","status":"unfixed","project":false,"upstream":[{"sha":"261b61d3735b042ae25634f795c4540be0fc140c","url":"https://git.kernel.org/stable/c/261b61d3735b042ae25634f795c4540be0fc140c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"261b61d3735b042ae25634f795c4540be0fc140c","lines":113,"reason":"","source":"https://github.com/torvalds/linux/commit/261b61d3735b042ae25634f795c4540be0fc140c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98628","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98628.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98620","title":"net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure","status":"backported","project":false,"upstream":[{"sha":"310d1ac61a4d5a2ca8356a3a48d263acf54503ce","url":"https://git.kernel.org/stable/c/310d1ac61a4d5a2ca8356a3a48d263acf54503ce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7254b702e556158e34b4d7c168b5d8e7da5978af","label":"7254b702e556","date":"2026-10-03T12:38:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"310d1ac61a4d5a2ca8356a3a48d263acf54503ce","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/310d1ac61a4d5a2ca8356a3a48d263acf54503ce.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98620","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98620.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98617","title":"eth: fbnic: use the Rx queue napi pointer to find the napi vector","status":"unfixed","project":false,"upstream":[{"sha":"b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e","url":"https://git.kernel.org/stable/c/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98617","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98617.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98616","title":"eth: fbnic: reset num_napi when the napi vectors are freed","status":"backported","project":false,"upstream":[{"sha":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","url":"https://git.kernel.org/stable/c/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c5b5aee41b9f5ed0743344be1c7b544555fa3cb9","label":"c5b5aee41b9f","date":"2026-10-03T12:38:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98616","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98616.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98599","title":"bpf: Reject non-negative offsets in stack_slot_obj_get_spi()","status":"unfixed","project":false,"upstream":[{"sha":"79a9172f3ab4ad8392c5e5c8944b9b7710ade620","url":"https://git.kernel.org/stable/c/79a9172f3ab4ad8392c5e5c8944b9b7710ade620"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"79a9172f3ab4ad8392c5e5c8944b9b7710ade620","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/79a9172f3ab4ad8392c5e5c8944b9b7710ade620.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98599","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98599.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98598","title":"ipv6: Prevent rt6_insert_exception() for dying fib6_info.","status":"backported","project":false,"upstream":[{"sha":"0346ec2f080b40d95ed05b853bb9226289e75212","url":"https://git.kernel.org/stable/c/0346ec2f080b40d95ed05b853bb9226289e75212"}],"evidence":[{"url":"https://git.kernel.org/stable/c/649ffc76ed5483b2caf35ed90d3787538efc4e53","label":"649ffc76ed54","date":"2026-10-03T12:38:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0346ec2f080b40d95ed05b853bb9226289e75212","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/0346ec2f080b40d95ed05b853bb9226289e75212.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98598","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98598.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98589","title":"bpf: Reject pkt arguments in mutating subprogs","status":"unfixed","project":false,"upstream":[{"sha":"a6c1edfbe240e4377038a0e1d233ad81fde9a21b","url":"https://git.kernel.org/stable/c/a6c1edfbe240e4377038a0e1d233ad81fde9a21b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6c1edfbe240e4377038a0e1d233ad81fde9a21b","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/a6c1edfbe240e4377038a0e1d233ad81fde9a21b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98589","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98589.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98570","title":"net: ipv6: keep room for the mac header in dst_dev_overhead()","status":"unfixed","project":false,"upstream":[{"sha":"87cd6b717e4069dca34e0866e57eaeb44d3b173e","url":"https://git.kernel.org/stable/c/87cd6b717e4069dca34e0866e57eaeb44d3b173e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"87cd6b717e4069dca34e0866e57eaeb44d3b173e","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/87cd6b717e4069dca34e0866e57eaeb44d3b173e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98570","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98570.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98565","title":"net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621","status":"backported","project":false,"upstream":[{"sha":"c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4","url":"https://git.kernel.org/stable/c/c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/62c0e38b2e5034184d4502ce77bd178b29e59b83","label":"62c0e38b2e50","date":"2026-10-03T12:38:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98565","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98565.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98562","title":"net: libwx: fix races in Tx timestamp handling","status":"unfixed","project":false,"upstream":[{"sha":"3173cba1170131816972ed2b6185cb970ba8b747","url":"https://git.kernel.org/stable/c/3173cba1170131816972ed2b6185cb970ba8b747"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3173cba1170131816972ed2b6185cb970ba8b747","lines":295,"reason":"","source":"https://github.com/torvalds/linux/commit/3173cba1170131816972ed2b6185cb970ba8b747.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98562","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98562.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98558","title":"net: flush skb_defer_nodes in dev_cpu_dead()","status":"unfixed","project":false,"upstream":[{"sha":"06e3f54e8b22040ada01a28343badf1990b4dd7d","url":"https://git.kernel.org/stable/c/06e3f54e8b22040ada01a28343badf1990b4dd7d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"06e3f54e8b22040ada01a28343badf1990b4dd7d","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/06e3f54e8b22040ada01a28343badf1990b4dd7d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98558","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98558.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98556","title":"gve: DQO: reject TSO packets with an out of range MSS","status":"backported","project":false,"upstream":[{"sha":"296c83b5ccc808c080865eb20fd7a477b0355bb7","url":"https://git.kernel.org/stable/c/296c83b5ccc808c080865eb20fd7a477b0355bb7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2dc3ae3942e151fef254b7bbb65c832192ad2069","label":"2dc3ae3942e1","date":"2026-10-03T12:38:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"296c83b5ccc808c080865eb20fd7a477b0355bb7","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/296c83b5ccc808c080865eb20fd7a477b0355bb7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98556","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98556.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98551","title":"perf/core: Fill branch entries with a single assignment","status":"unfixed","project":false,"upstream":[{"sha":"24b620729e53d978b3e425f55bc66efd3bab1f59","url":"https://git.kernel.org/stable/c/24b620729e53d978b3e425f55bc66efd3bab1f59"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"24b620729e53d978b3e425f55bc66efd3bab1f59","lines":163,"reason":"","source":"https://github.com/torvalds/linux/commit/24b620729e53d978b3e425f55bc66efd3bab1f59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98551","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98551.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98539","title":"fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga","status":"backported","project":false,"upstream":[{"sha":"1abd643f3783ea8f8e273c18697ff0413aa92dc7","url":"https://git.kernel.org/stable/c/1abd643f3783ea8f8e273c18697ff0413aa92dc7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/37ec7353f4ac495b28284b0fcb0e53d21d1b3f3f","label":"37ec7353f4ac","date":"2026-10-03T12:38:50+02:00","lore":["https://lore.kernel.org/6a9beced.a5e650b3.26d8a.000b.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1abd643f3783ea8f8e273c18697ff0413aa92dc7","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/1abd643f3783ea8f8e273c18697ff0413aa92dc7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98539","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98539.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98525","title":"mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()","status":"backported","project":false,"upstream":[{"sha":"26cc0e69cce062cd3aa6fae33074684669c35a71","url":"https://git.kernel.org/stable/c/26cc0e69cce062cd3aa6fae33074684669c35a71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e35cb500dd14882f8dee61783fccd1823fd3ab0d","label":"e35cb500dd14","date":"2026-10-03T12:38:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"26cc0e69cce062cd3aa6fae33074684669c35a71","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/26cc0e69cce062cd3aa6fae33074684669c35a71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98525","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98525.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98509","title":"drm/virtio: fix memory leak of fence event on execbuffer failure","status":"backported","project":false,"upstream":[{"sha":"b74aad23d99b279bb34d135795f39a6d8ecdc075","url":"https://git.kernel.org/stable/c/b74aad23d99b279bb34d135795f39a6d8ecdc075"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8fa78900fd24247277c03dc7b8a2864cb12d4340","label":"8fa78900fd24","date":"2026-10-03T12:38:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b74aad23d99b279bb34d135795f39a6d8ecdc075","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/b74aad23d99b279bb34d135795f39a6d8ecdc075.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98509","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98509.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98508","title":"drm/virtio: fix NULL pointer dereference on fence allocation failure","status":"backported","project":false,"upstream":[{"sha":"846b3c64fe3e77d9db20a7e3e62dbbb637c773e1","url":"https://git.kernel.org/stable/c/846b3c64fe3e77d9db20a7e3e62dbbb637c773e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f2f1683955b95c9b958069da3050f7e8e129ff88","label":"f2f1683955b9","date":"2026-10-03T12:38:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"846b3c64fe3e77d9db20a7e3e62dbbb637c773e1","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/846b3c64fe3e77d9db20a7e3e62dbbb637c773e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98508","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98508.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98506","title":"mm/hugetlb: do not dissolve gigantic pages without runtime support","status":"backported","project":false,"upstream":[{"sha":"a363c62a653cc8b3e21da9545fa4e028ef50f9c3","url":"https://git.kernel.org/stable/c/a363c62a653cc8b3e21da9545fa4e028ef50f9c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ccf96a4b8626a001c13c5836d8357f31c57bbd8e","label":"ccf96a4b8626","date":"2026-10-03T12:39:01+02:00","lore":["https://lore.kernel.org/20260823044118.1097121-2-xialonglong2025@163.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a363c62a653cc8b3e21da9545fa4e028ef50f9c3","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/a363c62a653cc8b3e21da9545fa4e028ef50f9c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98506","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98506.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98505","title":"mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()","status":"backported","project":false,"upstream":[{"sha":"39c0ceedd54557bdc1542de08d22b2ed33e534e4","url":"https://git.kernel.org/stable/c/39c0ceedd54557bdc1542de08d22b2ed33e534e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e59cb7eda7c06334a0faf5aa44adb6acf2a1287a","label":"e59cb7eda7c0","date":"2026-10-03T12:38:53+02:00","lore":["https://lore.kernel.org/20260830160545.98969-1-sj@kernel.org","https://lore.kernel.org/20260907170358.100168-1-sj@kernel.org"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"39c0ceedd54557bdc1542de08d22b2ed33e534e4","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/39c0ceedd54557bdc1542de08d22b2ed33e534e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98505","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98505.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98503","title":"packet: use ubuf_info completion for TX_RING packets","status":"backported","project":false,"upstream":[{"sha":"9518405613863d0bf0700927a21367f5942cf058","url":"https://git.kernel.org/stable/c/9518405613863d0bf0700927a21367f5942cf058"}],"evidence":[{"url":"https://git.kernel.org/stable/c/eda9bcb721f15a93746a99eabda33d80b86404fd","label":"eda9bcb721f1","date":"2026-10-03T12:38:53+02:00","lore":["https://lore.kernel.org/netdev/20260909085542.3370986-1-doebel@amazon.de/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"9518405613863d0bf0700927a21367f5942cf058","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/9518405613863d0bf0700927a21367f5942cf058.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98503","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98503.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98473","title":"s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config","status":"backported","project":false,"upstream":[{"sha":"65e05ec252a9b79e75930d3c4dd42d8877db04c5","url":"https://git.kernel.org/stable/c/65e05ec252a9b79e75930d3c4dd42d8877db04c5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cf441a0db681dfad5e89b015d6be11365159d7a9","label":"cf441a0db681","date":"2026-10-03T12:38:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"65e05ec252a9b79e75930d3c4dd42d8877db04c5","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/65e05ec252a9b79e75930d3c4dd42d8877db04c5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98473","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98473.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98471","title":"KVM: SEV: Do cache maintenance on the source VM during intra-host migration","status":"backported","project":false,"upstream":[{"sha":"93de2a6a4b91b72607136dd656edf03fb399d27f","url":"https://git.kernel.org/stable/c/93de2a6a4b91b72607136dd656edf03fb399d27f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/37dfb676fafd1eef36fe0bb649607afbb0d5521b","label":"37dfb676fafd","date":"2026-10-03T12:38:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"93de2a6a4b91b72607136dd656edf03fb399d27f","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/93de2a6a4b91b72607136dd656edf03fb399d27f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98471","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98471.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98466","title":"KVM: arm64: Transfer the hyp stack pages out of the host stage-2","status":"backported","project":false,"upstream":[{"sha":"3a8c562892b96f35bba1e00d5e455a15963bbb92","url":"https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e5dd2a91a7ae3a276e6d79806127e923936e241b","label":"e5dd2a91a7ae","date":"2026-10-03T12:38:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a8c562892b96f35bba1e00d5e455a15963bbb92","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/3a8c562892b96f35bba1e00d5e455a15963bbb92.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98466","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98466.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98458","title":"Bluetooth: ISO: release unused CIS holds after channel attach","status":"backported","project":false,"upstream":[{"sha":"0fcd4dad555c96e0bd3a1b8c569f989be85c7341","url":"https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ed4c026cc4094dfb7a329b9d8df0ddd0be1b2458","label":"ed4c026cc409","date":"2026-10-03T12:38:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fcd4dad555c96e0bd3a1b8c569f989be85c7341","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/0fcd4dad555c96e0bd3a1b8c569f989be85c7341.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98458","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98458.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98452","title":"smb: client: clean up failed cached directory opens","status":"backported","project":false,"upstream":[{"sha":"d2ff5fb93ea83034025850266b5eed391f96b825","url":"https://git.kernel.org/stable/c/d2ff5fb93ea83034025850266b5eed391f96b825"}],"evidence":[{"url":"https://git.kernel.org/stable/c/abab661eed00fa102d3c35ddf1cce4f687e718c1","label":"abab661eed00","date":"2026-10-03T12:38:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2ff5fb93ea83034025850266b5eed391f96b825","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/d2ff5fb93ea83034025850266b5eed391f96b825.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98452","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98452.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98449","title":"smb: client: delete compound mids on send failure before unlock","status":"unfixed","project":false,"upstream":[{"sha":"8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9","url":"https://git.kernel.org/stable/c/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98444","title":"xfs: drop dquot flush lock when we can't find a buffer to flush","status":"unfixed","project":false,"upstream":[{"sha":"ffb48dccce1960a9ea24463a2f3c21d124d6b672","url":"https://git.kernel.org/stable/c/ffb48dccce1960a9ea24463a2f3c21d124d6b672"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"ffb48dccce1960a9ea24463a2f3c21d124d6b672","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/ffb48dccce1960a9ea24463a2f3c21d124d6b672.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98444","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98444.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98439","title":"smb/server: cancel async requests when closing connection","status":"unfixed","project":false,"upstream":[{"sha":"4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851","url":"https://git.kernel.org/stable/c/4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98439","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98439.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98436","title":"accel/amdxdna: Disable device buffer exporting","status":"unfixed","project":false,"upstream":[{"sha":"9480dd7ec3fcadd4217503e4bb32c16e19e4b21f","url":"https://git.kernel.org/stable/c/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9480dd7ec3fcadd4217503e4bb32c16e19e4b21f","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98436","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98436.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98435","title":"EDAC/altera: Use parent device for devres in altr_portb_setup()","status":"backported","project":false,"upstream":[{"sha":"9868f5c077dfe0b606331f2e782484f91a5789a5","url":"https://git.kernel.org/stable/c/9868f5c077dfe0b606331f2e782484f91a5789a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2cf03ada03532bfb42f06fbf01d9e2a99e6011d7","label":"2cf03ada0353","date":"2026-09-21T15:06:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9868f5c077dfe0b606331f2e782484f91a5789a5","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/9868f5c077dfe0b606331f2e782484f91a5789a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98435","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98435.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98431","title":"RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency","status":"unfixed","project":false,"upstream":[{"sha":"a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","url":"https://git.kernel.org/stable/c/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98431","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98431.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98427","title":"net/sched: codel: bound the dropping loop per dequeue call","status":"unfixed","project":false,"upstream":[{"sha":"7f4a5ec6258fd7c92633ec4b0493fc51166d9398","url":"https://git.kernel.org/stable/c/7f4a5ec6258fd7c92633ec4b0493fc51166d9398"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f4a5ec6258fd7c92633ec4b0493fc51166d9398","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7f4a5ec6258fd7c92633ec4b0493fc51166d9398.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98427","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98427.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98425","title":"wifi: mac80211: don't warn when an IBSS has no channel to scan","status":"backported","project":false,"upstream":[{"sha":"a7491b7efbd9136b120a12ed72af9c12121dd134","url":"https://git.kernel.org/stable/c/a7491b7efbd9136b120a12ed72af9c12121dd134"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5f139e17f5bdba6b68177dd8afe13fa4549dfc5f","label":"5f139e17f5bd","date":"2026-09-25T16:35:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a7491b7efbd9136b120a12ed72af9c12121dd134","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/a7491b7efbd9136b120a12ed72af9c12121dd134.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98425","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98425.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98424","title":"wifi: cfg80211: undo netns switch if renaming the wiphy fails","status":"backported","project":false,"upstream":[{"sha":"a41bd1938a9bfe226d444172a7e20e4bd5097960","url":"https://git.kernel.org/stable/c/a41bd1938a9bfe226d444172a7e20e4bd5097960"}],"evidence":[{"url":"https://git.kernel.org/stable/c/96bef5667b0c4aecb1b850d2343f69b9d684abb9","label":"96bef5667b0c","date":"2026-09-25T16:35:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"a41bd1938a9bfe226d444172a7e20e4bd5097960","lines":117,"reason":"","source":"https://github.com/torvalds/linux/commit/a41bd1938a9bfe226d444172a7e20e4bd5097960.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98420","title":"ksmbd: follow SMB2 session expiration semantics","status":"unfixed","project":false,"upstream":[{"sha":"d7fd1f98607f2cd358e583f9548bdf0173090a86","url":"https://git.kernel.org/stable/c/d7fd1f98607f2cd358e583f9548bdf0173090a86"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d7fd1f98607f2cd358e583f9548bdf0173090a86","lines":441,"reason":"","source":"https://github.com/torvalds/linux/commit/d7fd1f98607f2cd358e583f9548bdf0173090a86.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98420","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98420.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98408","title":"watchdog: rzv2h: Avoid division by zero","status":"backported","project":false,"upstream":[{"sha":"6274281c41efa8dd1aa5234c59ad904ff89d7af4","url":"https://git.kernel.org/stable/c/6274281c41efa8dd1aa5234c59ad904ff89d7af4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/eb14ee406e1d0fbbfb857f0eaa710daa8c2dc30e","label":"eb14ee406e1d","date":"2026-09-25T16:35:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6274281c41efa8dd1aa5234c59ad904ff89d7af4","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/6274281c41efa8dd1aa5234c59ad904ff89d7af4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98408","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98408.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98403","title":"s390/boot: Avoid IPL parameter append past command line","status":"backported","project":false,"upstream":[{"sha":"d76181dfabdaa720703167393704efacba343442","url":"https://git.kernel.org/stable/c/d76181dfabdaa720703167393704efacba343442"}],"evidence":[{"url":"https://git.kernel.org/stable/c/73eec5a0d55916d7e1115f5d03a7ffc06d6215cf","label":"73eec5a0d559","date":"2026-09-21T15:05:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d76181dfabdaa720703167393704efacba343442","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/d76181dfabdaa720703167393704efacba343442.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98403","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98403.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98401","title":"net: iptunnel: fix stale transport header during tunnel decapsulation","status":"backported","project":false,"upstream":[{"sha":"28a57fb2c5df4deb42a06e52fd36c14b37aa0034","url":"https://git.kernel.org/stable/c/28a57fb2c5df4deb42a06e52fd36c14b37aa0034"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e4a5b01e59f7102169762b8f566c8e052d05c0ff","label":"e4a5b01e59f7","date":"2026-09-21T15:05:06+02:00","lore":["https://lore.kernel.org/all/69de2bee.a00a0220.475f0.0041.GAE@google.com/T/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"28a57fb2c5df4deb42a06e52fd36c14b37aa0034","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/28a57fb2c5df4deb42a06e52fd36c14b37aa0034.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98401","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98401.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98400","title":"s390/ipl: Fix NULL deref in kdump without re-IPL parm block","status":"backported","project":false,"upstream":[{"sha":"7f918871112e8e7c581e99eb8e545af4e59c8367","url":"https://git.kernel.org/stable/c/7f918871112e8e7c581e99eb8e545af4e59c8367"}],"evidence":[{"url":"https://git.kernel.org/stable/c/50f9c40768e84f30d374235b3ee3850a94d9ac29","label":"50f9c40768e8","date":"2026-09-21T15:05:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f918871112e8e7c581e99eb8e545af4e59c8367","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7f918871112e8e7c581e99eb8e545af4e59c8367.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98400.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98399","title":"s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block","status":"backported","project":false,"upstream":[{"sha":"37f61b71cbc0caefc01022a19ee56fc2510e2e6e","url":"https://git.kernel.org/stable/c/37f61b71cbc0caefc01022a19ee56fc2510e2e6e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8d7988e8116c3d29d9e02ca9d37ee84577643f2d","label":"8d7988e8116c","date":"2026-09-21T15:05:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"37f61b71cbc0caefc01022a19ee56fc2510e2e6e","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/37f61b71cbc0caefc01022a19ee56fc2510e2e6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98399","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98399.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98394","title":"af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.","status":"backported","project":false,"upstream":[{"sha":"6e5ee08eb5858d175da6768d75d163817b6a9d4a","url":"https://git.kernel.org/stable/c/6e5ee08eb5858d175da6768d75d163817b6a9d4a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d5dd55b316ca229a4cbf11729483ba5bb57233e7","label":"d5dd55b316ca","date":"2026-09-21T15:05:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6e5ee08eb5858d175da6768d75d163817b6a9d4a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/6e5ee08eb5858d175da6768d75d163817b6a9d4a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98394","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98394.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98393","title":"net: ipv4: Fix UDP length overflow with PMTU discover and big MTU","status":"backported","project":false,"upstream":[{"sha":"b83641e0ab8b20eefcc4cdc5a059f897375291a2","url":"https://git.kernel.org/stable/c/b83641e0ab8b20eefcc4cdc5a059f897375291a2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/83fedc4741210f75be8ca5b487985a242bf6f18d","label":"83fedc474121","date":"2026-09-21T15:05:29+02:00","lore":["https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b83641e0ab8b20eefcc4cdc5a059f897375291a2","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b83641e0ab8b20eefcc4cdc5a059f897375291a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98393","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98393.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98387","title":"s390/crypto: Fix skcipher_walk return code handling in aes_s390","status":"backported","project":false,"upstream":[{"sha":"15fa028589c3a2545f0bff355eff06d5844196bf","url":"https://git.kernel.org/stable/c/15fa028589c3a2545f0bff355eff06d5844196bf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/35c3f97569306050e818fa18e17fa97c358f0f28","label":"35c3f9756930","date":"2026-09-21T15:05:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"15fa028589c3a2545f0bff355eff06d5844196bf","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/15fa028589c3a2545f0bff355eff06d5844196bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98387","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98387.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98376","title":"bpf: Use array_map_meta_equal for percpu array inner map replacement","status":"unfixed","project":false,"upstream":[{"sha":"593980175389a05793f6060aa20e626330960395","url":"https://git.kernel.org/stable/c/593980175389a05793f6060aa20e626330960395"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"593980175389a05793f6060aa20e626330960395","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/593980175389a05793f6060aa20e626330960395.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98376","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98376.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98365","title":"RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access","status":"backported","project":false,"upstream":[{"sha":"d10e2a08799e858d3e71ea4169bcd018f216d444","url":"https://git.kernel.org/stable/c/d10e2a08799e858d3e71ea4169bcd018f216d444"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2f3b705144e3a3c14184fec6e354680081fe91ec","label":"2f3b705144e3","date":"2026-09-25T16:35:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d10e2a08799e858d3e71ea4169bcd018f216d444","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d10e2a08799e858d3e71ea4169bcd018f216d444.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98365","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98365.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98364","title":"xfrm: hold net_device reference under RCU in bundle creation","status":"unfixed","project":false,"upstream":[{"sha":"9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","url":"https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98364","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98364.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98355","title":"RDMA/rtrs: guard against null kobj name","status":"unfixed","project":false,"upstream":[{"sha":"99c24a8968ebef0573825b5cb89d5985d51635b9","url":"https://git.kernel.org/stable/c/99c24a8968ebef0573825b5cb89d5985d51635b9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"99c24a8968ebef0573825b5cb89d5985d51635b9","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/99c24a8968ebef0573825b5cb89d5985d51635b9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98353","title":"RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables","status":"backported","project":false,"upstream":[{"sha":"00baeade709fb66da647e8327e8398bb532e30f7","url":"https://git.kernel.org/stable/c/00baeade709fb66da647e8327e8398bb532e30f7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e32aa1d85126e6d5ef6efd594ced3f75178886ce","label":"e32aa1d85126","date":"2026-10-21T10:32:25+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"00baeade709fb66da647e8327e8398bb532e30f7","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/00baeade709fb66da647e8327e8398bb532e30f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98353","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98353.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98341","title":"wifi: cfg80211: don't free driver-owned scan requests","status":"backported","project":false,"upstream":[{"sha":"dab68a74e90b8e07f08ed9deaa5884857a3cfe89","url":"https://git.kernel.org/stable/c/dab68a74e90b8e07f08ed9deaa5884857a3cfe89"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e8c75736cfd0c6c87562cda2312e3fe5e2227955","label":"e8c75736cfd0","date":"2026-09-25T16:35:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"dab68a74e90b8e07f08ed9deaa5884857a3cfe89","lines":100,"reason":"","source":"https://github.com/torvalds/linux/commit/dab68a74e90b8e07f08ed9deaa5884857a3cfe89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98341","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98341.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98338","title":"wifi: cfg80211: ibss: ref BSS entry for joined event","status":"unfixed","project":false,"upstream":[{"sha":"708f9d43d6a2eb9c6b83fe62af628de9dffd9314","url":"https://git.kernel.org/stable/c/708f9d43d6a2eb9c6b83fe62af628de9dffd9314"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"708f9d43d6a2eb9c6b83fe62af628de9dffd9314","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/708f9d43d6a2eb9c6b83fe62af628de9dffd9314.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98338","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98338.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98337","title":"wifi: mac80211: don't start a ROC while scanning","status":"backported","project":false,"upstream":[{"sha":"733f0fde95392ed5f61a4e36aee661ea8d0e8581","url":"https://git.kernel.org/stable/c/733f0fde95392ed5f61a4e36aee661ea8d0e8581"}],"evidence":[{"url":"https://git.kernel.org/stable/c/81baab8b645ec532bad2b7a8464191c720ef8fd9","label":"81baab8b645e","date":"2026-09-25T16:35:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"733f0fde95392ed5f61a4e36aee661ea8d0e8581","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/733f0fde95392ed5f61a4e36aee661ea8d0e8581.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98335","title":"wifi: mac80211: abort chanswitch when leaving a mesh","status":"backported","project":false,"upstream":[{"sha":"ac7472a24bd433b81c06582835dd1d5547c10da9","url":"https://git.kernel.org/stable/c/ac7472a24bd433b81c06582835dd1d5547c10da9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2e1d6e80148495e728a85a9250176f266312e55c","label":"2e1d6e801484","date":"2026-09-25T16:35:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac7472a24bd433b81c06582835dd1d5547c10da9","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/ac7472a24bd433b81c06582835dd1d5547c10da9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98335","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98335.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98334","title":"wifi: mac80211: reset state when starting AP fails","status":"backported","project":false,"upstream":[{"sha":"3f28551d0241254a75626d868041c6340285088b","url":"https://git.kernel.org/stable/c/3f28551d0241254a75626d868041c6340285088b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5d5ff5b36f5748a2a077f875a73ccb26860d3fcc","label":"5d5ff5b36f57","date":"2026-09-25T16:35:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f28551d0241254a75626d868041c6340285088b","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/3f28551d0241254a75626d868041c6340285088b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98333","title":"wifi: mac80211: reset the LED state when ifup fails","status":"unfixed","project":false,"upstream":[{"sha":"78183e8331958fda11cd2b6850bb424a9747c4b2","url":"https://git.kernel.org/stable/c/78183e8331958fda11cd2b6850bb424a9747c4b2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"78183e8331958fda11cd2b6850bb424a9747c4b2","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/78183e8331958fda11cd2b6850bb424a9747c4b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98332","title":"wifi: mac80211: only operate on TDLS peers in the TDLS code","status":"unfixed","project":false,"upstream":[{"sha":"6f0a100df8539ce90f37c14e1945f396ca2410bc","url":"https://git.kernel.org/stable/c/6f0a100df8539ce90f37c14e1945f396ca2410bc"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f0a100df8539ce90f37c14e1945f396ca2410bc","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/6f0a100df8539ce90f37c14e1945f396ca2410bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98332","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98332.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98330","title":"wifi: cfg80211: get the wiphy out of a dying network namespace","status":"backported","project":false,"upstream":[{"sha":"4635b1a1c1d693178a537446a6e09963f0fdae52","url":"https://git.kernel.org/stable/c/4635b1a1c1d693178a537446a6e09963f0fdae52"}],"evidence":[{"url":"https://git.kernel.org/stable/c/caa02072b2986d4b0e7a824de05782ef7b03a0ba","label":"caa02072b298","date":"2026-09-25T16:35:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4635b1a1c1d693178a537446a6e09963f0fdae52","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/4635b1a1c1d693178a537446a6e09963f0fdae52.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98330","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98330.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98329","title":"wifi: mac80211: don't allow injecting frames wider than the chanctx","status":"backported","project":false,"upstream":[{"sha":"e14bf37bb2b3853012ff160131d1c6233f7a9cc9","url":"https://git.kernel.org/stable/c/e14bf37bb2b3853012ff160131d1c6233f7a9cc9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/73f48f7e16cadfc74f444ccd10c1d3ae253e2e27","label":"73f48f7e16ca","date":"2026-09-25T16:35:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e14bf37bb2b3853012ff160131d1c6233f7a9cc9","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/e14bf37bb2b3853012ff160131d1c6233f7a9cc9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98329","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98329.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98327","title":"wifi: mac80211: mesh: reset the CSA state when leaving","status":"backported","project":false,"upstream":[{"sha":"860134b3af77970e006feab7e5decb8c84771c7f","url":"https://git.kernel.org/stable/c/860134b3af77970e006feab7e5decb8c84771c7f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bd3b21145ae2e781daac1bbd19216a63ab4e0cbd","label":"bd3b21145ae2","date":"2026-09-25T16:35:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"860134b3af77970e006feab7e5decb8c84771c7f","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/860134b3af77970e006feab7e5decb8c84771c7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98327","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98327.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98321","title":"netfilter: nf_nat: unregister and release hooks on error","status":"backported","project":false,"upstream":[{"sha":"cbdd39ce42530a193c56beb206a3356cb6d01016","url":"https://git.kernel.org/stable/c/cbdd39ce42530a193c56beb206a3356cb6d01016"}],"evidence":[{"url":"https://git.kernel.org/stable/c/79084567cd082fb4482e1ea457580e7d6504dd99","label":"79084567cd08","date":"2026-09-25T16:35:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cbdd39ce42530a193c56beb206a3356cb6d01016","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/cbdd39ce42530a193c56beb206a3356cb6d01016.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98321","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98321.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98318","title":"smb: client: validate absolute native symlink targets before NT fixups","status":"unfixed","project":false,"upstream":[{"sha":"23c240d9509e15f72e4112fc95f0160ab32ec430","url":"https://git.kernel.org/stable/c/23c240d9509e15f72e4112fc95f0160ab32ec430"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"23c240d9509e15f72e4112fc95f0160ab32ec430","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/23c240d9509e15f72e4112fc95f0160ab32ec430.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98318","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98318.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98317","title":"neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.","status":"backported","project":false,"upstream":[{"sha":"6d79b223ec44ada58ad37db42f539b60985a7722","url":"https://git.kernel.org/stable/c/6d79b223ec44ada58ad37db42f539b60985a7722"}],"evidence":[{"url":"https://git.kernel.org/stable/c/982c7f66c04134b77126edbfd8a63ecd6928cfd9","label":"982c7f66c041","date":"2026-09-25T16:35:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6d79b223ec44ada58ad37db42f539b60985a7722","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/6d79b223ec44ada58ad37db42f539b60985a7722.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98313","title":"drm/msm/dp: skip PUSH_IDLE when the link was never enabled","status":"backported","project":false,"upstream":[{"sha":"e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","url":"https://git.kernel.org/stable/c/e249a6e2a130c08bb4d8b0a55cbe29754307e5c9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dc57147549a10c99766144cde265645287718ff7","label":"dc57147549a1","date":"2026-09-25T16:35:34+02:00","lore":["https://lore.kernel.org/r/20260808171325.133041-1-jesse.casco@gmail.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/e249a6e2a130c08bb4d8b0a55cbe29754307e5c9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98309","title":"drm/vc4: Use managed KMS polling to fix UAF on unbind","status":"backported","project":false,"upstream":[{"sha":"073a30d75f309812ed61af134f24ffef4107b13a","url":"https://git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ee507691c18f9fee5d4751e295ab9a7ff31d59ae","label":"ee507691c18f","date":"2026-09-25T16:35:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"073a30d75f309812ed61af134f24ffef4107b13a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/073a30d75f309812ed61af134f24ffef4107b13a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98309","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98309.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98307","title":"wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()","status":"backported","project":false,"upstream":[{"sha":"820b8cff81c796ba20573e04722ab62500713f97","url":"https://git.kernel.org/stable/c/820b8cff81c796ba20573e04722ab62500713f97"}],"evidence":[{"url":"https://git.kernel.org/stable/c/57bc3cd46458eafa1c38e3044a61b7399cde7642","label":"57bc3cd46458","date":"2026-09-25T16:35:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"820b8cff81c796ba20573e04722ab62500713f97","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/820b8cff81c796ba20573e04722ab62500713f97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98307","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98307.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98304","title":"net: bcmgenet: restore the hardware filters on open","status":"backported","project":false,"upstream":[{"sha":"23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","url":"https://git.kernel.org/stable/c/23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/56db7ec462d6a2b886e299ad835109c089606969","label":"56db7ec462d6","date":"2026-09-25T16:35:36+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98304","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98304.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98297","title":"Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained","status":"backported","project":false,"upstream":[{"sha":"6610c6fe4b8936c232048e6049bf77c70a6f759c","url":"https://git.kernel.org/stable/c/6610c6fe4b8936c232048e6049bf77c70a6f759c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e220c1242a643d97102a79f09b7ef3aa31276961","label":"e220c1242a64","date":"2026-09-25T16:35:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"unknown","patches":[{"sha":"6610c6fe4b8936c232048e6049bf77c70a6f759c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98297.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98296","title":"Bluetooth: btintel_pcie: validate TX skb length in send_sync","status":"backported","project":false,"upstream":[{"sha":"4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","url":"https://git.kernel.org/stable/c/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/84f353256e170dc4865d45007d1bc446ed566da7","label":"84f353256e17","date":"2026-09-25T16:35:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98296","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98296.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98295","title":"Bluetooth: coredump: Quiesce dump work on unregister","status":"backported","project":false,"upstream":[{"sha":"d236517c264e41dc09833c708ef23bccb7a91219","url":"https://git.kernel.org/stable/c/d236517c264e41dc09833c708ef23bccb7a91219"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dcaf10ef27f928568c25de3e9fc242e538de5c67","label":"dcaf10ef27f9","date":"2026-09-25T16:35:37+02:00","lore":["https://lore.kernel.org/r/20260322210849.68743-1-abysamross@gmail.com","https://lore.kernel.org/r/20260814231248.3096377-1-tristmd@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d236517c264e41dc09833c708ef23bccb7a91219","lines":128,"reason":"","source":"https://github.com/torvalds/linux/commit/d236517c264e41dc09833c708ef23bccb7a91219.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98295","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98295.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98294","title":"Bluetooth: hci_qca: Do not write to the serial port after it is closed","status":"backported","project":false,"upstream":[{"sha":"4e93c65f87825e1e012bce56615320aeb123815d","url":"https://git.kernel.org/stable/c/4e93c65f87825e1e012bce56615320aeb123815d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a5414b0a9464b863733c8bd97493cb443a210ec4","label":"a5414b0a9464","date":"2026-09-25T16:35:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4e93c65f87825e1e012bce56615320aeb123815d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/4e93c65f87825e1e012bce56615320aeb123815d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98294","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98294.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98292","title":"Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access","status":"unfixed","project":false,"upstream":[{"sha":"8879e3e0a84a86954c855caceead4867e74a9a27","url":"https://git.kernel.org/stable/c/8879e3e0a84a86954c855caceead4867e74a9a27"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8879e3e0a84a86954c855caceead4867e74a9a27","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/8879e3e0a84a86954c855caceead4867e74a9a27.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98292","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98292.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98289","title":"af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().","status":"backported","project":false,"upstream":[{"sha":"4a4263dfeabad72f95e8ab6e15146861fa4144dd","url":"https://git.kernel.org/stable/c/4a4263dfeabad72f95e8ab6e15146861fa4144dd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b8f71d69380a5fbc734c868acbeb560f1de1766f","label":"b8f71d69380a","date":"2026-09-25T16:35:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4a4263dfeabad72f95e8ab6e15146861fa4144dd","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/4a4263dfeabad72f95e8ab6e15146861fa4144dd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98288","title":"net: stmmac: fix TSO header length truncation","status":"unfixed","project":false,"upstream":[{"sha":"15989abd74f16f44bf953d056b95f1d2fda9b0cd","url":"https://git.kernel.org/stable/c/15989abd74f16f44bf953d056b95f1d2fda9b0cd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"15989abd74f16f44bf953d056b95f1d2fda9b0cd","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/15989abd74f16f44bf953d056b95f1d2fda9b0cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98286","title":"drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown","status":"backported","project":false,"upstream":[{"sha":"c391a40f71886b28c082b47270f0e856fa3e1150","url":"https://git.kernel.org/stable/c/c391a40f71886b28c082b47270f0e856fa3e1150"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9616b0c67fbd8cc0b49de7b26cdf2ab33747c80e","label":"9616b0c67fbd","date":"2026-09-25T16:35:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c391a40f71886b28c082b47270f0e856fa3e1150","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/c391a40f71886b28c082b47270f0e856fa3e1150.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98286","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98286.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98285","title":"net: bridge: vlan: fix bugs caused by switchdev deletion errors","status":"unfixed","project":false,"upstream":[{"sha":"2842ce397dd09882530b42f7fdb0c855767eb24e","url":"https://git.kernel.org/stable/c/2842ce397dd09882530b42f7fdb0c855767eb24e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2842ce397dd09882530b42f7fdb0c855767eb24e","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/2842ce397dd09882530b42f7fdb0c855767eb24e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98285","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98285.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98284","title":"netlink: do not free nlk->groups while lockless readers can use it","status":"unfixed","project":false,"upstream":[{"sha":"ceac0de741bfb47ca255eee075257b3bb31f0651","url":"https://git.kernel.org/stable/c/ceac0de741bfb47ca255eee075257b3bb31f0651"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"ceac0de741bfb47ca255eee075257b3bb31f0651","lines":101,"reason":"","source":"https://github.com/torvalds/linux/commit/ceac0de741bfb47ca255eee075257b3bb31f0651.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98284","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98284.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98279","title":"btrfs: handle lack of space when cleaning up verity items","status":"backported","project":false,"upstream":[{"sha":"76bf149cd0298544631e756670b89c399c7acbca","url":"https://git.kernel.org/stable/c/76bf149cd0298544631e756670b89c399c7acbca"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4b7ecabd87dc40998fe7870d7975279649229a3b","label":"4b7ecabd87dc","date":"2026-09-25T16:35:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"76bf149cd0298544631e756670b89c399c7acbca","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/76bf149cd0298544631e756670b89c399c7acbca.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98279","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98279.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98277","title":"eth: fbnic: ring the doorbell if a burst ends in a drop","status":"backported","project":false,"upstream":[{"sha":"490599ab23134962a6d18a024e84541d77bdb999","url":"https://git.kernel.org/stable/c/490599ab23134962a6d18a024e84541d77bdb999"}],"evidence":[{"url":"https://git.kernel.org/stable/c/60ef74357a36ed2a102a75bb68d37aa7f305b94e","label":"60ef74357a36","date":"2026-09-25T16:35:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"490599ab23134962a6d18a024e84541d77bdb999","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/490599ab23134962a6d18a024e84541d77bdb999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98277","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98277.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98273","title":"x86/kprobes: Fix crash when probing CS CALL instructions","status":"backported","project":false,"upstream":[{"sha":"a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","url":"https://git.kernel.org/stable/c/a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cfc1af3d054aaabee08f1f77c441b3533b082869","label":"cfc1af3d054a","date":"2026-09-25T16:35:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98273","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98273.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98271","title":"net: skbuff: do not leave stale header offsets after pskb_carve()","status":"backported","project":false,"upstream":[{"sha":"a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","url":"https://git.kernel.org/stable/c/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bff8a8e53a6d290bc2777bde36d3cb6317b8463d","label":"bff8a8e53a6d","date":"2026-09-25T16:35:40+02:00","lore":["https://lore.kernel.org/netdev/6aa3e9d3.f2639fcc.29487d.0028.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98271","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98271.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98269","title":"btrfs: abort transaction on failure to update inode for hole punching and reflinking","status":"backported","project":false,"upstream":[{"sha":"97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","url":"https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9588850bfa75c78ce73c2f6f72544d19d2e9beb6","label":"9588850bfa75","date":"2026-09-25T16:35:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98269","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98269.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98266","title":"ALSA: core: Fix potential UAF after asynchronous card release","status":"backported","project":false,"upstream":[{"sha":"fd95e68df6fe66344161a1329cbe5e5805e7b704","url":"https://git.kernel.org/stable/c/fd95e68df6fe66344161a1329cbe5e5805e7b704"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2dec4642589a663e064e4411d92d6e8fa250d53b","label":"2dec4642589a","date":"2026-09-25T16:35:41+02:00","lore":["https://lore.kernel.org/CA+0ovCgQUQNN=Z1tJTouiCsDaXR5M-3-SQEGk-cpPXQkM5Xh+w@mail.gmail.com","https://lore.kernel.org/CA+0ovChexj4TrZL_2iG_P0WBEbZc5+73GfB3DkciQi=R8pZOnA@mail.gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd95e68df6fe66344161a1329cbe5e5805e7b704","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/fd95e68df6fe66344161a1329cbe5e5805e7b704.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98266","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98266.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98254","title":"swiotlb: use the adjusted address for the highmem page lookup","status":"backported","project":false,"upstream":[{"sha":"b7d7914a9ae3097e63d113007e4fb44d33d515b1","url":"https://git.kernel.org/stable/c/b7d7914a9ae3097e63d113007e4fb44d33d515b1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aa4709813b29db89f2307f968db5d24925dcdeb1","label":"aa4709813b29","date":"2026-09-25T16:35:42+02:00","lore":["https://lore.kernel.org/r/20260905084210.148255-1-donggeunyoo.kernel@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b7d7914a9ae3097e63d113007e4fb44d33d515b1","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/b7d7914a9ae3097e63d113007e4fb44d33d515b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98254","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98254.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98248","title":"arm64: percpu: Fix LSE operations on {8,16}-bit types","status":"backported","project":false,"upstream":[{"sha":"8cf2093f5372952a9ebc805c418d45df7112cd14","url":"https://git.kernel.org/stable/c/8cf2093f5372952a9ebc805c418d45df7112cd14"}],"evidence":[{"url":"https://git.kernel.org/stable/c/390742871a723b52de9b92a94c0d1c85a2531e3e","label":"390742871a72","date":"2026-09-25T16:35:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8cf2093f5372952a9ebc805c418d45df7112cd14","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/8cf2093f5372952a9ebc805c418d45df7112cd14.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98248","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98248.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98229","title":"xfrm: save input state data before secpath resets","status":"backported","project":false,"upstream":[{"sha":"3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","url":"https://git.kernel.org/stable/c/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa"}],"evidence":[{"url":"https://git.kernel.org/stable/c/148db154066b066616b82c12d373e786eba1f96a","label":"148db154066b","date":"2026-09-25T16:35:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98229","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98229.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98228","title":"mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ","status":"unfixed","project":false,"upstream":[{"sha":"bbc448c541ed90d52f9ec22f17394304e3bf170e","url":"https://git.kernel.org/stable/c/bbc448c541ed90d52f9ec22f17394304e3bf170e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"bbc448c541ed90d52f9ec22f17394304e3bf170e","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/bbc448c541ed90d52f9ec22f17394304e3bf170e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98228","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98228.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98222","title":"KEYS: encrypted: fix integer overflow of datablob_len","status":"backported","project":false,"upstream":[{"sha":"8697c431e297eb0d0ab13dda6bc172b48a34f05c","url":"https://git.kernel.org/stable/c/8697c431e297eb0d0ab13dda6bc172b48a34f05c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0","label":"a1a98eca102b","date":"2026-09-25T16:35:45+02:00","lore":["https://lore.kernel.org/r/20260909153433.83117-1-cenzhang@linux.microsoft.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8697c431e297eb0d0ab13dda6bc172b48a34f05c","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/8697c431e297eb0d0ab13dda6bc172b48a34f05c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98222","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98222.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98212","title":"mmc: hsq: Fix use-after-free in retry work","status":"backported","project":false,"upstream":[{"sha":"5d132990475f02cfa1debe03d50b479432864ebd","url":"https://git.kernel.org/stable/c/5d132990475f02cfa1debe03d50b479432864ebd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8439bf262ce3267bcfee29d3c61605f1731a2271","label":"8439bf262ce3","date":"2026-09-25T16:35:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5d132990475f02cfa1debe03d50b479432864ebd","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/5d132990475f02cfa1debe03d50b479432864ebd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98212","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98212.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98211","title":"mmc: mmci: Fix use-after-free in busy-timeout work","status":"backported","project":false,"upstream":[{"sha":"2b19cf3e50cddaff07b657dae1a8f30f06032852","url":"https://git.kernel.org/stable/c/2b19cf3e50cddaff07b657dae1a8f30f06032852"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7fecf79f31568de161be14911db10d1251617b01","label":"7fecf79f3156","date":"2026-09-25T16:35:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b19cf3e50cddaff07b657dae1a8f30f06032852","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/2b19cf3e50cddaff07b657dae1a8f30f06032852.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98182","title":"wifi: mac80211: refuse to make a monitor active when it has no queue","status":"backported","project":false,"upstream":[{"sha":"2b04d6556964ae9f89819b86a0a7801e39c3aae5","url":"https://git.kernel.org/stable/c/2b04d6556964ae9f89819b86a0a7801e39c3aae5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/abe15e643e576459469867758ae9c586a7bab95d","label":"abe15e643e57","date":"2026-09-25T16:35:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b04d6556964ae9f89819b86a0a7801e39c3aae5","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/2b04d6556964ae9f89819b86a0a7801e39c3aae5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98182","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98182.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98180","title":"drm/msm: RCU-free the scheduler-containing ring and VM objects","status":"backported","project":false,"upstream":[{"sha":"01c8d1f385f788f1bbbbb7687c4386d614281218","url":"https://git.kernel.org/stable/c/01c8d1f385f788f1bbbbb7687c4386d614281218"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d81bf4581903b0cba0698cd4d1c07fc6be21754a","label":"d81bf4581903","date":"2026-09-25T16:35:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"01c8d1f385f788f1bbbbb7687c4386d614281218","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/01c8d1f385f788f1bbbbb7687c4386d614281218.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98180","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98180.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98179","title":"drm/amdgpu: fix rmmio iounmap skipped on device removal","status":"backported","project":false,"upstream":[{"sha":"5155002b03b24ba3ef91c5c313b8cf0171b24904","url":"https://git.kernel.org/stable/c/5155002b03b24ba3ef91c5c313b8cf0171b24904"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cd55dde2b63789a3dafe982c89844f537501d096","label":"cd55dde2b637","date":"2026-09-25T16:35:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5155002b03b24ba3ef91c5c313b8cf0171b24904","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/5155002b03b24ba3ef91c5c313b8cf0171b24904.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98179","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98179.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98177","title":"drm/amdkfd: Avoid integer underflow in EOP ring size calculation.","status":"unfixed","project":false,"upstream":[{"sha":"8ee521b8b189799e361d4233c5180ba56656d4d4","url":"https://git.kernel.org/stable/c/8ee521b8b189799e361d4233c5180ba56656d4d4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ee521b8b189799e361d4233c5180ba56656d4d4","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/8ee521b8b189799e361d4233c5180ba56656d4d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98177","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98177.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98176","title":"drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc","status":"unfixed","project":false,"upstream":[{"sha":"c883d0a132d430ef7ebb23fd94323be94d0fbdb8","url":"https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"c883d0a132d430ef7ebb23fd94323be94d0fbdb8","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/c883d0a132d430ef7ebb23fd94323be94d0fbdb8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98176","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98176.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98175","title":"smb: client: cancel reconnect work in clean_demultiplex_info()","status":"backported","project":false,"upstream":[{"sha":"c65eae6f61d1778ff7a82e4aae4080e26f486af1","url":"https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7ab9ceedd860216fb97f2d8574cbe58b8906f42a","label":"7ab9ceedd860","date":"2026-09-25T16:35:50+02:00","lore":["https://lore.kernel.org/r/6aa4a12d.f81106d8.2ab401.0023.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c65eae6f61d1778ff7a82e4aae4080e26f486af1","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/c65eae6f61d1778ff7a82e4aae4080e26f486af1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98175","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98175.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98174","title":"smb: client: fix rlist race and missing initialization","status":"backported","project":false,"upstream":[{"sha":"5f270f091256da1338c3631083e15d7f83cc05e1","url":"https://git.kernel.org/stable/c/5f270f091256da1338c3631083e15d7f83cc05e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/04082b1833856cb9ed87e0d3d5f04cbf836cf7da","label":"04082b183385","date":"2026-09-25T16:35:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"5f270f091256da1338c3631083e15d7f83cc05e1","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/5f270f091256da1338c3631083e15d7f83cc05e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98164","title":"KVM: x86/mmu: Check write tracking in all address spaces","status":"backported","project":false,"upstream":[{"sha":"0f38453cdb2e17566ccb7c0f3dabd5bd21caca26","url":"https://git.kernel.org/stable/c/0f38453cdb2e17566ccb7c0f3dabd5bd21caca26"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c0a9bd5fca0b5f2dea32b0fc31350e71e8648112","label":"c0a9bd5fca0b","date":"2026-09-02T14:31:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0f38453cdb2e17566ccb7c0f3dabd5bd21caca26","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98164","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98164.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98162","title":"smb/server: fix tree connection leak in smb2_tree_connect()","status":"backported","project":false,"upstream":[{"sha":"39f2032096715daae5f6fd0f587ca7a474b019df","url":"https://git.kernel.org/stable/c/39f2032096715daae5f6fd0f587ca7a474b019df"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fea9c705bbc618ba6426424c9f8330555820c9ec","label":"fea9c705bbc6","date":"2026-10-15T11:58:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"39f2032096715daae5f6fd0f587ca7a474b019df","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/39f2032096715daae5f6fd0f587ca7a474b019df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98162","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98162.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98161","title":"nvdimm: pmem: keep PREFLUSH before data writes","status":"backported","project":false,"upstream":[{"sha":"c644a2f8fef5618fcf453c591177700fd07dd024","url":"https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024"}],"evidence":[{"url":"https://git.kernel.org/stable/c/770a90c2127220f0fc194ce909ad4f0842e141cb","label":"770a90c21272","date":"2026-09-14T13:34:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c644a2f8fef5618fcf453c591177700fd07dd024","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/c644a2f8fef5618fcf453c591177700fd07dd024.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98156","title":"drm/virtio: use the DMA API for resource backing on Xen","status":"backported","project":false,"upstream":[{"sha":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","url":"https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78"}],"evidence":[{"url":"https://git.kernel.org/stable/c/93c557e947ef0040004b1ac6a1c1265d79a957e1","label":"93c557e947ef","date":"2026-09-21T15:05:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98156.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98153","title":"nvme: fix racy access to FDP placement id array","status":"unfixed","project":false,"upstream":[{"sha":"56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","url":"https://git.kernel.org/stable/c/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98153","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98153.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98148","title":"drm/gud: validate GUD_ROTATION_0 is present in supported rotations","status":"backported","project":false,"upstream":[{"sha":"cb732d027aa18e1fcf9d2797f47d20b179ebc59c","url":"https://git.kernel.org/stable/c/cb732d027aa18e1fcf9d2797f47d20b179ebc59c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b2cd682324b889011874cf844b7c7efa97c97296","label":"b2cd682324b8","date":"2026-09-21T15:05:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cb732d027aa18e1fcf9d2797f47d20b179ebc59c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/cb732d027aa18e1fcf9d2797f47d20b179ebc59c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98148","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98148.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98144","title":"accel/amdxdna: put the chained BO when its mapping fails","status":"unfixed","project":false,"upstream":[{"sha":"7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","url":"https://git.kernel.org/stable/c/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98144","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98144.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98142","title":"drm/cirrus-qemu: Validate BAR0 size during probe","status":"backported","project":false,"upstream":[{"sha":"92312d333bf700798f92f30406c721bce87506f3","url":"https://git.kernel.org/stable/c/92312d333bf700798f92f30406c721bce87506f3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/26bd90c886218f36c9adeab206b0e27b4384e2f6","label":"26bd90c88621","date":"2026-09-21T15:05:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"92312d333bf700798f92f30406c721bce87506f3","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/92312d333bf700798f92f30406c721bce87506f3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98142","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98142.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98131","title":"net: stmmac: fix dma mapping leak in stmmac_tso_xmit()","status":"backported","project":false,"upstream":[{"sha":"a5d946466a95621fa2769720d59ea336003aa1a5","url":"https://git.kernel.org/stable/c/a5d946466a95621fa2769720d59ea336003aa1a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8a3257f142ae513d0c96d42f97386d4941bcec29","label":"8a3257f142ae","date":"2026-10-15T11:58:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"a5d946466a95621fa2769720d59ea336003aa1a5","lines":120,"reason":"","source":"https://github.com/torvalds/linux/commit/a5d946466a95621fa2769720d59ea336003aa1a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98131","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98131.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98127","title":"smb/client: validate new EOF for insert range","status":"backported","project":false,"upstream":[{"sha":"1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","url":"https://git.kernel.org/stable/c/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bc7602b9082ef195d913c4c16fa9853dd262333e","label":"bc7602b9082e","date":"2026-09-21T15:05:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98127","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98127.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98126","title":"smb/client: validate new EOF for zero range","status":"backported","project":false,"upstream":[{"sha":"88972e35750792e717af287dc71f42a03b5cbce4","url":"https://git.kernel.org/stable/c/88972e35750792e717af287dc71f42a03b5cbce4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/06a4f9049cb6dc319bceec2dc813ba89add8b828","label":"06a4f9049cb6","date":"2026-09-21T15:05:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"88972e35750792e717af287dc71f42a03b5cbce4","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/88972e35750792e717af287dc71f42a03b5cbce4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98126","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98126.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98125","title":"smb/client: fix stale page cache in insert/collapse range","status":"unfixed","project":false,"upstream":[{"sha":"01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","url":"https://git.kernel.org/stable/c/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98124","title":"smb/client: invalidate fscache for fallocate range operations","status":"unfixed","project":false,"upstream":[{"sha":"448ba0ae65ca61064183564d2983c9aa59bd6ba7","url":"https://git.kernel.org/stable/c/448ba0ae65ca61064183564d2983c9aa59bd6ba7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"448ba0ae65ca61064183564d2983c9aa59bd6ba7","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/448ba0ae65ca61064183564d2983c9aa59bd6ba7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98124","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98124.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98119","title":"netfs: break unbuffered write when netfs_alloc_subrequest() fails","status":"backported","project":false,"upstream":[{"sha":"8fb45a934661419c04a44d4cfea1e0df7dcf2805","url":"https://git.kernel.org/stable/c/8fb45a934661419c04a44d4cfea1e0df7dcf2805"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cf6f93b8b06acf57de62dacbe71a3b99c68656a7","label":"cf6f93b8b06a","date":"2026-09-21T15:05:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8fb45a934661419c04a44d4cfea1e0df7dcf2805","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/8fb45a934661419c04a44d4cfea1e0df7dcf2805.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98119","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98119.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98118","title":"netfs: Fix readahead synchronisation issues by loading all folios upfront","status":"unfixed","project":false,"upstream":[{"sha":"fed0b33e6c584986ba70018ec9f9787a98216e64","url":"https://git.kernel.org/stable/c/fed0b33e6c584986ba70018ec9f9787a98216e64"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"fed0b33e6c584986ba70018ec9f9787a98216e64","lines":362,"reason":"","source":"https://github.com/torvalds/linux/commit/fed0b33e6c584986ba70018ec9f9787a98216e64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98115","title":"ksmbd: safely drain sessions during logoff","status":"unfixed","project":false,"upstream":[{"sha":"d12168084c8c1b6d883c8eca5853929ac5136a9e","url":"https://git.kernel.org/stable/c/d12168084c8c1b6d883c8eca5853929ac5136a9e"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"d12168084c8c1b6d883c8eca5853929ac5136a9e","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/d12168084c8c1b6d883c8eca5853929ac5136a9e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98114","title":"ksmbd: propagate DACL parsing errors","status":"backported","project":false,"upstream":[{"sha":"c61dc7b1b4a3234b4aa3965502908a292238805c","url":"https://git.kernel.org/stable/c/c61dc7b1b4a3234b4aa3965502908a292238805c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/37952f03d5171eb3a33b2abc2cf6e456d69ff4a1","label":"37952f03d517","date":"2026-09-21T15:05:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c61dc7b1b4a3234b4aa3965502908a292238805c","lines":147,"reason":"","source":"https://github.com/torvalds/linux/commit/c61dc7b1b4a3234b4aa3965502908a292238805c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98114","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98114.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98111","title":"Bluetooth: btintel: validate version TLV value lengths","status":"backported","project":false,"upstream":[{"sha":"a086c0892969bf8a0151b0f12bd14a68827c88b2","url":"https://git.kernel.org/stable/c/a086c0892969bf8a0151b0f12bd14a68827c88b2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/76948d207d0978a613ce06a05cba07284a5578a7","label":"76948d207d09","date":"2026-09-21T15:05:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a086c0892969bf8a0151b0f12bd14a68827c88b2","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/a086c0892969bf8a0151b0f12bd14a68827c88b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98111","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98111.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98107","title":"Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect","status":"backported","project":false,"upstream":[{"sha":"56c2b5831d39dc84aad2573dc3e197af1a872a05","url":"https://git.kernel.org/stable/c/56c2b5831d39dc84aad2573dc3e197af1a872a05"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65","label":"6da5c0331fc3","date":"2026-09-21T15:05:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"56c2b5831d39dc84aad2573dc3e197af1a872a05","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/56c2b5831d39dc84aad2573dc3e197af1a872a05.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98107","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98107.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98106","title":"drm/pagemap: Prevent double migration of device pages","status":"unfixed","project":false,"upstream":[{"sha":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","url":"https://git.kernel.org/stable/c/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","lines":204,"reason":"","source":"https://github.com/torvalds/linux/commit/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98106","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98106.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98103","title":"igmp: convert struct ip_sf_list to RCU","status":"backported","project":false,"upstream":[{"sha":"2987ee196c88dbde0463dc87d5fb209c684e34a2","url":"https://git.kernel.org/stable/c/2987ee196c88dbde0463dc87d5fb209c684e34a2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d3011d1f293478c730aa0870490afa145c37600e","label":"d3011d1f2934","date":"2026-09-21T15:05:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2987ee196c88dbde0463dc87d5fb209c684e34a2","lines":490,"reason":"","source":"https://github.com/torvalds/linux/commit/2987ee196c88dbde0463dc87d5fb209c684e34a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98102","title":"ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()","status":"backported","project":false,"upstream":[{"sha":"93b49239840b91313adbd77b8b52993eff2d08c1","url":"https://git.kernel.org/stable/c/93b49239840b91313adbd77b8b52993eff2d08c1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8d4fe5c13f5056faa6deb09a90e24a89f9ebfad4","label":"8d4fe5c13f50","date":"2026-09-21T15:05:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"93b49239840b91313adbd77b8b52993eff2d08c1","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/93b49239840b91313adbd77b8b52993eff2d08c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98101","title":"ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()","status":"backported","project":false,"upstream":[{"sha":"c073d1b070f171d206b19c98d71739a97f15b3f1","url":"https://git.kernel.org/stable/c/c073d1b070f171d206b19c98d71739a97f15b3f1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2c2091e2ee93049fc513ad1e6c99d8b6c809f467","label":"2c2091e2ee93","date":"2026-09-21T15:05:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c073d1b070f171d206b19c98d71739a97f15b3f1","lines":147,"reason":"","source":"https://github.com/torvalds/linux/commit/c073d1b070f171d206b19c98d71739a97f15b3f1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98099","title":"ipv6: mcast: use rcu_assign_pointer() for __rcu list updates","status":"backported","project":false,"upstream":[{"sha":"0c8f56c583c3250408367880c98e4d6fbc929315","url":"https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315"}],"evidence":[{"url":"https://git.kernel.org/stable/c/afca229b39acc2590976b3e4f6e0fe76cededc60","label":"afca229b39ac","date":"2026-10-15T11:58:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0c8f56c583c3250408367880c98e4d6fbc929315","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/0c8f56c583c3250408367880c98e4d6fbc929315.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98099","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98099.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98097","title":"tipc: Dont send random pad bytes in RESET/ACTIVATE messages","status":"backported","project":false,"upstream":[{"sha":"81c600c26302a27852ed8b19c5f2f647ea3555c9","url":"https://git.kernel.org/stable/c/81c600c26302a27852ed8b19c5f2f647ea3555c9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4ab2977323d5f068a872126f7818d1aeb9e9ca0d","label":"4ab2977323d5","date":"2026-09-21T15:05:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"81c600c26302a27852ed8b19c5f2f647ea3555c9","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/81c600c26302a27852ed8b19c5f2f647ea3555c9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98087","title":"sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate","status":"backported","project":false,"upstream":[{"sha":"dae5c0292080dd7b9c7d784268dcf443f1f3d15e","url":"https://git.kernel.org/stable/c/dae5c0292080dd7b9c7d784268dcf443f1f3d15e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/755476d7ba92a1f3fe2a376c515d710bc6baebc3","label":"755476d7ba92","date":"2026-09-21T15:05:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"dae5c0292080dd7b9c7d784268dcf443f1f3d15e","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/dae5c0292080dd7b9c7d784268dcf443f1f3d15e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98087","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98087.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98085","title":"bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge","status":"backported","project":false,"upstream":[{"sha":"387b1baefbb776e3f48dc2261e77a49213f470f7","url":"https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a0cd9e22f8faed30a8da8be357c51bd8b3074ee9","label":"a0cd9e22f8fa","date":"2026-10-15T11:58:12+02:00","lore":["https://lore.kernel.org/bpf/20260901-bug-016-backtrack-ld-abs-v1-1-59368f1be435@gmail.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":{"id":"CVE-2026-98085","series":"6.18.y","upstream":["387b1baefbb776e3f48dc2261e77a49213f470f7"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"The newer scalar backtracker does not traverse the implicit parent-frame subprogram-exit edge for ld_abs/ld_ind; 6.1 is unaffected because its backtracker conservatively returns ENOTSUPP for these opcodes.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n4268"},{"label":"Upstream fix 387b1baefbb7","url":"https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7"}]},"size":{"status":"within-limit","patches":[{"sha":"387b1baefbb776e3f48dc2261e77a49213f470f7","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/387b1baefbb776e3f48dc2261e77a49213f470f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98084","title":"bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks","status":"backported","project":false,"upstream":[{"sha":"e3e4f66cc4b72333d0886ae2673c360248987889","url":"https://git.kernel.org/stable/c/e3e4f66cc4b72333d0886ae2673c360248987889"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3a39bc9707fbd1bef4df7318a9d02222741dda5b","label":"3a39bc9707fb","date":"2026-10-15T11:58:12+02:00","lore":["https://lore.kernel.org/r/20260831-bug-015-backtrack-cb-args-precise-v1-1-68a8e2a821e0@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-98084","series":"6.18.y","upstream":["e3e4f66cc4b72333d0886ae2673c360248987889"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"Callback backtracking on BPF_EXIT clears outer-frame R1-R5 when calls_callback is set, losing caller precision.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n4268"},{"label":"Upstream fix e3e4f66cc4b7","url":"https://git.kernel.org/stable/c/e3e4f66cc4b72333d0886ae2673c360248987889"}]},"size":{"status":"within-limit","patches":[{"sha":"e3e4f66cc4b72333d0886ae2673c360248987889","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/e3e4f66cc4b72333d0886ae2673c360248987889.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98084","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98084.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98081","title":"btrfs: zoned: finish active block group cleanup if call_zone_finish() fails","status":"backported","project":false,"upstream":[{"sha":"a18a6b93a2843b9d103d3456bbd4b3f90282a379","url":"https://git.kernel.org/stable/c/a18a6b93a2843b9d103d3456bbd4b3f90282a379"}],"evidence":[{"url":"https://git.kernel.org/stable/c/40370f02a1ca3760f8925ffcbe76eb4d91ea758d","label":"40370f02a1ca","date":"2026-09-21T15:05:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a18a6b93a2843b9d103d3456bbd4b3f90282a379","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/a18a6b93a2843b9d103d3456bbd4b3f90282a379.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98081","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98081.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98079","title":"btrfs: zstd: fix lost wakeup when waiting for a workspace","status":"backported","project":false,"upstream":[{"sha":"2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","url":"https://git.kernel.org/stable/c/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d8f57049521948df5f50797141472fbbed3b0723","label":"d8f570495219","date":"2026-09-21T15:05:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98073","title":"net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().","status":"backported","project":false,"upstream":[{"sha":"debac3a20dec524a59625cf10fa2f18571127824","url":"https://git.kernel.org/stable/c/debac3a20dec524a59625cf10fa2f18571127824"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a29ea5b5034654aaaa4aadd771f48c01abfd2dfa","label":"a29ea5b50346","date":"2026-09-21T15:05:17+02:00","lore":["https://lore.kernel.org/all/6a96219e.04428c52.29b18.0001.GAE@google.com/T/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"debac3a20dec524a59625cf10fa2f18571127824","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/debac3a20dec524a59625cf10fa2f18571127824.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98067","title":"erofs: disable LZ4 rolling decompression for now","status":"backported","project":false,"upstream":[{"sha":"82e664cf1219c459c33aae931b222cf951af9cb7","url":"https://git.kernel.org/stable/c/82e664cf1219c459c33aae931b222cf951af9cb7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ec52dfed7b14514ed97ee71161e4cf4cfe2fbff2","label":"ec52dfed7b14","date":"2026-09-21T15:05:18+02:00","lore":["https://lore.kernel.org/r/BEZP281MB2102E57CD31862B8D958B33DD2AC2@BEZP281MB2102.DEUP281.PROD.OUTLOOK.COM"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"82e664cf1219c459c33aae931b222cf951af9cb7","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/82e664cf1219c459c33aae931b222cf951af9cb7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98067","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98067.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98058","title":"bpf: Mark syscall helpers as sleepable","status":"backported","project":false,"upstream":[{"sha":"d05524794240b52fdc3b6c1220dd05505715824d","url":"https://git.kernel.org/stable/c/d05524794240b52fdc3b6c1220dd05505715824d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/65f636322ac402add6046c68e9ece77b9ffd71c9","label":"65f636322ac4","date":"2026-10-15T11:58:12+02:00","lore":["https://lore.kernel.org/r/20260903144433.1716731-10-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d05524794240b52fdc3b6c1220dd05505715824d","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/d05524794240b52fdc3b6c1220dd05505715824d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98058","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98058.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98056","title":"nvme: remove stale namespaces by NSID range during scan","status":"backported","project":false,"upstream":[{"sha":"4ed7f3d7d435bf5b63da2814dc9270f5ba896011","url":"https://git.kernel.org/stable/c/4ed7f3d7d435bf5b63da2814dc9270f5ba896011"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f56b2bb4b18b017b056c4c17c66b2c4c54bf6ee4","label":"f56b2bb4b18b","date":"2026-09-21T15:05:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4ed7f3d7d435bf5b63da2814dc9270f5ba896011","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/4ed7f3d7d435bf5b63da2814dc9270f5ba896011.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98056","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98056.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98049","title":"bpf: zero extend the result of an arena 32-bit cmpxchg","status":"backported","project":false,"upstream":[{"sha":"4814ed6406f3493bd554ad046da5f7fc04833571","url":"https://git.kernel.org/stable/c/4814ed6406f3493bd554ad046da5f7fc04833571"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6bb6ae5ab1beffda51dabf41612f501d07f10fc6","label":"6bb6ae5ab1be","date":"2026-10-15T11:58:12+02:00","lore":["https://lore.kernel.org/r/20260903171542.1438050-1-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-98049","series":"6.18.y","upstream":["4814ed6406f3493bd554ad046da5f7fc04833571"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"The verifier cmpxchg predicate recognizes BPF_ATOMIC but not the arena-rewritten BPF_PROBE_ATOMIC, so the result can skip required zero extension.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n600"},{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n600"},{"label":"Upstream fix 4814ed6406f3","url":"https://git.kernel.org/stable/c/4814ed6406f3493bd554ad046da5f7fc04833571"}]},"size":{"status":"within-limit","patches":[{"sha":"4814ed6406f3493bd554ad046da5f7fc04833571","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/4814ed6406f3493bd554ad046da5f7fc04833571.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98049","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98049.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98044","title":"bpf: Reject legacy packet loads from callbacks","status":"backported","project":false,"upstream":[{"sha":"e7d28823c662128caae63f14e16bd394916c139b","url":"https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3484a99303912db62428494a9061212049027e57","label":"3484a9930391","date":"2026-09-21T15:05:21+02:00","lore":["https://lore.kernel.org/bpf/20260903152147.C0E241F00A3A@smtp.kernel.org","https://lore.kernel.org/r/20260903214758.2727663-8-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"e7d28823c662128caae63f14e16bd394916c139b","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/e7d28823c662128caae63f14e16bd394916c139b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98043","title":"bpf: Don't infer non-NULL from a pointer with an unbounded offset","status":"backported","project":false,"upstream":[{"sha":"67b529f521a6676cdfc78b91b0217d7eaa84216b","url":"https://git.kernel.org/stable/c/67b529f521a6676cdfc78b91b0217d7eaa84216b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/65bea674f43c09c0eda033a140dfac6a2842a19f","label":"65bea674f43c","date":"2026-10-15T11:58:12+02:00","lore":["https://lore.kernel.org/bpf/20260904083325.2083493-1-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"67b529f521a6676cdfc78b91b0217d7eaa84216b","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/67b529f521a6676cdfc78b91b0217d7eaa84216b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98041","title":"bpf: Don't predict JMP32 pointer vs zero comparisons","status":"backported","project":false,"upstream":[{"sha":"e51179a4e09846f8fd0f26a05068520de2b301bf","url":"https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e2ae33247e8b2dbe9d116d3e61cadf6d548339c6","label":"e2ae33247e8b","date":"2026-09-21T15:05:21+02:00","lore":["https://lore.kernel.org/bpf/20260904083325.2083493-5-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e51179a4e09846f8fd0f26a05068520de2b301bf","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/e51179a4e09846f8fd0f26a05068520de2b301bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98041","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98041.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98034","title":"bpf: Mark NULL kptr stores precise","status":"backported","project":false,"upstream":[{"sha":"ecdc5043794c9184aa8e6c814603899479c46b35","url":"https://git.kernel.org/stable/c/ecdc5043794c9184aa8e6c814603899479c46b35"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bb667eb575c906f24c707986541a99424c5b07ea","label":"bb667eb575c9","date":"2026-10-15T11:58:12+02:00","lore":["https://lore.kernel.org/r/20260904104203.345917-6-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ecdc5043794c9184aa8e6c814603899479c46b35","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/ecdc5043794c9184aa8e6c814603899479c46b35.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98034","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98034.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98033","title":"bpf: Preserve inner map identity in callback frames","status":"backported","project":false,"upstream":[{"sha":"b90c5d770dad910fb89e6c1b15052a8a1e8db752","url":"https://git.kernel.org/stable/c/b90c5d770dad910fb89e6c1b15052a8a1e8db752"}],"evidence":[{"url":"https://git.kernel.org/stable/c/08b534bafdd9de65b6374474a8fe719c90eb3b01","label":"08b534bafdd9","date":"2026-10-15T11:58:12+02:00","lore":["https://lore.kernel.org/r/20260904104203.345917-8-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b90c5d770dad910fb89e6c1b15052a8a1e8db752","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/b90c5d770dad910fb89e6c1b15052a8a1e8db752.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98033","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98033.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98026","title":"net: bridge: mcast: properly convert mglist to rcu","status":"backported","project":false,"upstream":[{"sha":"4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","url":"https://git.kernel.org/stable/c/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/38ab2a435001a3c4dbeb70a52f5921e1ccd66f55","label":"38ab2a435001","date":"2026-09-21T15:05:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98021","title":"net: reject oversized tx_queue_len at netlink parse time","status":"backported","project":false,"upstream":[{"sha":"1aa9e143bf51405665a793d4cc925e1c4f0c5922","url":"https://git.kernel.org/stable/c/1aa9e143bf51405665a793d4cc925e1c4f0c5922"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2fd0880f0272ec022906a05587fd91416ebecc38","label":"2fd0880f0272","date":"2026-09-21T15:05:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1aa9e143bf51405665a793d4cc925e1c4f0c5922","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/1aa9e143bf51405665a793d4cc925e1c4f0c5922.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98021","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98021.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98019","title":"bpf: mark a NULL call argument precise","status":"backported","project":false,"upstream":[{"sha":"1a3a10b030c96ea88868ccc060a16827c01eaa5a","url":"https://git.kernel.org/stable/c/1a3a10b030c96ea88868ccc060a16827c01eaa5a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b1fe6379e401b8ce0f561cb4d84af2b70b4343c3","label":"b1fe6379e401","date":"2026-10-15T11:58:12+02:00","lore":["https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-1-0f5a360ff15d@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a3a10b030c96ea88868ccc060a16827c01eaa5a","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/1a3a10b030c96ea88868ccc060a16827c01eaa5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98019","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98019.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98003","title":"iommu/amd: Do not reallocate GA log buffers on resume","status":"backported","project":false,"upstream":[{"sha":"00a7dd64888d6dd72110b40e2824a088cf7b7386","url":"https://git.kernel.org/stable/c/00a7dd64888d6dd72110b40e2824a088cf7b7386"}],"evidence":[{"url":"https://git.kernel.org/stable/c/94458b80d3b203c1c9e2c98aa7319b7713e006c0","label":"94458b80d3b2","date":"2026-09-21T15:05:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00a7dd64888d6dd72110b40e2824a088cf7b7386","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/00a7dd64888d6dd72110b40e2824a088cf7b7386.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98003","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98003.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97997","title":"virtio_ring: fix stale descriptor flags after a failed packed add","status":"backported","project":false,"upstream":[{"sha":"75d276e5bb68778b2916f98a2bc30f142ebadc64","url":"https://git.kernel.org/stable/c/75d276e5bb68778b2916f98a2bc30f142ebadc64"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3e6400e3b8b858cdf0f8d70b20d8b55d703af368","label":"3e6400e3b8b8","date":"2026-10-15T11:58:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75d276e5bb68778b2916f98a2bc30f142ebadc64","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/75d276e5bb68778b2916f98a2bc30f142ebadc64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97997","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97997.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97994","title":"vhost/vdpa: reject VRING_NUM larger than device max","status":"backported","project":false,"upstream":[{"sha":"ccb1dc7c527f8c925925cf92afc76ae590dac311","url":"https://git.kernel.org/stable/c/ccb1dc7c527f8c925925cf92afc76ae590dac311"}],"evidence":[{"url":"https://git.kernel.org/stable/c/68232102f20fc961327fb9e0f605a7eaadf030a9","label":"68232102f20f","date":"2026-09-21T15:05:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ccb1dc7c527f8c925925cf92afc76ae590dac311","lines":81,"reason":"","source":"https://github.com/torvalds/linux/commit/ccb1dc7c527f8c925925cf92afc76ae590dac311.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97994","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97994.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97992","title":"vhost-vdpa: protect config_ctx from being freed under the config callback","status":"backported","project":false,"upstream":[{"sha":"62be4e3e5f5f947fbf765b914cebdc478f715d12","url":"https://git.kernel.org/stable/c/62be4e3e5f5f947fbf765b914cebdc478f715d12"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5a075ee2398929d5cc1393666f219c35332becb1","label":"5a075ee23989","date":"2026-09-21T15:05:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"62be4e3e5f5f947fbf765b914cebdc478f715d12","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/62be4e3e5f5f947fbf765b914cebdc478f715d12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97992","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97992.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97990","title":"vdpa_sim_net: check TX pull result before RX copy","status":"backported","project":false,"upstream":[{"sha":"0d195797a80b77f2ec56718cd26d3ee65d0093e8","url":"https://git.kernel.org/stable/c/0d195797a80b77f2ec56718cd26d3ee65d0093e8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3af20238a09ca180d66623e3bed16b64e9975f39","label":"3af20238a09c","date":"2026-09-21T15:05:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0d195797a80b77f2ec56718cd26d3ee65d0093e8","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/0d195797a80b77f2ec56718cd26d3ee65d0093e8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97989","title":"vduse: validate virtqueue alignment","status":"backported","project":false,"upstream":[{"sha":"fa2c25b4add57888acfa89e398389e267bff3dcf","url":"https://git.kernel.org/stable/c/fa2c25b4add57888acfa89e398389e267bff3dcf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/831dab9b9bcc184adf78f18b5b788316e3174aec","label":"831dab9b9bcc","date":"2026-10-15T11:58:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fa2c25b4add57888acfa89e398389e267bff3dcf","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/fa2c25b4add57888acfa89e398389e267bff3dcf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97988","title":"vhost: invalidate vring access on IOTLB transitions","status":"backported","project":false,"upstream":[{"sha":"e4f4761879a230aa59e569102a6ab9851847d833","url":"https://git.kernel.org/stable/c/e4f4761879a230aa59e569102a6ab9851847d833"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7f8ee0b8f632441aec456a7c147fb43f5c73542d","label":"7f8ee0b8f632","date":"2026-10-15T11:58:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"e4f4761879a230aa59e569102a6ab9851847d833","lines":104,"reason":"","source":"https://github.com/torvalds/linux/commit/e4f4761879a230aa59e569102a6ab9851847d833.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97985","title":"af_unix: Update last skb marker in manage_oob().","status":"backported","project":false,"upstream":[{"sha":"94fd4debd2e3a69cf93e766c8b328a810c228119","url":"https://git.kernel.org/stable/c/94fd4debd2e3a69cf93e766c8b328a810c228119"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f1816b3d7ce80dcf086bb68ff5ae6e09520ca1fa","label":"f1816b3d7ce8","date":"2026-09-21T15:05:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"94fd4debd2e3a69cf93e766c8b328a810c228119","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/94fd4debd2e3a69cf93e766c8b328a810c228119.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97985","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97985.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97984","title":"net: ipv6: Fix UDP length overflow with PMTU discover and big MTU","status":"backported","project":false,"upstream":[{"sha":"0ae10b6be49b425827659b23bcce498f80eb7182","url":"https://git.kernel.org/stable/c/0ae10b6be49b425827659b23bcce498f80eb7182"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ce66352d3eb21825410af8b91db7cc4bb8e22c98","label":"ce66352d3eb2","date":"2026-09-21T15:05:29+02:00","lore":["https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0ae10b6be49b425827659b23bcce498f80eb7182","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0ae10b6be49b425827659b23bcce498f80eb7182.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97984","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97984.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97978","title":"eth: ice: don't dereference pointers from TP_printk()","status":"backported","project":false,"upstream":[{"sha":"b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","url":"https://git.kernel.org/stable/c/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0b0d2f9db2406aa541a8bc3737f4f4aae1cafde9","label":"0b0d2f9db240","date":"2026-09-21T15:05:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","lines":88,"reason":"","source":"https://github.com/torvalds/linux/commit/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97978","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97978.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97975","title":"Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()","status":"backported","project":false,"upstream":[{"sha":"9b851b09b392da68bd715601f10a5adb2d8d19b8","url":"https://git.kernel.org/stable/c/9b851b09b392da68bd715601f10a5adb2d8d19b8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/eeabdb25c3209569367e99a85ca9a503b64a646d","label":"eeabdb25c320","date":"2026-09-21T15:05:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9b851b09b392da68bd715601f10a5adb2d8d19b8","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/9b851b09b392da68bd715601f10a5adb2d8d19b8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97965","title":"vxlan: initialize _md in vxlan_xmit_one()","status":"backported","project":false,"upstream":[{"sha":"be83178bfc44588f6e3adb827ed874c683193466","url":"https://git.kernel.org/stable/c/be83178bfc44588f6e3adb827ed874c683193466"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bfb74c48ac2d31476d5e09cf9658844508d2608a","label":"bfb74c48ac2d","date":"2026-09-21T15:05:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"be83178bfc44588f6e3adb827ed874c683193466","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/be83178bfc44588f6e3adb827ed874c683193466.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97965","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97965.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97953","title":"net: stmmac: fix TX descriptor availability check for TSO traffic","status":"backported","project":false,"upstream":[{"sha":"5e38d732ec67a5b1f9a56e6c73add480c4b6030a","url":"https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c28175220f808c867d5618de8ecc6dbcc815c773","label":"c28175220f80","date":"2026-09-21T15:05:36+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5e38d732ec67a5b1f9a56e6c73add480c4b6030a","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/5e38d732ec67a5b1f9a56e6c73add480c4b6030a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97953","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97953.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97950","title":"configfs: pin the symlink target's dirent instead of chasing ->ci_dentry","status":"backported","project":false,"upstream":[{"sha":"a7c1290eef60711c10289c056ad32ed1f2b47b12","url":"https://git.kernel.org/stable/c/a7c1290eef60711c10289c056ad32ed1f2b47b12"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4f54beb2e7f6d399396466682fba3539bcdcb414","label":"4f54beb2e7f6","date":"2026-09-21T15:05:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a7c1290eef60711c10289c056ad32ed1f2b47b12","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/a7c1290eef60711c10289c056ad32ed1f2b47b12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97950","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97950.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97949","title":"configfs: unhash the dentry before dropping the item in rmdir","status":"backported","project":false,"upstream":[{"sha":"f06c2d26d1999d37e93299db0ecead04ca7d0b9f","url":"https://git.kernel.org/stable/c/f06c2d26d1999d37e93299db0ecead04ca7d0b9f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5d7cbfb65e47cc71d5d94d87d5d0d1679080f3eb","label":"5d7cbfb65e47","date":"2026-09-21T15:06:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f06c2d26d1999d37e93299db0ecead04ca7d0b9f","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/f06c2d26d1999d37e93299db0ecead04ca7d0b9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97938","title":"reboot: fix cad_pid use-after-free race","status":"backported","project":false,"upstream":[{"sha":"5a88f78df753993469dab4d1831f8fb4256a9468","url":"https://git.kernel.org/stable/c/5a88f78df753993469dab4d1831f8fb4256a9468"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ad72e2566643fff7f01666d845fb026898155e1f","label":"ad72e2566643","date":"2026-09-21T15:05:39+02:00","lore":["https://lore.kernel.org/all/20260717210143.4734-1-blbllhy@gmail.com/","https://lore.kernel.org/all/al4ICz9biJKtdZc4@redhat.com/","https://lore.kernel.org/all/alz5ZYLE4kaq_v2P@redhat.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5a88f78df753993469dab4d1831f8fb4256a9468","lines":92,"reason":"","source":"https://github.com/torvalds/linux/commit/5a88f78df753993469dab4d1831f8fb4256a9468.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97933","title":"tracing: Take trace_array reference when opening a tracer options file","status":"backported","project":false,"upstream":[{"sha":"ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","url":"https://git.kernel.org/stable/c/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d9232a90c6f7de822177d35d73d9234cba523ef9","label":"d9232a90c6f7","date":"2026-10-15T11:58:11+02:00","lore":["https://lore.kernel.org/linux-trace-kernel/20260902121918.5a9e9d1b@gandalf.local.home/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97933","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97933.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97929","title":"ALSA: usbusx2y: validate URB actual_length in interrupt callback","status":"backported","project":false,"upstream":[{"sha":"8f5ef203abda9dd36b2af473c7b737d544f807bd","url":"https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d","label":"b0c30fe6c0d5","date":"2026-09-21T15:05:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f5ef203abda9dd36b2af473c7b737d544f807bd","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/8f5ef203abda9dd36b2af473c7b737d544f807bd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97918","title":"tracing: Undo the registration when enabling the histogram trigger fails","status":"backported","project":false,"upstream":[{"sha":"92383cef66791a0c63a2f27755cadbdb2fbf270b","url":"https://git.kernel.org/stable/c/92383cef66791a0c63a2f27755cadbdb2fbf270b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/51b07104d563d4be2be34158d3b9d922ca417642","label":"51b07104d563","date":"2026-09-21T15:06:02+02:00","lore":["https://lore.kernel.org/linux-trace-kernel/20260907092944.3950E1F00A3D@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"92383cef66791a0c63a2f27755cadbdb2fbf270b","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/92383cef66791a0c63a2f27755cadbdb2fbf270b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97906","title":"bootconfig: Fix integer overflow in initrd size check","status":"backported","project":false,"upstream":[{"sha":"7812d6dab0698001e50e8c2f901e17da3eb6f429","url":"https://git.kernel.org/stable/c/7812d6dab0698001e50e8c2f901e17da3eb6f429"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8d4343a411eaa182d323ab5b149496416015f27d","label":"8d4343a411ea","date":"2026-09-21T15:06:00+02:00","lore":["https://lore.kernel.org/all/178905333479.213925.1358412668943562406.stgit@devnote2/","https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7812d6dab0698001e50e8c2f901e17da3eb6f429","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7812d6dab0698001e50e8c2f901e17da3eb6f429.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97619","title":"io_uring/rw: end write accounting from ->ki_complete","status":"backported","project":false,"upstream":[{"sha":"796aa0547557e63338657ed1c487906f9fac4c73","url":"https://git.kernel.org/stable/c/796aa0547557e63338657ed1c487906f9fac4c73"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cc580cee4dfa2ec9099c30ecbd4d804cbb996432","label":"cc580cee4dfa","date":"2026-09-21T15:06:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"796aa0547557e63338657ed1c487906f9fac4c73","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/796aa0547557e63338657ed1c487906f9fac4c73.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97619","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97619.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97600","title":"ieee802154: cc2520: fix FIFOP work use-after-free","status":"backported","project":false,"upstream":[{"sha":"ff5891b266a7fc6a062710836be84f1cc19338b5","url":"https://git.kernel.org/stable/c/ff5891b266a7fc6a062710836be84f1cc19338b5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c68fd52c73b676aee67020011e98fea125a978f4","label":"c68fd52c73b6","date":"2026-09-21T15:05:45+02:00","lore":["https://lore.kernel.org/20260812061714.175966-1-fanwu01@zju.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ff5891b266a7fc6a062710836be84f1cc19338b5","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/ff5891b266a7fc6a062710836be84f1cc19338b5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97600","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97600.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97566","title":"mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0","status":"backported","project":false,"upstream":[{"sha":"2ac7d6e620764f1fc79eb4edd3610a7a661981ca","url":"https://git.kernel.org/stable/c/2ac7d6e620764f1fc79eb4edd3610a7a661981ca"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d4a67a880654e1bfe318a31bea0bdbb026a09ade","label":"d4a67a880654","date":"2026-09-21T15:05:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2ac7d6e620764f1fc79eb4edd3610a7a661981ca","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97566","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97566.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97565","title":"smb: client: reject short READ responses in CIFSSMBRead()","status":"backported","project":false,"upstream":[{"sha":"e6142a8bfc230c7263eb8b0475249c958ce49367","url":"https://git.kernel.org/stable/c/e6142a8bfc230c7263eb8b0475249c958ce49367"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0f1f77b821506a4dacab6ce7d29cf9e0c26f14cd","label":"0f1f77b82150","date":"2026-09-21T15:05:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e6142a8bfc230c7263eb8b0475249c958ce49367","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/e6142a8bfc230c7263eb8b0475249c958ce49367.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97565","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97565.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97563","title":"smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()","status":"unfixed","project":false,"upstream":[{"sha":"5be5bdda5863eacc964b609ba927764f253431b3","url":"https://git.kernel.org/stable/c/5be5bdda5863eacc964b609ba927764f253431b3"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5be5bdda5863eacc964b609ba927764f253431b3","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/5be5bdda5863eacc964b609ba927764f253431b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97563","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97563.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97562","title":"smb: client: pin DFS superblock in iterator callback","status":"backported","project":false,"upstream":[{"sha":"d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","url":"https://git.kernel.org/stable/c/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a6b6561522212af852c9ad8a7dca8d59ef2c7377","label":"a6b656152221","date":"2026-09-21T15:05:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97562","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97562.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97538","title":"hwmon: (asus_rog_ryujin) Validate HID report lengths","status":"unfixed","project":false,"upstream":[{"sha":"8042312e73c50de82634ce63eae7cf219464b481","url":"https://git.kernel.org/stable/c/8042312e73c50de82634ce63eae7cf219464b481"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"8042312e73c50de82634ce63eae7cf219464b481","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/8042312e73c50de82634ce63eae7cf219464b481.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97526","title":"s390/pai: Support CPU hotplug for PMU PAI","status":"unfixed","project":false,"upstream":[{"sha":"9ecc4d033879f7761f2df07e20cd2fbec00fd90b","url":"https://git.kernel.org/stable/c/9ecc4d033879f7761f2df07e20cd2fbec00fd90b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"9ecc4d033879f7761f2df07e20cd2fbec00fd90b","lines":292,"reason":"","source":"https://github.com/torvalds/linux/commit/9ecc4d033879f7761f2df07e20cd2fbec00fd90b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97526","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97526.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97515","title":"i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845","status":"backported","project":false,"upstream":[{"sha":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","url":"https://git.kernel.org/stable/c/1effa3adfe53cb2bb28bf5640a676b791d5ab405"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e9b139c4684ed8593a0b779ca02ea05f460b2eec","label":"e9b139c4684e","date":"2026-09-21T15:04:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/1effa3adfe53cb2bb28bf5640a676b791d5ab405.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97515","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97515.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97499","title":"coresight: perf: Retrieve path and source from event data","status":"backported","project":false,"upstream":[{"sha":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","url":"https://git.kernel.org/stable/c/f37bc31447c0ddafedb25e3c4a4f4e2284034247"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0f4cb08f30011b7625a4fba668fa5c36da5e6637","label":"0f4cb08f3001","date":"2026-09-21T15:04:19+02:00","lore":["https://lore.kernel.org/r/20260515-arm_coresight_path_power_management_improvement-v14-7-f88c4a3ecfe9@arm.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","lines":229,"reason":"","source":"https://github.com/torvalds/linux/commit/f37bc31447c0ddafedb25e3c4a4f4e2284034247.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97496","title":"drm/amdkfd: Fix OOB memory exposure in get_wave_state()","status":"backported","project":false,"upstream":[{"sha":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","url":"https://git.kernel.org/stable/c/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ec646686613d8ab05b282d1463a7baa49fd6b83b","label":"ec646686613d","date":"2026-09-21T15:04:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97496","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97496.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97424","title":"drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq","status":"backported","project":false,"upstream":[{"sha":"e3829992dd9fa0a82511af4f01733fc854cd15a5","url":"https://git.kernel.org/stable/c/e3829992dd9fa0a82511af4f01733fc854cd15a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/001824103f2fe6ffd2380afddf81f43b446035b2","label":"001824103f2f","date":"2026-09-21T15:04:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"e3829992dd9fa0a82511af4f01733fc854cd15a5","lines":131,"reason":"","source":"https://github.com/torvalds/linux/commit/e3829992dd9fa0a82511af4f01733fc854cd15a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93799","title":"wifi: iwlwifi: mvm: validate sta_id in BA window status notif","status":"backported","project":false,"upstream":[{"sha":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","url":"https://git.kernel.org/stable/c/6aa77efaea9efea92e3090c35ad348fd759a3cf3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e35ae757c6462bfd3437bf58121bb721fe1f790c","label":"e35ae757c646","date":"2026-09-21T15:04:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/6aa77efaea9efea92e3090c35ad348fd759a3cf3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93796","title":"wifi: iwlwifi: pcie: null RX pointers after free","status":"backported","project":false,"upstream":[{"sha":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","url":"https://git.kernel.org/stable/c/2c79d7a7b583050c9f58041465cb46fe3483ab5d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3456c5bcc987aeb182e50e30c9b02be8420e9953","label":"3456c5bcc987","date":"2026-09-21T15:04:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93796","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93796.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93276","title":"phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator","status":"backported","project":false,"upstream":[{"sha":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","url":"https://git.kernel.org/stable/c/49c9b71b45081e5e5eeb507a2d6edb80d332dc59"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bf7fefbc26e292c08cfe7b6496b879109ef1475a","label":"bf7fefbc26e2","date":"2026-09-14T13:35:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/49c9b71b45081e5e5eeb507a2d6edb80d332dc59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93276","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93276.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93270","title":"bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn","status":"unfixed","project":false,"upstream":[{"sha":"7a0855e73757ee9cf25ba635a1c735018ecba742","url":"https://git.kernel.org/stable/c/7a0855e73757ee9cf25ba635a1c735018ecba742"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7a0855e73757ee9cf25ba635a1c735018ecba742","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/7a0855e73757ee9cf25ba635a1c735018ecba742.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93270","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93270.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93244","title":"drm/sysfb: simpledrm: Improve stride validation","status":"backported","project":false,"upstream":[{"sha":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","url":"https://git.kernel.org/stable/c/df6533f11688aa30be3bb883c7637f4ffdbb7cbd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6892f0a2f6b5990b9572ba043dd14dd4df6bb3f0","label":"6892f0a2f6b5","date":"2026-09-11T11:49:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93244","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93244.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93238","title":"s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap","status":"backported","project":false,"upstream":[{"sha":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","url":"https://git.kernel.org/stable/c/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6d554f2571e6b4db242593ba561efd6a6d1f99a9","label":"6d554f2571e6","date":"2026-09-11T11:49:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93238","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93238.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93237","title":"LoongArch: Add DIRECT_MAP_PHYSMEM_END definition","status":"backported","project":false,"upstream":[{"sha":"2677f97a67fdbc62a82ce1faa67791f54451d36f","url":"https://git.kernel.org/stable/c/2677f97a67fdbc62a82ce1faa67791f54451d36f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ab275a23b4d9f04ca6c2f5f6a3246194e045a761","label":"ab275a23b4d9","date":"2026-09-11T11:49:23+02:00","lore":["https://lore.kernel.org/amd-gfx/20250814032153.227285-1-jeffbai@aosc.io/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2677f97a67fdbc62a82ce1faa67791f54451d36f","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/2677f97a67fdbc62a82ce1faa67791f54451d36f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93235","title":"f2fs: fix to zero post-EOF data when extending file size","status":"backported","project":false,"upstream":[{"sha":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","url":"https://git.kernel.org/stable/c/5eced87b7d19dbc76ebdddaf322046f9ac582fcb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/91ec55ddc097ccddd25ffb95a3d079b2ef362372","label":"91ec55ddc097","date":"2026-09-11T11:49:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/5eced87b7d19dbc76ebdddaf322046f9ac582fcb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93235","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93235.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93221","title":"nfsd: convert nfsd_net boolean flags to unsigned long flags word","status":"backported","project":false,"upstream":[{"sha":"11a5fe42e1811f793e04ef885b639ea7668f439d","url":"https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/40bab0da844c142431a6b1cc21b4cf53491dac44","label":"40bab0da844c","date":"2026-10-15T11:58:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"11a5fe42e1811f793e04ef885b639ea7668f439d","lines":276,"reason":"","source":"https://github.com/torvalds/linux/commit/11a5fe42e1811f793e04ef885b639ea7668f439d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93221","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93221.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93216","title":"mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()","status":"unfixed","project":false,"upstream":[{"sha":"90f095b816e25c6a9e4446d299bac5007fdcb3df","url":"https://git.kernel.org/stable/c/90f095b816e25c6a9e4446d299bac5007fdcb3df"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"90f095b816e25c6a9e4446d299bac5007fdcb3df","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/90f095b816e25c6a9e4446d299bac5007fdcb3df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93216","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93216.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93184","title":"ASoC: fsl_audmix: rework runtime PM handling in probe","status":"backported","project":false,"upstream":[{"sha":"3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71","url":"https://git.kernel.org/stable/c/3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e921cc73fae68ccee932ad0a4fb11d637557db0e","label":"e921cc73fae6","date":"2026-09-14T13:34:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71","lines":59,"reason":"","source":"https://github.com/torvalds/linux/commit/3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93184","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93184.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93181","title":"perf/x86/intel/uncore: Fix uncore_box ref/unref ordering","status":"unfixed","project":false,"upstream":[{"sha":"174f0582e38abe03b88e15f04bfe58490f88cb19","url":"https://git.kernel.org/stable/c/174f0582e38abe03b88e15f04bfe58490f88cb19"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"174f0582e38abe03b88e15f04bfe58490f88cb19","lines":108,"reason":"","source":"https://github.com/torvalds/linux/commit/174f0582e38abe03b88e15f04bfe58490f88cb19.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93181","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93181.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93155","title":"crypto: keembay - Fix AEAD unregister count in error path","status":"backported","project":false,"upstream":[{"sha":"e264401ce4776a288524e5b87593d4d864147115","url":"https://git.kernel.org/stable/c/e264401ce4776a288524e5b87593d4d864147115"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5bbb726d27ff6dff750264e51aa665538394d0f8","label":"5bbb726d27ff","date":"2026-09-14T13:34:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e264401ce4776a288524e5b87593d4d864147115","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93155","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93155.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93154","title":"RDMA/irdma: Add refcounting to user ring MRs","status":"backported","project":false,"upstream":[{"sha":"f67d8a08f60c9217df6d40da56422d2049f5e334","url":"https://git.kernel.org/stable/c/f67d8a08f60c9217df6d40da56422d2049f5e334"}],"evidence":[{"url":"https://git.kernel.org/stable/c/07974c267f603a76aead348bca97deee95efdcc9","label":"07974c267f60","date":"2026-09-14T13:34:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"f67d8a08f60c9217df6d40da56422d2049f5e334","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/f67d8a08f60c9217df6d40da56422d2049f5e334.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93154","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93154.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93135","title":"bpf: Reject programs with inlined helpers if JIT is not available","status":"unfixed","project":false,"upstream":[{"sha":"f1c27922576edccb99d0257827d09bd05c0304a6","url":"https://git.kernel.org/stable/c/f1c27922576edccb99d0257827d09bd05c0304a6"}],"evidence":[],"submission_lore":[],"basis":"bpf_do_misc_fixups skips helper rewriting for architectures that inline helpers but does not set jit_required, allowing interpreter fallback with unpatched helper IDs.","review":{"id":"CVE-2026-93135","series":"6.18.y","upstream":["f1c27922576edccb99d0257827d09bd05c0304a6"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"bpf_do_misc_fixups skips helper rewriting for architectures that inline helpers but does not set jit_required, allowing interpreter fallback with unpatched helper IDs.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n22572"},{"label":"Upstream fix f1c27922576e","url":"https://git.kernel.org/stable/c/f1c27922576edccb99d0257827d09bd05c0304a6"}]},"size":{"status":"within-limit","patches":[{"sha":"f1c27922576edccb99d0257827d09bd05c0304a6","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/f1c27922576edccb99d0257827d09bd05c0304a6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93135","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93135.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93123","title":"serial: qcom-geni: do not advance stale DMA completions","status":"backported","project":false,"upstream":[{"sha":"7ea38c49e7178960926657863299face6dc0e1b0","url":"https://git.kernel.org/stable/c/7ea38c49e7178960926657863299face6dc0e1b0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c02d030747c46da33faf406dd772ef91100efa27","label":"c02d030747c4","date":"2026-09-14T13:34:36+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7ea38c49e7178960926657863299face6dc0e1b0","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/7ea38c49e7178960926657863299face6dc0e1b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93100","title":"fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()","status":"backported","project":false,"upstream":[{"sha":"f5bcf539484d2d604c2f2330e09487ea090b21c7","url":"https://git.kernel.org/stable/c/f5bcf539484d2d604c2f2330e09487ea090b21c7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ae69f936e8ffed553d899ba4c02f8a7461a89e54","label":"ae69f936e8ff","date":"2026-09-14T13:34:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"f5bcf539484d2d604c2f2330e09487ea090b21c7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93100","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93100.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93099","title":"fs/resctrl: Fix UAF from worker threads when domains are removed","status":"backported","project":false,"upstream":[{"sha":"2566b5cd6a275c124e8f154fef6e815f92ec8d5c","url":"https://git.kernel.org/stable/c/2566b5cd6a275c124e8f154fef6e815f92ec8d5c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6a2e023429a41afd0d9dfe74268aa51774a953ff","label":"6a2e023429a4","date":"2026-10-15T11:58:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2566b5cd6a275c124e8f154fef6e815f92ec8d5c","lines":199,"reason":"","source":"https://github.com/torvalds/linux/commit/2566b5cd6a275c124e8f154fef6e815f92ec8d5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93099","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93099.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93093","title":"firmware: arm_scmi: Publish channel state before callbacks","status":"backported","project":false,"upstream":[{"sha":"0314900dcdde044af0208fed212035dbfaa55843","url":"https://git.kernel.org/stable/c/0314900dcdde044af0208fed212035dbfaa55843"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1bea027f7ef6fb889628b16c568a5f7c07a51b30","label":"1bea027f7ef6","date":"2026-09-14T13:34:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0314900dcdde044af0208fed212035dbfaa55843","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93093","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93093.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93091","title":"firmware: arm_scmi: Quiesce notifications before teardown","status":"backported","project":false,"upstream":[{"sha":"8e49055d0d495c9c07575ad8e111d9eaf0efb13f","url":"https://git.kernel.org/stable/c/8e49055d0d495c9c07575ad8e111d9eaf0efb13f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2aac23bc0a79af41104d99823bb250fae92ba144","label":"2aac23bc0a79","date":"2026-09-14T13:34:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8e49055d0d495c9c07575ad8e111d9eaf0efb13f","lines":86,"reason":"","source":"https://github.com/torvalds/linux/commit/8e49055d0d495c9c07575ad8e111d9eaf0efb13f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93091","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93091.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93083","title":"firmware: arm_scmi: Unwind TX receiver mailbox setup failure","status":"backported","project":false,"upstream":[{"sha":"6f7c06744d53dc8e047725d411d7f915d9ec35ae","url":"https://git.kernel.org/stable/c/6f7c06744d53dc8e047725d411d7f915d9ec35ae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/717b8e972a667fc1bebe63cbcf0d58e692cbb491","label":"717b8e972a66","date":"2026-09-14T13:34:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f7c06744d53dc8e047725d411d7f915d9ec35ae","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/6f7c06744d53dc8e047725d411d7f915d9ec35ae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93083","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93083.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93072","title":"irqchip/renesas-irqc: Fix generic interrupt chip leak on remove","status":"backported","project":false,"upstream":[{"sha":"616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba","url":"https://git.kernel.org/stable/c/616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9acc996cb2e8477ae81bd7c067fec15202d6bc89","label":"9acc996cb2e8","date":"2026-09-14T13:34:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93072","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93072.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93047","title":"drm/v3d: Associate BOs with every job that accesses them","status":"unfixed","project":false,"upstream":[{"sha":"fa98563ab00dbe62fcedfef6bdd34ded7a860d9f","url":"https://git.kernel.org/stable/c/fa98563ab00dbe62fcedfef6bdd34ded7a860d9f"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"fa98563ab00dbe62fcedfef6bdd34ded7a860d9f","lines":175,"reason":"","source":"https://github.com/torvalds/linux/commit/fa98563ab00dbe62fcedfef6bdd34ded7a860d9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93047","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93047.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93044","title":"bpf: Disallow interpreter fallback for arena-related insns","status":"unfixed","project":false,"upstream":[{"sha":"34746b5a84ec37c0ea2bf6808c65c5ed8790eb51","url":"https://git.kernel.org/stable/c/34746b5a84ec37c0ea2bf6808c65c5ed8790eb51"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"34746b5a84ec37c0ea2bf6808c65c5ed8790eb51","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/34746b5a84ec37c0ea2bf6808c65c5ed8790eb51.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92518","title":"riscv, bpf: Fix kernel stack corruption in tailcall with CFI","status":"backported","project":false,"upstream":[{"sha":"52fb1756ea1d2759dfef2d86245be00b05dac3a2","url":"https://git.kernel.org/stable/c/52fb1756ea1d2759dfef2d86245be00b05dac3a2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/34b1bb33a025787e05f966e74de18cd36276f801","label":"34b1bb33a025","date":"2026-09-14T13:34:55+02:00","lore":["https://lore.kernel.org/bpf/20260708064436.2971933-5-pulehui@huaweicloud.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"52fb1756ea1d2759dfef2d86245be00b05dac3a2","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/52fb1756ea1d2759dfef2d86245be00b05dac3a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92518","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92518.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92500","title":"ext4: use fsdata to track inline data write state and fix race","status":"backported","project":false,"upstream":[{"sha":"7edbb323bab2b2a609016014caafdb651c898249","url":"https://git.kernel.org/stable/c/7edbb323bab2b2a609016014caafdb651c898249"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bd8d74bd46d09905164255b8635fa58b45f41068","label":"bd8d74bd46d0","date":"2026-09-14T13:35:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7edbb323bab2b2a609016014caafdb651c898249","lines":95,"reason":"","source":"https://github.com/torvalds/linux/commit/7edbb323bab2b2a609016014caafdb651c898249.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92500","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92500.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92499","title":"ext4: validate readdir offset before accessing dirent","status":"backported","project":false,"upstream":[{"sha":"bc4b7b0414c33b2c8898eb04386df0d21a13dad8","url":"https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/64d445d40e5ea4c4d4d88880db753b370cb69161","label":"64d445d40e5e","date":"2026-09-14T13:35:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bc4b7b0414c33b2c8898eb04386df0d21a13dad8","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/bc4b7b0414c33b2c8898eb04386df0d21a13dad8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92493","title":"cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active","status":"backported","project":false,"upstream":[{"sha":"8d31bb1451643f328db0cea0e21e63ef54b4faf2","url":"https://git.kernel.org/stable/c/8d31bb1451643f328db0cea0e21e63ef54b4faf2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/baf5a7fd3f3e2f4297b42b249f4f4f63214f44c0","label":"baf5a7fd3f3e","date":"2026-09-14T13:35:05+02:00","lore":["https://lore.kernel.org/r/1784191899-28957-1-git-send-email-pengqh1@chinatelecom.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8d31bb1451643f328db0cea0e21e63ef54b4faf2","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/8d31bb1451643f328db0cea0e21e63ef54b4faf2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90401","title":"md: remove REQ_NOWAIT support from raid1/10/456","status":"backported","project":false,"upstream":[{"sha":"3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","url":"https://git.kernel.org/stable/c/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ffcc9ea4e4d121c78aef6654a1577aa7d120774d","label":"ffcc9ea4e4d1","date":"2026-10-15T11:58:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","lines":588,"reason":"","source":"https://github.com/torvalds/linux/commit/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90401","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90401.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90397","title":"firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published","status":"backported","project":false,"upstream":[{"sha":"966d23c7e68ea32679275a7e3d2383181002c868","url":"https://git.kernel.org/stable/c/966d23c7e68ea32679275a7e3d2383181002c868"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1d753df5899ec356272d08bc4718e82844e4bdf0","label":"1d753df5899e","date":"2026-09-14T13:35:15+02:00","lore":["https://lore.kernel.org/r/20260724094939.613844-2-mukesh.ojha@oss.qualcomm.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"966d23c7e68ea32679275a7e3d2383181002c868","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/966d23c7e68ea32679275a7e3d2383181002c868.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90397","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90397.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90389","title":"md: scope memalloc_noio to allocation critical sections","status":"backported","project":false,"upstream":[{"sha":"bace2010dd7ac07bc980575afb135c406730a7fe","url":"https://git.kernel.org/stable/c/bace2010dd7ac07bc980575afb135c406730a7fe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/28fdea874f68cac6c36651b1fc7272fd2199c48d","label":"28fdea874f68","date":"2026-09-14T13:35:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"bace2010dd7ac07bc980575afb135c406730a7fe","lines":306,"reason":"","source":"https://github.com/torvalds/linux/commit/bace2010dd7ac07bc980575afb135c406730a7fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90389","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90389.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90379","title":"wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash","status":"backported","project":false,"upstream":[{"sha":"915672c5ae32deeb72f4572856d123f314791136","url":"https://git.kernel.org/stable/c/915672c5ae32deeb72f4572856d123f314791136"}],"evidence":[{"url":"https://git.kernel.org/stable/c/670b3dc4e3713542a9f002d38fb9d1740b9e342b","label":"670b3dc4e371","date":"2026-09-14T13:35:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"915672c5ae32deeb72f4572856d123f314791136","lines":227,"reason":"","source":"https://github.com/torvalds/linux/commit/915672c5ae32deeb72f4572856d123f314791136.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90379","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90379.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90375","title":"wifi: mt76: fix non-AQL packet accounting for MLO stations","status":"backported","project":false,"upstream":[{"sha":"8ae659743ba936b22ecb4620815887728e2820d6","url":"https://git.kernel.org/stable/c/8ae659743ba936b22ecb4620815887728e2820d6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fc7fae55255ccbde009232e84b102d2782a69ecf","label":"fc7fae55255c","date":"2026-09-14T13:35:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8ae659743ba936b22ecb4620815887728e2820d6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90375","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90375.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90373","title":"wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear","status":"backported","project":false,"upstream":[{"sha":"6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba","url":"https://git.kernel.org/stable/c/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b4a41a47a67c788e6b0625fa517ec8872e99bb6c","label":"b4a41a47a67c","date":"2026-09-14T13:35:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90373","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90373.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90359","title":"bpf: Reject >8 byte return values on return-reading trampoline paths","status":"backported","project":false,"upstream":[{"sha":"c48796aa6c392cde93946e5d5a9a1f1b1cf72feb","url":"https://git.kernel.org/stable/c/c48796aa6c392cde93946e5d5a9a1f1b1cf72feb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9a9e902bd0556052534641f7d5f868c6dc4b84ae","label":"9a9e902bd055","date":"2026-10-15T11:58:08+02:00","lore":["https://lore.kernel.org/bpf/20260729050159.2585809-1-yonghong.song@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c48796aa6c392cde93946e5d5a9a1f1b1cf72feb","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/c48796aa6c392cde93946e5d5a9a1f1b1cf72feb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90359","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90359.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90333","title":"dm-integrity: replace forgeable discard filler with a keyed sector marker","status":"backported","project":false,"upstream":[{"sha":"68c5c42567bc462139128968ebbfadd0aefff519","url":"https://git.kernel.org/stable/c/68c5c42567bc462139128968ebbfadd0aefff519"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5c58ea19a909ef6bed4f0f824e9cd7e30d7e4775","label":"5c58ea19a909","date":"2026-09-14T13:35:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"68c5c42567bc462139128968ebbfadd0aefff519","lines":357,"reason":"","source":"https://github.com/torvalds/linux/commit/68c5c42567bc462139128968ebbfadd0aefff519.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90321","title":"ocfs2: validate inline xattrs during inode block validation","status":"unfixed","project":false,"upstream":[{"sha":"8914a3330b72378136c2c02d6328a826f6abdad7","url":"https://git.kernel.org/stable/c/8914a3330b72378136c2c02d6328a826f6abdad7"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"8914a3330b72378136c2c02d6328a826f6abdad7","lines":164,"reason":"","source":"https://github.com/torvalds/linux/commit/8914a3330b72378136c2c02d6328a826f6abdad7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90321","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90321.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90320","title":"ocfs2: validate external xattr entries when reading metadata","status":"unfixed","project":false,"upstream":[{"sha":"2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6","url":"https://git.kernel.org/stable/c/2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6","lines":121,"reason":"","source":"https://github.com/torvalds/linux/commit/2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90320","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90320.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90317","title":"bpf: Invalidate RCU pointers after final spin unlock","status":"backported","project":false,"upstream":[{"sha":"180c7000712db77063b3a26f4c97e7dd9038f449","url":"https://git.kernel.org/stable/c/180c7000712db77063b3a26f4c97e7dd9038f449"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f81972b235f3ebfa40bdce8bcfee3f242fb24065","label":"f81972b235f3","date":"2026-10-15T11:58:07+02:00","lore":["https://lore.kernel.org/bpf/20260803112615.3362122-2-dingning04@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"180c7000712db77063b3a26f4c97e7dd9038f449","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/180c7000712db77063b3a26f4c97e7dd9038f449.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90315","title":"PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers","status":"backported","project":false,"upstream":[{"sha":"747b9bbbbdfdee51aee2456388f9b94b5086de4d","url":"https://git.kernel.org/stable/c/747b9bbbbdfdee51aee2456388f9b94b5086de4d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3556caa31a2bfbc22c11b812fd4ed8851c2d7bff","label":"3556caa31a2b","date":"2026-10-15T11:58:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"747b9bbbbdfdee51aee2456388f9b94b5086de4d","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/747b9bbbbdfdee51aee2456388f9b94b5086de4d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90306","title":"ARM: 9481/2: breakpoint: CFI breakpoints only on demand","status":"backported","project":false,"upstream":[{"sha":"8ed9bff906cf8036531d1559f10e82733a52b41f","url":"https://git.kernel.org/stable/c/8ed9bff906cf8036531d1559f10e82733a52b41f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/314f1a6762b5d51b37784ed7dc701d4c3d893703","label":"314f1a6762b5","date":"2026-09-14T13:35:36+02:00","lore":["https://lore.kernel.org/lkml/kJqktbpLphg_Pk5I5SPptgTLjl3E3eq5mN5UzCslyFj7Q1Irp-wDid4mj5eQVd2iZtRGXgeZd8goq195EkXdjyt864YMc8mVb2B9NGH91NQ=@protonmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ed9bff906cf8036531d1559f10e82733a52b41f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8ed9bff906cf8036531d1559f10e82733a52b41f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90306","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90306.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90265","title":"btrfs: defrag: fix deadlock between defrag and delalloc space reservation","status":"backported","project":false,"upstream":[{"sha":"ba02eab28041f9a4bbe9fc90c7249644fef6de0f","url":"https://git.kernel.org/stable/c/ba02eab28041f9a4bbe9fc90c7249644fef6de0f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a9701dd06e82c345fe70debdf8835b7eb5000c59","label":"a9701dd06e82","date":"2026-09-14T13:35:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ba02eab28041f9a4bbe9fc90c7249644fef6de0f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90265","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90265.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90261","title":"btrfs: zoned: flush active metadata block group at btree_writepages() start","status":"backported","project":false,"upstream":[{"sha":"ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b","url":"https://git.kernel.org/stable/c/ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/58b0ab0340ce04a057169d42cbacbf786063813d","label":"58b0ab0340ce","date":"2026-10-15T11:58:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b","lines":132,"reason":"","source":"https://github.com/torvalds/linux/commit/ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90261","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90261.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90256","title":"Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind","status":"unfixed","project":false,"upstream":[{"sha":"2b66c83ff1751d6bd3201b3017206262ab46dc05","url":"https://git.kernel.org/stable/c/2b66c83ff1751d6bd3201b3017206262ab46dc05"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b66c83ff1751d6bd3201b3017206262ab46dc05","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/2b66c83ff1751d6bd3201b3017206262ab46dc05.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90256","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90256.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90237","title":"netfilter: nft_ct: move custom expectation support to helper","status":"unfixed","project":false,"upstream":[{"sha":"3679da4ad8be84cddaf40bc307fef1fe13e051ff","url":"https://git.kernel.org/stable/c/3679da4ad8be84cddaf40bc307fef1fe13e051ff"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3679da4ad8be84cddaf40bc307fef1fe13e051ff","lines":260,"reason":"","source":"https://github.com/torvalds/linux/commit/3679da4ad8be84cddaf40bc307fef1fe13e051ff.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90230","title":"nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()","status":"backported","project":false,"upstream":[{"sha":"5bb96cc218835769ab74ec7f3ea2bf81fbffe955","url":"https://git.kernel.org/stable/c/5bb96cc218835769ab74ec7f3ea2bf81fbffe955"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c38a8186326799957d293d370136c128cd113916","label":"c38a81863267","date":"2026-09-14T13:35:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5bb96cc218835769ab74ec7f3ea2bf81fbffe955","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/5bb96cc218835769ab74ec7f3ea2bf81fbffe955.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90230","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90230.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90227","title":"nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()","status":"backported","project":false,"upstream":[{"sha":"b53d495c7f0db46b6748b5ade48371a10dd5d3bc","url":"https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/736b7c6adc7a65c4411beff197b6a634f7a6ca27","label":"736b7c6adc7a","date":"2026-09-14T13:35:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b53d495c7f0db46b6748b5ade48371a10dd5d3bc","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/b53d495c7f0db46b6748b5ade48371a10dd5d3bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90227","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90227.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90220","title":"ALSA: seq: Don't leak the extension cell pointer in the bounce payload","status":"backported","project":false,"upstream":[{"sha":"59e1592d3c270ff4642d5d6dc55c545306eb0693","url":"https://git.kernel.org/stable/c/59e1592d3c270ff4642d5d6dc55c545306eb0693"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b1e8d40663997aacaa198f37ce6893e07aaba77a","label":"b1e8d4066399","date":"2026-09-14T13:35:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"59e1592d3c270ff4642d5d6dc55c545306eb0693","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/59e1592d3c270ff4642d5d6dc55c545306eb0693.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90220","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90220.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90217","title":"bpf: Compare iterator types during state pruning","status":"backported","project":false,"upstream":[{"sha":"83608e303b95d07afba1c15da0b5d9e513c2f15a","url":"https://git.kernel.org/stable/c/83608e303b95d07afba1c15da0b5d9e513c2f15a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e4ab436d5ba61e4910fd49d24bb64ddb34d493d6","label":"e4ab436d5ba6","date":"2026-10-15T11:58:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-90217","series":"6.18.y","upstream":["83608e303b95d07afba1c15da0b5d9e513c2f15a"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"BPF iterator state pruning compares BTF/ID/state but omits pointer type, allowing distinct iterator pointer types to be treated equivalent.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/bpf/verifier.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/bpf/verifier.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n19394"},{"label":"Upstream fix 83608e303b95","url":"https://git.kernel.org/stable/c/83608e303b95d07afba1c15da0b5d9e513c2f15a"}]},"size":{"status":"within-limit","patches":[{"sha":"83608e303b95d07afba1c15da0b5d9e513c2f15a","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/83608e303b95d07afba1c15da0b5d9e513c2f15a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90211","title":"bpf, s390: Clear fetch destination on faulting arena atomic","status":"unfixed","project":false,"upstream":[{"sha":"cc3e12330599f097f0e1f792435686ddc276f26d","url":"https://git.kernel.org/stable/c/cc3e12330599f097f0e1f792435686ddc276f26d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cc3e12330599f097f0e1f792435686ddc276f26d","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/cc3e12330599f097f0e1f792435686ddc276f26d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90199","title":"fs/ntfs3: reject out-of-range evcn in mi_enum_attr()","status":"backported","project":false,"upstream":[{"sha":"20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3","url":"https://git.kernel.org/stable/c/20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ce9a619c432b9a4044fee115c5483fbed946c131","label":"ce9a619c432b","date":"2026-09-14T13:35:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90199","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90199.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90154","title":"ksmbd: scope session state changes to bound connections","status":"backported","project":false,"upstream":[{"sha":"c50e628122aed077695669e25b842e778511a43d","url":"https://git.kernel.org/stable/c/c50e628122aed077695669e25b842e778511a43d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1ff0e41afbe73240a7d7b96d4e8e86d0aaf0fe0b","label":"1ff0e41afbe7","date":"2026-10-15T11:58:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c50e628122aed077695669e25b842e778511a43d","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/c50e628122aed077695669e25b842e778511a43d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90154","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90154.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90129","title":"virtio_balloon: quiesce balloon work before device shutdown","status":"backported","project":false,"upstream":[{"sha":"7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","url":"https://git.kernel.org/stable/c/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6dd28e32f4d81a0d57c732b9900de24184e60a7d","label":"6dd28e32f4d8","date":"2026-09-14T13:36:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90119","title":"ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup","status":"backported","project":false,"upstream":[{"sha":"d736eba9c453fedce664fdf592c8b71ecff1932b","url":"https://git.kernel.org/stable/c/d736eba9c453fedce664fdf592c8b71ecff1932b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b15782627b6562f7b6d628f4699316f26340f835","label":"b15782627b65","date":"2026-09-14T13:36:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d736eba9c453fedce664fdf592c8b71ecff1932b","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/d736eba9c453fedce664fdf592c8b71ecff1932b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90119","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90119.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90098","title":"net: sparx5: fix sleep in atomic context in MAC table access","status":"unfixed","project":false,"upstream":[{"sha":"b62793a7baeea9cf20209c9fd2e333311aaf3b8d","url":"https://git.kernel.org/stable/c/b62793a7baeea9cf20209c9fd2e333311aaf3b8d"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b62793a7baeea9cf20209c9fd2e333311aaf3b8d","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/b62793a7baeea9cf20209c9fd2e333311aaf3b8d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90098","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90098.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90060","title":"ALSA: control: Don't add invalid kcontrols to LED layer","status":"backported","project":false,"upstream":[{"sha":"74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11","url":"https://git.kernel.org/stable/c/74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2f0c97b1a32fba8e81a69f6231aa0b3c9b6bc581","label":"2f0c97b1a32f","date":"2026-09-14T13:36:14+02:00","lore":["https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90060","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90060.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90040","title":"KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped","status":"backported","project":false,"upstream":[{"sha":"d1a3c216233413f57f5341a9b878b7e2dde7e785","url":"https://git.kernel.org/stable/c/d1a3c216233413f57f5341a9b878b7e2dde7e785"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ef4dee4640c6adc3051401399b0788135e77d50b","label":"ef4dee4640c6","date":"2026-10-15T11:58:03+02:00","lore":["https://lore.kernel.org/all/aimMWzAf5b3luM0b@v4bel"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d1a3c216233413f57f5341a9b878b7e2dde7e785","lines":242,"reason":"","source":"https://github.com/torvalds/linux/commit/d1a3c216233413f57f5341a9b878b7e2dde7e785.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90040","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90040.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90036","title":"NFSD: Prevent client use-after-free during blocked-lock reaping","status":"backported","project":false,"upstream":[{"sha":"9026932ac8be4d0ae01db47f23619a98cc57b671","url":"https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cd489b03587378645fe0d20142a33f1ed60bac98","label":"cd489b035873","date":"2026-09-11T11:49:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9026932ac8be4d0ae01db47f23619a98cc57b671","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/9026932ac8be4d0ae01db47f23619a98cc57b671.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90036","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90036.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90027","title":"usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop","status":"backported","project":false,"upstream":[{"sha":"263f7d61a4201cde16849b2d016251806e7418be","url":"https://git.kernel.org/stable/c/263f7d61a4201cde16849b2d016251806e7418be"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c614d7c44ca7fb78867ba46b233acdb59287e8c8","label":"c614d7c44ca7","date":"2026-09-11T11:49:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"263f7d61a4201cde16849b2d016251806e7418be","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/263f7d61a4201cde16849b2d016251806e7418be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90027","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90027.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89944","title":"ASoC: hdac_hda: Fix hlink refcount leak on component registration failure","status":"backported","project":false,"upstream":[{"sha":"6ad4892c4f5cb437a928a02f5b7d37d496aa9268","url":"https://git.kernel.org/stable/c/6ad4892c4f5cb437a928a02f5b7d37d496aa9268"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e8ea01a0457080b0cc7c69c430c0ab65d84dc377","label":"e8ea01a04570","date":"2026-09-11T11:49:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6ad4892c4f5cb437a928a02f5b7d37d496aa9268","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89938","title":"iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF","status":"backported","project":false,"upstream":[{"sha":"be61c8c6252671ecf1fee0ad90f87669e0be1e20","url":"https://git.kernel.org/stable/c/be61c8c6252671ecf1fee0ad90f87669e0be1e20"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2071624c3d0f497ca91da78858e6f30d7112fea6","label":"2071624c3d0f","date":"2026-09-11T11:49:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"be61c8c6252671ecf1fee0ad90f87669e0be1e20","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/be61c8c6252671ecf1fee0ad90f87669e0be1e20.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89935","title":"iio: light: apds9306: fix PM reference leak in apds9306_read_data()","status":"backported","project":false,"upstream":[{"sha":"d378fceaafd79e0dc59d3546bda251a3058062c0","url":"https://git.kernel.org/stable/c/d378fceaafd79e0dc59d3546bda251a3058062c0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f3d97800b03cd39ec135e544dcd0a93ffd18e4c7","label":"f3d97800b03c","date":"2026-09-14T13:34:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d378fceaafd79e0dc59d3546bda251a3058062c0","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/d378fceaafd79e0dc59d3546bda251a3058062c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89935","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89935.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89929","title":"KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU","status":"backported","project":false,"upstream":[{"sha":"6d00e67326d831e6e610933a3800712f4ffe6ec1","url":"https://git.kernel.org/stable/c/6d00e67326d831e6e610933a3800712f4ffe6ec1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/27bdeb5fd19046ffba9ff234e92fe553eb2efb30","label":"27bdeb5fd190","date":"2026-09-11T11:49:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6d00e67326d831e6e610933a3800712f4ffe6ec1","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/6d00e67326d831e6e610933a3800712f4ffe6ec1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89913","title":"KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables","status":"backported","project":false,"upstream":[{"sha":"f5b8f203bfc07a5a257dff859e66d2c500f9f509","url":"https://git.kernel.org/stable/c/f5b8f203bfc07a5a257dff859e66d2c500f9f509"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7631f95297560157d3a9283cb999e3be00103348","label":"7631f9529756","date":"2026-09-11T11:49:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f5b8f203bfc07a5a257dff859e66d2c500f9f509","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/f5b8f203bfc07a5a257dff859e66d2c500f9f509.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89913","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89913.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89906","title":"LoongArch: BPF: Refactor jump offset calculation in tail call","status":"backported","project":false,"upstream":[{"sha":"37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","url":"https://git.kernel.org/stable/c/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/882b8912b7e92341fdb115ba0e2e5142a28684ff","label":"882b8912b7e9","date":"2026-09-11T11:49:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89899","title":"media: cec: disable delayed work before freeing an interrupted transmit","status":"backported","project":false,"upstream":[{"sha":"0fbd5c2327020858c45b2d1c65775d64cdeca523","url":"https://git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a3adb63b121937b97f7fdc51e96564c7c799538b","label":"a3adb63b1219","date":"2026-09-11T11:49:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fbd5c2327020858c45b2d1c65775d64cdeca523","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0fbd5c2327020858c45b2d1c65775d64cdeca523.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89866","title":"media: chips-media: wave5: Resume device before setting EOS flag","status":"backported","project":false,"upstream":[{"sha":"a52e6f7923c17a672135b485ffd96fbd72f46267","url":"https://git.kernel.org/stable/c/a52e6f7923c17a672135b485ffd96fbd72f46267"}],"evidence":[{"url":"https://git.kernel.org/stable/c/56c2c5ad35614ca5ae23838d6af5d7f59e3124dc","label":"56c2c5ad3561","date":"2026-10-15T11:58:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a52e6f7923c17a672135b485ffd96fbd72f46267","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/a52e6f7923c17a672135b485ffd96fbd72f46267.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89866","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89866.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89862","title":"scsi: qla2xxx: Fix BSG job leak on validate flash image error path","status":"unfixed","project":false,"upstream":[{"sha":"0fb52cc632464b0cd07f970341330466d772efe1","url":"https://git.kernel.org/stable/c/0fb52cc632464b0cd07f970341330466d772efe1"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fb52cc632464b0cd07f970341330466d772efe1","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/0fb52cc632464b0cd07f970341330466d772efe1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89826","title":"drm/panthor: harden firmware build-info bounds checks","status":"backported","project":false,"upstream":[{"sha":"8321b093fa6c297b80586460ce6914d9655df170","url":"https://git.kernel.org/stable/c/8321b093fa6c297b80586460ce6914d9655df170"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5516f1acfd07564361cf306cc90a8e513df0f096","label":"5516f1acfd07","date":"2026-09-11T11:49:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8321b093fa6c297b80586460ce6914d9655df170","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/8321b093fa6c297b80586460ce6914d9655df170.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89806","title":"drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation","status":"backported","project":false,"upstream":[{"sha":"c6f48e59ece0123f6a11527ad4d89b21c2d65b87","url":"https://git.kernel.org/stable/c/c6f48e59ece0123f6a11527ad4d89b21c2d65b87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ded6ad826fe0fd059333d3a3b3e1742c8e45ff41","label":"ded6ad826fe0","date":"2026-09-11T11:49:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6f48e59ece0123f6a11527ad4d89b21c2d65b87","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/c6f48e59ece0123f6a11527ad4d89b21c2d65b87.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89805","title":"drm/pagemap: Fix folio allocation fallback and use-after-put","status":"unfixed","project":false,"upstream":[{"sha":"df72e55e754c8d449321ddddad19a8bd3cb8d032","url":"https://git.kernel.org/stable/c/df72e55e754c8d449321ddddad19a8bd3cb8d032"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"df72e55e754c8d449321ddddad19a8bd3cb8d032","lines":181,"reason":"","source":"https://github.com/torvalds/linux/commit/df72e55e754c8d449321ddddad19a8bd3cb8d032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89805","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89805.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89797","title":"power: supply: ab8500_fg: fix use-after-free on remove","status":"backported","project":false,"upstream":[{"sha":"75b1e88d34254f4fb7753345e21bfee47abddd7f","url":"https://git.kernel.org/stable/c/75b1e88d34254f4fb7753345e21bfee47abddd7f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c660c017dec1fd7cd88e1103c5ae1aae6ce636bf","label":"c660c017dec1","date":"2026-09-11T11:49:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75b1e88d34254f4fb7753345e21bfee47abddd7f","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/75b1e88d34254f4fb7753345e21bfee47abddd7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89793","title":"ublk: clear VM_MAYWRITE on read-only ublk char device mmap","status":"backported","project":false,"upstream":[{"sha":"6e2b571b0a54755b06e092501913e1dfefe75d6c","url":"https://git.kernel.org/stable/c/6e2b571b0a54755b06e092501913e1dfefe75d6c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e373c1acdbcf88cec533ece9f589020adaed0a78","label":"e373c1acdbcf","date":"2026-09-11T11:49:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6e2b571b0a54755b06e092501913e1dfefe75d6c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/6e2b571b0a54755b06e092501913e1dfefe75d6c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89793","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89793.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89788","title":"ksmbd: fix tree connection use-after-free in smb2_tree_connect()","status":"unfixed","project":false,"upstream":[{"sha":"b5ec6c462aab1062cf5d1e667ba7c6442f737055","url":"https://git.kernel.org/stable/c/b5ec6c462aab1062cf5d1e667ba7c6442f737055"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5ec6c462aab1062cf5d1e667ba7c6442f737055","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/b5ec6c462aab1062cf5d1e667ba7c6442f737055.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89788","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89788.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89772","title":"btrfs: write-protect folios during data writeback","status":"unfixed","project":false,"upstream":[{"sha":"5376c9db45368eb210b4d71104ac00a59dc8b6e0","url":"https://git.kernel.org/stable/c/5376c9db45368eb210b4d71104ac00a59dc8b6e0"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"5376c9db45368eb210b4d71104ac00a59dc8b6e0","lines":125,"reason":"","source":"https://github.com/torvalds/linux/commit/5376c9db45368eb210b4d71104ac00a59dc8b6e0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89772","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89772.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89768","title":"fs: fix user path of nested backing files","status":"backported","project":false,"upstream":[{"sha":"f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d","url":"https://git.kernel.org/stable/c/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c03114634d342648bd34910aa8fb88007e92cc3c","label":"c03114634d34","date":"2026-09-07T17:22:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89762","title":"apparmor: fix cred UAF caused by begin_current_label_crit_section()","status":"backported","project":false,"upstream":[{"sha":"3f4ae5fab613dca01d6a2a8210dd832e009fcf47","url":"https://git.kernel.org/stable/c/3f4ae5fab613dca01d6a2a8210dd832e009fcf47"}],"evidence":[{"url":"https://git.kernel.org/stable/c/587a6a92b93ec314c583bbf747413af170d42540","label":"587a6a92b93e","date":"2026-09-07T17:22:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3f4ae5fab613dca01d6a2a8210dd832e009fcf47","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89755","title":"mm/migrate_device: clear stale mapping after freeing swapcache","status":"unfixed","project":false,"upstream":[{"sha":"34a00895d032a414830d41106a09329ae6c251b6","url":"https://git.kernel.org/stable/c/34a00895d032a414830d41106a09329ae6c251b6"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"34a00895d032a414830d41106a09329ae6c251b6","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/34a00895d032a414830d41106a09329ae6c251b6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89755","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89755.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89739","title":"usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition","status":"backported","project":false,"upstream":[{"sha":"9c855832790cd488d87de1885974f4c37cfe7358","url":"https://git.kernel.org/stable/c/9c855832790cd488d87de1885974f4c37cfe7358"}],"evidence":[{"url":"https://git.kernel.org/stable/c/448e95c0f3eaa8d99f16ccae92ab94545f14413b","label":"448e95c0f3ea","date":"2026-09-07T17:22:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9c855832790cd488d87de1885974f4c37cfe7358","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/9c855832790cd488d87de1885974f4c37cfe7358.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89739","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89739.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89722","title":"PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()","status":"backported","project":false,"upstream":[{"sha":"dc76258d0132df1d831a5a29758bd448ca9c566e","url":"https://git.kernel.org/stable/c/dc76258d0132df1d831a5a29758bd448ca9c566e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e892f05f1f790d5721cd8e3c561ed76da7e08bae","label":"e892f05f1f79","date":"2026-09-07T17:22:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"dc76258d0132df1d831a5a29758bd448ca9c566e","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/dc76258d0132df1d831a5a29758bd448ca9c566e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89722","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89722.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89708","title":"nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown","status":"backported","project":false,"upstream":[{"sha":"01c5d5f58a5db9b0ee5afba2e49d3157788687b2","url":"https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f164eb52b6f3cbf40f07fe379f9f421f88e02f76","label":"f164eb52b6f3","date":"2026-09-07T17:22:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"01c5d5f58a5db9b0ee5afba2e49d3157788687b2","lines":324,"reason":"","source":"https://github.com/torvalds/linux/commit/01c5d5f58a5db9b0ee5afba2e49d3157788687b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89708","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89708.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89675","title":"nfsd: fix UAF in async copy cancel and shutdown","status":"backported","project":false,"upstream":[{"sha":"62c0f6eaf050bb9284c1f9cac6ed1770092e6b95","url":"https://git.kernel.org/stable/c/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9031493ef7369d5c59c4bacc96f0c85965f09a98","label":"9031493ef736","date":"2026-09-11T11:49:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"62c0f6eaf050bb9284c1f9cac6ed1770092e6b95","lines":230,"reason":"","source":"https://github.com/torvalds/linux/commit/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89675","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89675.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89644","title":"btrfs: fix extent map leak in NOCOW direct I/O write","status":"backported","project":false,"upstream":[{"sha":"3f950867c307c5413d628a153ac44915bd117ffd","url":"https://git.kernel.org/stable/c/3f950867c307c5413d628a153ac44915bd117ffd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f42efd634c0ae7ba0ce2fc5e30e291b0803b0ae2","label":"f42efd634c0a","date":"2026-09-07T17:22:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3f950867c307c5413d628a153ac44915bd117ffd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89644","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89644.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89639","title":"cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC","status":"backported","project":false,"upstream":[{"sha":"364b183230586a62660a7280c1eb20138338eeb5","url":"https://git.kernel.org/stable/c/364b183230586a62660a7280c1eb20138338eeb5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8b9b10fe5b8b492b27b9f4546742ea541a650213","label":"8b9b10fe5b8b","date":"2026-09-07T17:22:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"364b183230586a62660a7280c1eb20138338eeb5","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/364b183230586a62660a7280c1eb20138338eeb5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89639","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89639.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89637","title":"smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2","status":"backported","project":false,"upstream":[{"sha":"730d0bb19507b9e19c2fe5343109ac618e2fbce5","url":"https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9eed72e9534b10a6d9f8f5146feff3db53aebdba","label":"9eed72e9534b","date":"2026-09-11T11:49:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"730d0bb19507b9e19c2fe5343109ac618e2fbce5","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/730d0bb19507b9e19c2fe5343109ac618e2fbce5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89637","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89637.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89633","title":"smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()","status":"backported","project":false,"upstream":[{"sha":"6343c1da561962688f203362d80d6a3bfa39fa1b","url":"https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e","label":"672cf86aa6aa","date":"2026-09-11T11:49:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6343c1da561962688f203362d80d6a3bfa39fa1b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89633","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89633.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89632","title":"smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()","status":"unfixed","project":false,"upstream":[{"sha":"05f78e6cf34ea3a285053bd5999e08e8ac298bd5","url":"https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"05f78e6cf34ea3a285053bd5999e08e8ac298bd5","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/05f78e6cf34ea3a285053bd5999e08e8ac298bd5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89632","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89632.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89630","title":"smb: client: restore the data_offset bound in is_valid_oplock_break()","status":"unknown","project":false,"upstream":[{"sha":"ba22f575de9deeae4ae0859ca4315a7698226237","url":"https://git.kernel.org/stable/c/ba22f575de9deeae4ae0859ca4315a7698226237"}],"evidence":[],"submission_lore":[],"basis":"Affected paths absent; applicability of earlier or renamed code needs review","review":null,"size":{"status":"within-limit","patches":[{"sha":"ba22f575de9deeae4ae0859ca4315a7698226237","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/ba22f575de9deeae4ae0859ca4315a7698226237.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89630","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89630.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89611","title":"ntfs: validate non-resident attribute offsets","status":"not-applicable","project":false,"upstream":[{"sha":"a83e82b0ec3ae523028e24813f23f18b43e8fc1c","url":"https://git.kernel.org/stable/c/a83e82b0ec3ae523028e24813f23f18b43e8fc1c"}],"evidence":[],"submission_lore":[],"basis":"NTFS3 validator is independent; legacy fs/ntfs/attrib.c conversion path absent","review":{"id":"CVE-2026-89611","series":"6.18.y","upstream":["a83e82b0ec3ae523028e24813f23f18b43e8fc1c"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"not-applicable","applicability":"unaffected","reason":"NTFS3 validator is independent; legacy fs/ntfs/attrib.c conversion path absent","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/ntfs3/attrib.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ntfs3/attrib.c?id=1b357ecb321392158d507b04672ffee57bfa071d"},{"label":"Upstream fix a83e82b0ec3a","url":"https://git.kernel.org/stable/c/a83e82b0ec3ae523028e24813f23f18b43e8fc1c"}]},"size":{"status":"within-limit","patches":[{"sha":"a83e82b0ec3ae523028e24813f23f18b43e8fc1c","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/a83e82b0ec3ae523028e24813f23f18b43e8fc1c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89611","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89611.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89610","title":"ntfs: verify run length exceeding volume boundary","status":"not-applicable","project":false,"upstream":[{"sha":"fea9e4488f384c0ef1c0e3d96b565127c1b98447","url":"https://git.kernel.org/stable/c/fea9e4488f384c0ef1c0e3d96b565127c1b98447"}],"evidence":[],"submission_lore":[],"basis":"target uses separate NTFS3 implementation; legacy fs/ntfs/runlist.c decoder absent","review":{"id":"CVE-2026-89610","series":"6.18.y","upstream":["fea9e4488f384c0ef1c0e3d96b565127c1b98447"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"not-applicable","applicability":"unaffected","reason":"target uses separate NTFS3 implementation; legacy fs/ntfs/runlist.c decoder absent","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: fs/ntfs3/attrib.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ntfs3/attrib.c?id=1b357ecb321392158d507b04672ffee57bfa071d"},{"label":"Upstream fix fea9e4488f38","url":"https://git.kernel.org/stable/c/fea9e4488f384c0ef1c0e3d96b565127c1b98447"}]},"size":{"status":"within-limit","patches":[{"sha":"fea9e4488f384c0ef1c0e3d96b565127c1b98447","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/fea9e4488f384c0ef1c0e3d96b565127c1b98447.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89610","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89610.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89584","title":"block: validate user space vectors during extraction","status":"unfixed","project":false,"upstream":[{"sha":"14b007e178811db72fbb1ebb3535160db6ec1e6a","url":"https://git.kernel.org/stable/c/14b007e178811db72fbb1ebb3535160db6ec1e6a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"14b007e178811db72fbb1ebb3535160db6ec1e6a","lines":168,"reason":"","source":"https://github.com/torvalds/linux/commit/14b007e178811db72fbb1ebb3535160db6ec1e6a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89584","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89584.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89568","title":"kho: fix size calculation in kho_preserved_memory_reserve()","status":"backported","project":false,"upstream":[{"sha":"3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded","url":"https://git.kernel.org/stable/c/3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0692a8fdf0222af130c8ea97426f1c3bf3814905","label":"0692a8fdf022","date":"2026-10-15T11:58:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-89568","series":"6.18.y","upstream":["3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"deserialize_bitmap computes reservation size using int sz = 1 << (order + PAGE_SHIFT)","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: kernel/kexec_handover.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kernel/kexec_handover.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n421"},{"label":"Upstream fix 3a0b8fa2eb36","url":"https://git.kernel.org/stable/c/3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded"}]},"size":{"status":"within-limit","patches":[{"sha":"3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89568","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89568.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89567","title":"jbd2: bound shrinker scans by examined checkpoint buffers","status":"backported","project":false,"upstream":[{"sha":"15cb16496446b94e67f7abcb049b8e2c75cd3d02","url":"https://git.kernel.org/stable/c/15cb16496446b94e67f7abcb049b8e2c75cd3d02"}],"evidence":[{"url":"https://git.kernel.org/stable/c/71c6b872c746465fa4b5def239cb296173ca8216","label":"71c6b872c746","date":"2026-09-07T17:22:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"15cb16496446b94e67f7abcb049b8e2c75cd3d02","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/15cb16496446b94e67f7abcb049b8e2c75cd3d02.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89567","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89567.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89566","title":"jbd2: check need_resched() when skipping busy checkpoint buffers","status":"backported","project":false,"upstream":[{"sha":"f213e12ff5c9590b1034ae8da0e6d09665c772d0","url":"https://git.kernel.org/stable/c/f213e12ff5c9590b1034ae8da0e6d09665c772d0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f9182a85991a0ad5cd2940df6db75f40ad90028c","label":"f9182a85991a","date":"2026-09-07T17:22:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f213e12ff5c9590b1034ae8da0e6d09665c772d0","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/f213e12ff5c9590b1034ae8da0e6d09665c772d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89566","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89566.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89545","title":"sunrpc: defer rq_argp and rq_resp free until after RCU grace period","status":"backported","project":false,"upstream":[{"sha":"c479bde671cbe2f9e152834a8b0eb7c3c295bbaf","url":"https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/08bc49e0541260bf294962cf889a32a2d2713ad6","label":"08bc49e05412","date":"2026-09-07T17:22:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c479bde671cbe2f9e152834a8b0eb7c3c295bbaf","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89545","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89545.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89534","title":"svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails","status":"backported","project":false,"upstream":[{"sha":"01500306e1d50de7ca7a2cdcdfa28ac0523eb747","url":"https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747"}],"evidence":[{"url":"https://git.kernel.org/stable/c/65f0f82f20334e76acaf29087a59af7b3b9699ed","label":"65f0f82f2033","date":"2026-10-15T11:58:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"01500306e1d50de7ca7a2cdcdfa28ac0523eb747","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/01500306e1d50de7ca7a2cdcdfa28ac0523eb747.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89534","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89534.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89451","title":"iommu/sva: Set handle->dev before the SVA handle is visible","status":"backported","project":false,"upstream":[{"sha":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","url":"https://git.kernel.org/stable/c/530f8f9c3546cb3ebee1b135375aaee08a073ebb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/968e9a1f71140c86dc4092f6b361e997923f3813","label":"968e9a1f7114","date":"2026-09-07T17:22:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/530f8f9c3546cb3ebee1b135375aaee08a073ebb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89451","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89451.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-81016","title":"platform/x86/amd/pmc: Propagate SMU errors and validate S2D address","status":"backported","project":false,"upstream":[{"sha":"0225c1d637687b03726f00ac65b6def843d2c464","url":"https://git.kernel.org/stable/c/0225c1d637687b03726f00ac65b6def843d2c464"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8178f59d76570b152d836bde07f5997f15861f04","label":"8178f59d7657","date":"2026-09-07T17:22:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0225c1d637687b03726f00ac65b6def843d2c464","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81016","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-81016.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-81010","title":"io_uring/waitid: honor task_work cancellation","status":"backported","project":false,"upstream":[{"sha":"14572de82e5022899e5856008bc9cac97004a88c","url":"https://git.kernel.org/stable/c/14572de82e5022899e5856008bc9cac97004a88c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0879697520abda2383ed7be40572ad583b5c4b02","label":"0879697520ab","date":"2026-09-14T13:34:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"14572de82e5022899e5856008bc9cac97004a88c","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/14572de82e5022899e5856008bc9cac97004a88c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-81010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80999","title":"net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO","status":"backported","project":false,"upstream":[{"sha":"fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc","url":"https://git.kernel.org/stable/c/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f71087e7c63aa3e99bf65d7ddf91eb4fd3545778","label":"f71087e7c63a","date":"2026-09-07T17:22:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80990","title":"net: thunderbolt: Release the Rx HopID that was handed out on mismatch","status":"backported","project":false,"upstream":[{"sha":"2f1463554d0561a2fead81e3888604e5c1125e29","url":"https://git.kernel.org/stable/c/2f1463554d0561a2fead81e3888604e5c1125e29"}],"evidence":[{"url":"https://git.kernel.org/stable/c/61ff3c353e5d2ff4eb9d0b6d8d9e47805b136eea","label":"61ff3c353e5d","date":"2026-09-07T17:22:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2f1463554d0561a2fead81e3888604e5c1125e29","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80989","title":"net: thunderbolt: Mark the connection down when bringing it up fails","status":"backported","project":false,"upstream":[{"sha":"3c8b26ebf525ba5960510f48c6e9936a79ebe76f","url":"https://git.kernel.org/stable/c/3c8b26ebf525ba5960510f48c6e9936a79ebe76f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f01e6a35c440b62f060e21f36b385e574a7f308c","label":"f01e6a35c440","date":"2026-09-07T17:22:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3c8b26ebf525ba5960510f48c6e9936a79ebe76f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80947","title":"wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop","status":"backported","project":false,"upstream":[{"sha":"6c080026ecc17eecb103f8927c64ea73a74bb818","url":"https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818"}],"evidence":[{"url":"https://git.kernel.org/stable/c/620acb1e8037b73a457dc8ef20fc23fc7adcb405","label":"620acb1e8037","date":"2026-09-07T17:22:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6c080026ecc17eecb103f8927c64ea73a74bb818","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80920","title":"io_uring: defer eventfd signaling when queued from a wakeup handler","status":"backported","project":false,"upstream":[{"sha":"cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e","url":"https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e22f4494cc9487d326e5e3067f33dea7c1e442b2","label":"e22f4494cc94","date":"2026-09-02T14:31:47+02:00","lore":["https://lore.kernel.org/all/20260813133843.2933127-1-4ncienth@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e","lines":163,"reason":"","source":"https://github.com/torvalds/linux/commit/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80899","title":"erofs: remove fscache backend entirely","status":"unfixed","project":false,"upstream":[{"sha":"c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56","url":"https://git.kernel.org/stable/c/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56","lines":1137,"reason":"","source":"https://github.com/torvalds/linux/commit/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80872","title":"ALSA: hda/tas2781: Cancel async firmware request at unbind","status":"backported","project":false,"upstream":[{"sha":"5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9","url":"https://git.kernel.org/stable/c/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f8272331da877eec8fe8e89a1e98e6a710e12490","label":"f8272331da87","date":"2026-07-24T16:17:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80862","title":"nvme-tcp: fix usage of page_frag_cache","status":"backported","project":false,"upstream":[{"sha":"36ac05f7cfd59d90c597071304b14e98090d5dd1","url":"https://git.kernel.org/stable/c/36ac05f7cfd59d90c597071304b14e98090d5dd1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/64561afb42d8390695bf810d9bbd087cbca00291","label":"64561afb42d8","date":"2026-09-02T14:31:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"36ac05f7cfd59d90c597071304b14e98090d5dd1","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/36ac05f7cfd59d90c597071304b14e98090d5dd1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80820","title":"xfs: don't livelock in scrub on a circular unlinked list","status":"backported","project":false,"upstream":[{"sha":"527eaaefddb6ec5c83a06c9a1559960dd6361753","url":"https://git.kernel.org/stable/c/527eaaefddb6ec5c83a06c9a1559960dd6361753"}],"evidence":[{"url":"https://git.kernel.org/stable/c/159d162fe80bd56573cafde5801bd5a90a3dd1ac","label":"159d162fe80b","date":"2026-08-27T14:32:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"527eaaefddb6ec5c83a06c9a1559960dd6361753","lines":149,"reason":"","source":"https://github.com/torvalds/linux/commit/527eaaefddb6ec5c83a06c9a1559960dd6361753.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80820","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80820.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80785","title":"fbdev: serialize mode sysfs access with lock_fb_info()","status":"unfixed","project":false,"upstream":[{"sha":"061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2","url":"https://git.kernel.org/stable/c/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80785","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80785.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80771","title":"HID: nintendo: register input device after capabilities are set","status":"backported","project":false,"upstream":[{"sha":"d723bc1fe2e72b9252234e94c11af644ec477bf7","url":"https://git.kernel.org/stable/c/d723bc1fe2e72b9252234e94c11af644ec477bf7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/268679f501386ad46405d42c2bcf89384cb5e256","label":"268679f50138","date":"2026-08-27T14:32:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d723bc1fe2e72b9252234e94c11af644ec477bf7","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/d723bc1fe2e72b9252234e94c11af644ec477bf7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80771","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80771.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80721","title":"Bluetooth: ISO: ensure no dangling hcon references in iso_conn","status":"backported","project":false,"upstream":[{"sha":"aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb","url":"https://git.kernel.org/stable/c/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e941799c31f68e67ce0976efb38a79101f921b64","label":"e941799c31f6","date":"2026-08-09T20:25:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80721","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80721.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80705","title":"drm/amd/display: check if dml21_add_phantom_plane() is successful","status":"backported","project":false,"upstream":[{"sha":"000acb4ce7fb9feba3072ce468ad681f6585cd5d","url":"https://git.kernel.org/stable/c/000acb4ce7fb9feba3072ce468ad681f6585cd5d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bea1f73ad69eec36b757adb8e63beb3092f862ee","label":"bea1f73ad69e","date":"2026-10-15T11:58:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-80705","series":"6.18.y","upstream":["000acb4ce7fb9feba3072ce468ad681f6585cd5d"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"dml21_handle_phantom_streams_planes() discards dml21_add_phantom_plane() failure and marks phantoms_added true unconditionally.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_utils.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_utils.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n320"},{"label":"Upstream fix 000acb4ce7fb","url":"https://git.kernel.org/stable/c/000acb4ce7fb9feba3072ce468ad681f6585cd5d"}]},"size":{"status":"within-limit","patches":[{"sha":"000acb4ce7fb9feba3072ce468ad681f6585cd5d","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/000acb4ce7fb9feba3072ce468ad681f6585cd5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80705","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80705.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80704","title":"drm/amd/display: use proper context for logging","status":"backported","project":false,"upstream":[{"sha":"114b42507b6a23d9d24e24e4ef165233332c64d4","url":"https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/02647d98340738f918690ed227fdcf154db1b84a","label":"02647d983407","date":"2026-08-09T20:25:23+02:00","lore":["https://lore.kernel.org/all/a9ee54e6-2413-4156-9bde-d528ae3c63a3@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"114b42507b6a23d9d24e24e4ef165233332c64d4","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/114b42507b6a23d9d24e24e4ef165233332c64d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80704","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80704.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80685","title":"mm/util: don't read __page_2 for order-1 folios in snapshot_page()","status":"backported","project":false,"upstream":[{"sha":"7441d6348c70738e9ed307510db171c7a9b3f4bf","url":"https://git.kernel.org/stable/c/7441d6348c70738e9ed307510db171c7a9b3f4bf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9668ffe0e2a5e2399dce281620198a2e415871fc","label":"9668ffe0e2a5","date":"2026-08-09T20:25:11+02:00","lore":["https://lore.kernel.org/20260708201954.686111-1-aboorvad@linux.ibm.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7441d6348c70738e9ed307510db171c7a9b3f4bf","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7441d6348c70738e9ed307510db171c7a9b3f4bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80685","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80685.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80676","title":"Drivers: hv: vmbus: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"331d8900121a1d74ecd45cd2db742ddcb5a0a565","url":"https://git.kernel.org/stable/c/331d8900121a1d74ecd45cd2db742ddcb5a0a565"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0e2f0833556c8c5269deb457b89d538644a3b747","label":"0e2f0833556c","date":"2026-07-24T16:15:57+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"331d8900121a1d74ecd45cd2db742ddcb5a0a565","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/331d8900121a1d74ecd45cd2db742ddcb5a0a565.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80676","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80676.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80670","title":"perf tools: Use perf_env__get_cpu_topology() in machine__resolve()","status":"backported","project":false,"upstream":[{"sha":"5484b43a0ec8231c36fba6ead654cb72dbba8b8f","url":"https://git.kernel.org/stable/c/5484b43a0ec8231c36fba6ead654cb72dbba8b8f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b9e8406651dcc1c19238aad11861a758683525b4","label":"b9e8406651dc","date":"2026-07-24T16:16:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5484b43a0ec8231c36fba6ead654cb72dbba8b8f","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/5484b43a0ec8231c36fba6ead654cb72dbba8b8f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80670","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80670.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80668","title":"netfilter: nf_conntrack_expect: use conntrack GC to reap expectations","status":"unfixed","project":false,"upstream":[{"sha":"b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2","url":"https://git.kernel.org/stable/c/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2","lines":512,"reason":"","source":"https://github.com/torvalds/linux/commit/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80668","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80668.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80657","title":"accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer","status":"unfixed","project":false,"upstream":[{"sha":"506255d46bdb93a281cf39e72abbca124f5c7a1b","url":"https://git.kernel.org/stable/c/506255d46bdb93a281cf39e72abbca124f5c7a1b"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"506255d46bdb93a281cf39e72abbca124f5c7a1b","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/506255d46bdb93a281cf39e72abbca124f5c7a1b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80657","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80657.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80650","title":"media: atomisp: gc2235: fix UAF and memory leak","status":"backported","project":false,"upstream":[{"sha":"628f763aee0047ff44974388d6f70f75a763026b","url":"https://git.kernel.org/stable/c/628f763aee0047ff44974388d6f70f75a763026b"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","url":"https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"628f763aee0047ff44974388d6f70f75a763026b","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/628f763aee0047ff44974388d6f70f75a763026b.patch"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","lines":168072,"reason":"","source":"https://github.com/torvalds/linux/commit/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80650","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80650.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80636","title":"netfilter: conntrack: revert ct extension genid infrastructure","status":"backported","project":false,"upstream":[{"sha":"35e21a4dccc5c255ba59ccfbfeb4629ed21da972","url":"https://git.kernel.org/stable/c/35e21a4dccc5c255ba59ccfbfeb4629ed21da972"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d53eecbca16f056abba274075cb15120ab062518","label":"d53eecbca16f","date":"2026-07-24T16:16:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"35e21a4dccc5c255ba59ccfbfeb4629ed21da972","lines":183,"reason":"","source":"https://github.com/torvalds/linux/commit/35e21a4dccc5c255ba59ccfbfeb4629ed21da972.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80636","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80636.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80634","title":"netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag","status":"backported","project":false,"upstream":[{"sha":"e052f920773b73be49eb4d8702a9f85de7464363","url":"https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363"}],"evidence":[{"url":"https://git.kernel.org/stable/c/547ea9f567498e4accc89e7816264f15a1a0629f","label":"547ea9f56749","date":"2026-10-15T11:58:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e052f920773b73be49eb4d8702a9f85de7464363","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80611","title":"ACPI: processor_idle: Mark LPI enter functions as __cpuidle","status":"backported","project":false,"upstream":[{"sha":"956ca5d72c76504824c8eb601879da9476973e15","url":"https://git.kernel.org/stable/c/956ca5d72c76504824c8eb601879da9476973e15"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5b6165d7ec38477e8cfa41bfa464959957953822","label":"5b6165d7ec38","date":"2026-07-24T16:16:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"956ca5d72c76504824c8eb601879da9476973e15","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80611","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80611.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80580","title":"fbdev: bound mode sysfs output to the sysfs buffer","status":"unfixed","project":false,"upstream":[{"sha":"d15d51fb26e830af58f3f21964f1c09c239077ea","url":"https://git.kernel.org/stable/c/d15d51fb26e830af58f3f21964f1c09c239077ea"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d15d51fb26e830af58f3f21964f1c09c239077ea","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/d15d51fb26e830af58f3f21964f1c09c239077ea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80580","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80580.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80579","title":"fbdev: clear fb_info->mode before deleting a videomode","status":"unfixed","project":false,"upstream":[{"sha":"95e647d2a5304a8fd11f1ba3c8502de700650131","url":"https://git.kernel.org/stable/c/95e647d2a5304a8fd11f1ba3c8502de700650131"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"95e647d2a5304a8fd11f1ba3c8502de700650131","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/95e647d2a5304a8fd11f1ba3c8502de700650131.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80579","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80579.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80556","title":"mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition","status":"backported","project":false,"upstream":[{"sha":"c125ee35a49a0518521b52b27631eef061b8719a","url":"https://git.kernel.org/stable/c/c125ee35a49a0518521b52b27631eef061b8719a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b5060ff2f5460795a3e9f7cdf5052aa42f96ff81","label":"b5060ff2f546","date":"2026-08-23T14:26:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c125ee35a49a0518521b52b27631eef061b8719a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/c125ee35a49a0518521b52b27631eef061b8719a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80556","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80556.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80546","title":"s390/zcrypt: Improve CCA CPRB length and overflow checks","status":"backported","project":false,"upstream":[{"sha":"35ac6754ba6da45fd193f5ce3f665f7490b830d5","url":"https://git.kernel.org/stable/c/35ac6754ba6da45fd193f5ce3f665f7490b830d5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/584400144020f40365de3972c4763da520e7280e","label":"584400144020","date":"2026-10-15T11:58:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"35ac6754ba6da45fd193f5ce3f665f7490b830d5","lines":110,"reason":"","source":"https://github.com/torvalds/linux/commit/35ac6754ba6da45fd193f5ce3f665f7490b830d5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80546","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80546.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80545","title":"s390/zcrypt: Improve EP11 CPRB length and overflow checks","status":"backported","project":false,"upstream":[{"sha":"17ac0bc866fc624cd05f022dcd8b730c0af11bb1","url":"https://git.kernel.org/stable/c/17ac0bc866fc624cd05f022dcd8b730c0af11bb1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f463f474773aa49ed1d6087d95d44cea7099fdc7","label":"f463f474773a","date":"2026-10-15T11:58:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"17ac0bc866fc624cd05f022dcd8b730c0af11bb1","lines":197,"reason":"","source":"https://github.com/torvalds/linux/commit/17ac0bc866fc624cd05f022dcd8b730c0af11bb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80545","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80545.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80544","title":"s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing","status":"backported","project":false,"upstream":[{"sha":"0864a163783bff109b548266921829ea794edc93","url":"https://git.kernel.org/stable/c/0864a163783bff109b548266921829ea794edc93"}],"evidence":[{"url":"https://git.kernel.org/stable/c/00a44ff06bcffb68b9cd7e90d2259b7d14b82b18","label":"00a44ff06bcf","date":"2026-10-15T11:58:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"over-limit","patches":[{"sha":"0864a163783bff109b548266921829ea794edc93","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/0864a163783bff109b548266921829ea794edc93.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80544","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80544.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80543","title":"s390/zcrypt: Pad trailing CCA or EP11 message with zeros","status":"backported","project":false,"upstream":[{"sha":"eb363254472493e3458156fc11fd56dca92f4333","url":"https://git.kernel.org/stable/c/eb363254472493e3458156fc11fd56dca92f4333"}],"evidence":[{"url":"https://git.kernel.org/stable/c/44e61f1834831f873af5a4fec5a5e432b929c6a2","label":"44e61f183483","date":"2026-10-15T11:58:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb363254472493e3458156fc11fd56dca92f4333","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/eb363254472493e3458156fc11fd56dca92f4333.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80543","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80543.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80521","title":"af_unix: Unlink scc_entry in unix_del_edge().","status":"backported","project":true,"upstream":[{"sha":"594d905195024b228c962627ae5ae7c17bd582a4","url":"https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fe198b077864feafd4aa4b33b1a5ce26f50195a2","label":"fe198b077864","date":"2026-09-21T15:05:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"594d905195024b228c962627ae5ae7c17bd582a4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80521","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80521.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74752","title":"sctp: validate cookie AUTH state before use","status":"unfixed","project":false,"upstream":[{"sha":"3dbb44d88b1e94dd31fe43588af7437b34b44d56","url":"https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"3dbb44d88b1e94dd31fe43588af7437b34b44d56","lines":105,"reason":"","source":"https://github.com/torvalds/linux/commit/3dbb44d88b1e94dd31fe43588af7437b34b44d56.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74735","title":"l2tp: fix tunnel and session refcount leak on seq_file release","status":"backported","project":true,"upstream":[{"sha":"9006c116dd111d457bf5d074990210f70a4ad2c8","url":"https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8c4fde01bcf91f22b9c7ded8c3e14addd7ddd500","label":"8c4fde01bcf9","date":"2026-09-21T15:05:04+02:00","lore":["https://lore.kernel.org/netdev/6a760f32.01d0871a.3a0d52.004f.GAE@google.com/T/#u"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9006c116dd111d457bf5d074990210f70a4ad2c8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74735","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74735.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74725","title":"enic: fix tx_hang_reset use-after-free on device removal","status":"backported","project":false,"upstream":[{"sha":"ec680ea4ba1bca92a767fb7e7869758bfdd886e3","url":"https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b","label":"e506e704b747","date":"2026-08-19T18:17:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ec680ea4ba1bca92a767fb7e7869758bfdd886e3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/ec680ea4ba1bca92a767fb7e7869758bfdd886e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74725","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74725.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74677","title":"net: usb: ipheth: fix carrier_work UAF on disconnect","status":"backported","project":false,"upstream":[{"sha":"fde39b8a521780391fb4e5bda2c0aa4928947f12","url":"https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45","label":"2c7496124e94","date":"2026-08-19T18:17:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fde39b8a521780391fb4e5bda2c0aa4928947f12","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/fde39b8a521780391fb4e5bda2c0aa4928947f12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74677","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74677.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74653","title":"serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx","status":"backported","project":false,"upstream":[{"sha":"1423415471274abda87024967d7fe2206ceee0ea","url":"https://git.kernel.org/stable/c/1423415471274abda87024967d7fe2206ceee0ea"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3ce24bc4d115336218e59b7e286fd3a79f4fc4c6","label":"3ce24bc4d115","date":"2026-08-19T18:18:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1423415471274abda87024967d7fe2206ceee0ea","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/1423415471274abda87024967d7fe2206ceee0ea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74653","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74653.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74638","title":"drm/v3d: Serialize the scheduler timeout handlers","status":"backported","project":false,"upstream":[{"sha":"4da94744707b27a3ae1197bdd7127da4505dc5b1","url":"https://git.kernel.org/stable/c/4da94744707b27a3ae1197bdd7127da4505dc5b1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5884851a096d8afcdf91f0e542bac193035183a6","label":"5884851a096d","date":"2026-08-19T18:18:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4da94744707b27a3ae1197bdd7127da4505dc5b1","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/4da94744707b27a3ae1197bdd7127da4505dc5b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74638","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74638.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74592","title":"ima: Instantiate file_truncate and path_truncate hooks","status":"backported","project":false,"upstream":[{"sha":"b80bed5c871a80151351342c065579405ce77145","url":"https://git.kernel.org/stable/c/b80bed5c871a80151351342c065579405ce77145"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dd21c96a71e876c8df9ec546b885a2c5f47bbb05","label":"dd21c96a71e8","date":"2026-08-19T18:18:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b80bed5c871a80151351342c065579405ce77145","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/b80bed5c871a80151351342c065579405ce77145.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74592","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74592.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74560","title":"xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx","status":"backported","project":false,"upstream":[{"sha":"a3c8382ebce4780c6b3ace2c09bc342313ac0186","url":"https://git.kernel.org/stable/c/a3c8382ebce4780c6b3ace2c09bc342313ac0186"}],"evidence":[{"url":"https://git.kernel.org/stable/c/05e283466b86e0b25a5209a3eafe87aa9886064a","label":"05e283466b86","date":"2026-08-09T20:25:02+02:00","lore":["https://lore.kernel.org/all/20260425041726.85FB3C2BCB2@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a3c8382ebce4780c6b3ace2c09bc342313ac0186","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/a3c8382ebce4780c6b3ace2c09bc342313ac0186.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74560","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74560.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74559","title":"xsk: drain continuation descs after overflow in xsk_build_skb()","status":"backported","project":false,"upstream":[{"sha":"bd44a6dcd4248883de90f5dad53ae80066e27096","url":"https://git.kernel.org/stable/c/bd44a6dcd4248883de90f5dad53ae80066e27096"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ceb00cb87a22c42d20c39336213db2b843ca9e34","label":"ceb00cb87a22","date":"2026-08-09T20:25:02+02:00","lore":["https://lore.kernel.org/all/20260425041726.85FB3C2BCB2@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bd44a6dcd4248883de90f5dad53ae80066e27096","lines":97,"reason":"","source":"https://github.com/torvalds/linux/commit/bd44a6dcd4248883de90f5dad53ae80066e27096.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74559","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74559.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74558","title":"xsk: reclaim invalid Tx descriptors in ZC batch path","status":"backported","project":false,"upstream":[{"sha":"72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","url":"https://git.kernel.org/stable/c/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2c0a8cc97a9d970a252f17aa0bbf4588768f7aad","label":"2c0a8cc97a9d","date":"2026-10-15T11:57:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","lines":404,"reason":"","source":"https://github.com/torvalds/linux/commit/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74558","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74558.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74536","title":"Bluetooth: ISO: fix leaking sk after socket release","status":"backported","project":false,"upstream":[{"sha":"ce57442a379212fe3fda59c9437ee8217eceb5b1","url":"https://git.kernel.org/stable/c/ce57442a379212fe3fda59c9437ee8217eceb5b1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e76a0ae6542ae43241b2147bacf4990e7ae5316a","label":"e76a0ae6542a","date":"2026-08-09T20:25:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ce57442a379212fe3fda59c9437ee8217eceb5b1","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/ce57442a379212fe3fda59c9437ee8217eceb5b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74536","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74536.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74533","title":"Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero","status":"unfixed","project":false,"upstream":[{"sha":"af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","url":"https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","lines":170,"reason":"","source":"https://github.com/torvalds/linux/commit/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74533","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74533.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74531","title":"Bluetooth: hci_conn: hold conn reference in abort_conn_sync()","status":"backported","project":false,"upstream":[{"sha":"5761d003daa987ac81463f570713ce9c9dd204e5","url":"https://git.kernel.org/stable/c/5761d003daa987ac81463f570713ce9c9dd204e5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e8f9fef362bab431d95371d3406bc720350290c3","label":"e8f9fef362ba","date":"2026-08-09T20:25:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5761d003daa987ac81463f570713ce9c9dd204e5","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/5761d003daa987ac81463f570713ce9c9dd204e5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74531","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74531.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74521","title":"ksmbd: use memcmp() to compare ClientGUIDs","status":"backported","project":true,"upstream":[{"sha":"e8bb506e6ef749ac0336f3e579d8d02396b7d832","url":"https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a386c83043015a703e227775f778e40343f45911","label":"a386c8304301","date":"2026-09-21T15:05:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e8bb506e6ef749ac0336f3e579d8d02396b7d832","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74521","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74521.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74513","title":"dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister","status":"backported","project":false,"upstream":[{"sha":"a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","url":"https://git.kernel.org/stable/c/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c0837aeace96152d14b17fdd19d70102b6631a7d","label":"c0837aeace96","date":"2026-08-09T20:25:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74513","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74513.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74506","title":"afs: Fix UAF when sending a message","status":"backported","project":false,"upstream":[{"sha":"4af1ec68d54b3871155914d584fb10669c41a861","url":"https://git.kernel.org/stable/c/4af1ec68d54b3871155914d584fb10669c41a861"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c0d3b81f703b2a9e37fe1347610a50cdf0078c27","label":"c0d3b81f703b","date":"2026-08-09T20:25:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4af1ec68d54b3871155914d584fb10669c41a861","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/4af1ec68d54b3871155914d584fb10669c41a861.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74506","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74506.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74449","title":"drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport","status":"backported","project":false,"upstream":[{"sha":"f327e389c07cfc3a2f6ff54f6214e1a52d457edc","url":"https://git.kernel.org/stable/c/f327e389c07cfc3a2f6ff54f6214e1a52d457edc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/23a541c31b45fa813b33269376f6bd53535429a8","label":"23a541c31b45","date":"2026-10-15T11:57:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-74449","series":"6.18.y","upstream":["f327e389c07cfc3a2f6ff54f6214e1a52d457edc"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"calculate_mcache_setting() asserts a positive mcache count but continues into calculations that use the count and viewport dimensions; it does not return failure for invalid zero-count inputs.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n2415"},{"label":"Upstream fix f327e389c07c","url":"https://git.kernel.org/stable/c/f327e389c07cfc3a2f6ff54f6214e1a52d457edc"}]},"size":{"status":"within-limit","patches":[{"sha":"f327e389c07cfc3a2f6ff54f6214e1a52d457edc","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/f327e389c07cfc3a2f6ff54f6214e1a52d457edc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74419","title":"accel/amdxdna: Adjust size for copy_to_user()","status":"unfixed","project":false,"upstream":[{"sha":"6e87001fe19f251e2ae14373bc76554358a13df2","url":"https://git.kernel.org/stable/c/6e87001fe19f251e2ae14373bc76554358a13df2"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"6e87001fe19f251e2ae14373bc76554358a13df2","lines":264,"reason":"","source":"https://github.com/torvalds/linux/commit/6e87001fe19f251e2ae14373bc76554358a13df2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74419","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74419.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74407","title":"wifi: ath11k: cancel SSR work items during PCI shutdown","status":"backported","project":true,"upstream":[{"sha":"8c79aac429b583301f387374ff37c59be671df87","url":"https://git.kernel.org/stable/c/8c79aac429b583301f387374ff37c59be671df87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6dd3701facc0cee62d6682e49eed64499f9d0e43","label":"6dd3701facc0","date":"2026-09-21T15:05:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8c79aac429b583301f387374ff37c59be671df87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74407","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74407.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74374","title":"md/raid1,raid10: fix error-path detection with md_cloned_bio()","status":"backported","project":false,"upstream":[{"sha":"811545e0926d02a6a0b1a1258bb5544777c164d4","url":"https://git.kernel.org/stable/c/811545e0926d02a6a0b1a1258bb5544777c164d4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/029b363c9b690613141338436ac91366b1928af2","label":"029b363c9b69","date":"2026-10-15T11:57:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"811545e0926d02a6a0b1a1258bb5544777c164d4","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/811545e0926d02a6a0b1a1258bb5544777c164d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74374","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74374.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74368","title":"wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()","status":"backported","project":false,"upstream":[{"sha":"98d4f92ab6a1af2ea2ab590d7e2801b203110981","url":"https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981"}],"evidence":[{"url":"https://git.kernel.org/stable/c/55c6f05b667726d2da5fd011d646fb48ce5b6b9c","label":"55c6f05b6677","date":"2026-10-15T11:57:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-74368","series":"6.18.y","upstream":["98d4f92ab6a1af2ea2ab590d7e2801b203110981"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"On TKIP MIC failure, ath12k_dp_rx_h_verify_tkip_mic returns -EINVAL when NWIFI header-length validation fails without freeing msdu. ath12k_dp_rx_h_defrag has already unlinked first_frag from rx_tid->rx_frags, then sets first_frag to NULL on this error. The caller error path frees NULL and purges only the remaining queue, so the unlinked first fragment leaks.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/wireless/ath/ath12k/dp_rx.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/ath/ath12k/dp_rx.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n3187"},{"label":"Checked source: drivers/net/wireless/ath/ath12k/dp_rx.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/ath/ath12k/dp_rx.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n3187"},{"label":"Checked source: drivers/net/wireless/ath/ath12k/dp_rx.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/ath/ath12k/dp_rx.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n3187"},{"label":"Upstream fix 98d4f92ab6a1","url":"https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981"}]},"size":{"status":"within-limit","patches":[{"sha":"98d4f92ab6a1af2ea2ab590d7e2801b203110981","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/98d4f92ab6a1af2ea2ab590d7e2801b203110981.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74368","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74368.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74354","title":"bpf: Take mmap_lock in zap_pages()","status":"unfixed","project":false,"upstream":[{"sha":"80b89d0226a05e8b67969de99c31b51fcd54f76a","url":"https://git.kernel.org/stable/c/80b89d0226a05e8b67969de99c31b51fcd54f76a"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"80b89d0226a05e8b67969de99c31b51fcd54f76a","lines":93,"reason":"","source":"https://github.com/torvalds/linux/commit/80b89d0226a05e8b67969de99c31b51fcd54f76a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74354","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74354.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74342","title":"kernfs: link kn to its parent before the LSM init hook","status":"unfixed","project":false,"upstream":[{"sha":"6cccc49b027c7551ffc1d2532f2ef1922661f3da","url":"https://git.kernel.org/stable/c/6cccc49b027c7551ffc1d2532f2ef1922661f3da"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"6cccc49b027c7551ffc1d2532f2ef1922661f3da","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/6cccc49b027c7551ffc1d2532f2ef1922661f3da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74342","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74342.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74337","title":"bpf: Fix NMI/tracepoint re-entry deadlock on lru locks","status":"backported","project":false,"upstream":[{"sha":"89edbdfc5d0308cef57b71359331de5c4ddbf763","url":"https://git.kernel.org/stable/c/89edbdfc5d0308cef57b71359331de5c4ddbf763"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8b0510cc3a4a000d4ed1a56cd96231f3d3ba94c5","label":"8b0510cc3a4a","date":"2026-07-24T16:16:02+02:00","lore":["https://lore.kernel.org/bpf/20251030030010.95352-1-dongml2@chinatelecom.cn/","https://lore.kernel.org/bpf/20260119142120.28170-1-leon.hwang@linux.dev/","https://lore.kernel.org/bpf/CAPPBnEYO4R+m+SpVc2gNj_x31R6fo1uJvj2bK2YS1P09GWT6kQ@mail.gmail.com/","https://lore.kernel.org/bpf/CAPPBnEZmFA3ab8Uc=PEm0bdojZy=7T_F5_+eyZSHyZR3MBG4Vw@mail.gmail.com/","https://lore.kernel.org/r/20260607-lru_map_spin-v3-1-bcd9332e911b@meta.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"89edbdfc5d0308cef57b71359331de5c4ddbf763","lines":402,"reason":"","source":"https://github.com/torvalds/linux/commit/89edbdfc5d0308cef57b71359331de5c4ddbf763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74336","title":"wifi: mac80211: bound S1G TIM PVB walk to the TIM element","status":"backported","project":false,"upstream":[{"sha":"b224d18b1e5d1cddfc67f63f41d80023b2ec8889","url":"https://git.kernel.org/stable/c/b224d18b1e5d1cddfc67f63f41d80023b2ec8889"}],"evidence":[{"url":"https://git.kernel.org/stable/c/68cf46755894d495b432e21f9e25637030d8b075","label":"68cf46755894","date":"2026-10-15T11:57:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-74336","series":"6.18.y","upstream":["b224d18b1e5d1cddfc67f63f41d80023b2ec8889"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"The older S1G TIM walker forms its end pointer as tim + tim_len + 2, stepping two bytes beyond the TIM element.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: include/linux/ieee80211.h","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/include/linux/ieee80211.h?id=1b357ecb321392158d507b04672ffee57bfa071d#n3090"},{"label":"Upstream fix b224d18b1e5d","url":"https://git.kernel.org/stable/c/b224d18b1e5d1cddfc67f63f41d80023b2ec8889"}]},"size":{"status":"within-limit","patches":[{"sha":"b224d18b1e5d1cddfc67f63f41d80023b2ec8889","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b224d18b1e5d1cddfc67f63f41d80023b2ec8889.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74336","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74336.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74324","title":"wifi: mt76: mt7925: validate skb length in testmode query","status":"backported","project":false,"upstream":[{"sha":"c7369a00860a0704461d440e7c3bf9b49bfdbaee","url":"https://git.kernel.org/stable/c/c7369a00860a0704461d440e7c3bf9b49bfdbaee"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c386e90a7ce8ddec9f038e9437661a2821b0ce89","label":"c386e90a7ce8","date":"2026-07-24T16:16:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7369a00860a0704461d440e7c3bf9b49bfdbaee","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/c7369a00860a0704461d440e7c3bf9b49bfdbaee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74324","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74324.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74314","title":"bpf: Cancel special fields on map value recycle","status":"unfixed","project":false,"upstream":[{"sha":"a3a81d247651218e47153f2d2afd7aee236726fd","url":"https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"a3a81d247651218e47153f2d2afd7aee236726fd","lines":471,"reason":"","source":"https://github.com/torvalds/linux/commit/a3a81d247651218e47153f2d2afd7aee236726fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74314","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74314.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74294","title":"ASoC: meson: aiu: Validate written enum values","status":"backported","project":true,"upstream":[{"sha":"d65adf85477247be04ac86886f8edfaa047b5d4a","url":"https://git.kernel.org/stable/c/d65adf85477247be04ac86886f8edfaa047b5d4a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/96f5b92d958bc34500500f29fab8e0b908f25397","label":"96f5b92d958b","date":"2026-09-21T15:05:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d65adf85477247be04ac86886f8edfaa047b5d4a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74294","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74294.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74291","title":"ASoC: topology: Check PCM and DAI name strings before use","status":"backported","project":true,"upstream":[{"sha":"b7e44d1986d6671342c19b82192189ca5db5dab7","url":"https://git.kernel.org/stable/c/b7e44d1986d6671342c19b82192189ca5db5dab7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5c2537cf24d673956b4e58029001667f89586fa2","label":"5c2537cf24d6","date":"2026-09-21T15:05:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"b7e44d1986d6671342c19b82192189ca5db5dab7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74291","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74291.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74289","title":"ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().","status":"backported","project":true,"upstream":[{"sha":"06b693d2eb6651a63ad85bad8673de3b7d4edd6d","url":"https://git.kernel.org/stable/c/06b693d2eb6651a63ad85bad8673de3b7d4edd6d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bea03e887db5a8a79234531faf14cf2c4d8816c3","label":"bea03e887db5","date":"2026-09-21T15:05:03+02:00","lore":["https://lore.kernel.org/netdev/6a290011.39669fcc.33b062.00b1.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"06b693d2eb6651a63ad85bad8673de3b7d4edd6d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74272","title":"cxl/region: Resolve region deletion races","status":"unfixed","project":false,"upstream":[{"sha":"4dd86ca99ffcc413cbf79063fd9956ef54e0ca91","url":"https://git.kernel.org/stable/c/4dd86ca99ffcc413cbf79063fd9956ef54e0ca91"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"4dd86ca99ffcc413cbf79063fd9956ef54e0ca91","lines":176,"reason":"","source":"https://github.com/torvalds/linux/commit/4dd86ca99ffcc413cbf79063fd9956ef54e0ca91.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74272","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74272.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74269","title":"bnxt: fix head underflow on XDP head-grow","status":"backported","project":true,"upstream":[{"sha":"e26657fe3b85c068b01f42bb0c602f242d643ba9","url":"https://git.kernel.org/stable/c/e26657fe3b85c068b01f42bb0c602f242d643ba9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4c03275bc4435cc8e25f7f3f08aff58c0e783d8d","label":"4c03275bc443","date":"2026-09-21T15:05:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e26657fe3b85c068b01f42bb0c602f242d643ba9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74269","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74269.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74258","title":"bpf: Guard __get_user acesss with access_ok for uprobe_multi data","status":"backported","project":true,"upstream":[{"sha":"4d87a251d45b4a95eb4c0abcfab809c9f231258a","url":"https://git.kernel.org/stable/c/4d87a251d45b4a95eb4c0abcfab809c9f231258a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a9f1395028c2bbe18e57864cc355c11faff488cb","label":"a9f1395028c2","date":"2026-09-21T15:05:03+02:00","lore":["https://lore.kernel.org/bpf/20260610145235.CB1441F00893@smtp.kernel.org/","https://lore.kernel.org/r/20260611114230.950379-2-jolsa@kernel.org"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"4d87a251d45b4a95eb4c0abcfab809c9f231258a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74258","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74258.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72501","title":"RDMA/bnxt_re: Initialize dpi variable to zero","status":"backported","project":false,"upstream":[{"sha":"978b27d6ce538bb832ccd69e45802824e4301c4b","url":"https://git.kernel.org/stable/c/978b27d6ce538bb832ccd69e45802824e4301c4b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b87cbd4d198ae377be4815d8102fa9dfefb91dcc","label":"b87cbd4d198a","date":"2026-07-24T16:17:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"978b27d6ce538bb832ccd69e45802824e4301c4b","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/978b27d6ce538bb832ccd69e45802824e4301c4b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72501","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72501.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72496","title":"RDMA/bnxt_re: Proper rollback if the ioremap fails","status":"backported","project":true,"upstream":[{"sha":"87267803a8c824616eb147c5dad7030a5db6f878","url":"https://git.kernel.org/stable/c/87267803a8c824616eb147c5dad7030a5db6f878"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f956477c343aa73e9d9c8d6ebf32efac7cd4f4e2","label":"f956477c343a","date":"2026-09-21T15:05:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"87267803a8c824616eb147c5dad7030a5db6f878","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72496","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72496.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72494","title":"RDMA/irdma: Replace waitqueue and flag with completion","status":"backported","project":true,"upstream":[{"sha":"d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd","url":"https://git.kernel.org/stable/c/d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/706591cccdd3ac2c0ddc8c2ed6c89a6be9865826","label":"706591cccdd3","date":"2026-09-21T15:05:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72494","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72494.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72493","title":"net: serialize netif_running() check in enqueue_to_backlog()","status":"backported","project":false,"upstream":[{"sha":"46762cefe7f4e5bffc1eb467810a7bbb02e461d7","url":"https://git.kernel.org/stable/c/46762cefe7f4e5bffc1eb467810a7bbb02e461d7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b422e3eff0edf0975de4883929adbed28f9d08bc","label":"b422e3eff0ed","date":"2026-10-15T11:57:56+02:00","lore":["https://lore.kernel.org/netdev/6a315824.b0403584.28d0ff.0000.GAE@google.com/T/#u"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"46762cefe7f4e5bffc1eb467810a7bbb02e461d7","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/46762cefe7f4e5bffc1eb467810a7bbb02e461d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72485","title":"coresight: platform: defer connection counter increment until alloc succeeds","status":"backported","project":true,"upstream":[{"sha":"1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae","url":"https://git.kernel.org/stable/c/1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/09c44549820df67048be3ba19c723bac72ebb98e","label":"09c44549820d","date":"2026-09-21T15:05:03+02:00","lore":["https://lore.kernel.org/r/20260511-fix-ref-count-issue-v1-1-99d647810d3c@oss.qualcomm.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72485","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72485.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72472","title":"nfs: use nfsi->rwsem to protect traversal of the file lock list","status":"backported","project":false,"upstream":[{"sha":"4837fb36219e6c08b666bc31a86841bad8526358","url":"https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f161ef7b0dd2f51fdb002ba4a4e9bf0ee7409218","label":"f161ef7b0dd2","date":"2026-07-24T16:16:21+02:00","lore":["https://lore.kernel.org/all/20250419085709.1452492-1-lilingfeng3@huawei.com/","https://lore.kernel.org/all/20250715030559.2906634-1-lilingfeng3@huawei.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4837fb36219e6c08b666bc31a86841bad8526358","lines":87,"reason":"","source":"https://github.com/torvalds/linux/commit/4837fb36219e6c08b666bc31a86841bad8526358.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72472","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72472.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72469","title":"xprtrdma: Fix ep kref imbalance on ADDR_CHANGE","status":"backported","project":false,"upstream":[{"sha":"af9b65b29af341932625c4283dc7a23cdb62688a","url":"https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d0479c2b12974aa188b10d221a5770126b118b6d","label":"d0479c2b1297","date":"2026-07-24T16:16:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"af9b65b29af341932625c4283dc7a23cdb62688a","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/af9b65b29af341932625c4283dc7a23cdb62688a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72469","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72469.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72463","title":"xfrm: Fix dev use-after-free in xfrm async resumption","status":"backported","project":false,"upstream":[{"sha":"8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff","url":"https://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1acd93259b6be269e26be5d71c224bccd1f8352f","label":"1acd93259b6b","date":"2026-09-25T16:35:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"over-limit","patches":[{"sha":"8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff","lines":115,"reason":"","source":"https://github.com/torvalds/linux/commit/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72463","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72463.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72454","title":"i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()","status":"backported","project":false,"upstream":[{"sha":"650716f23eac488c6696babdc7805f6a6b7427ad","url":"https://git.kernel.org/stable/c/650716f23eac488c6696babdc7805f6a6b7427ad"}],"evidence":[{"url":"https://git.kernel.org/stable/c/308d7951ca221e8c8896b563c4e98d28a4400f2e","label":"308d7951ca22","date":"2026-10-15T11:57:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"650716f23eac488c6696babdc7805f6a6b7427ad","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/650716f23eac488c6696babdc7805f6a6b7427ad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72454","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72454.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72438","title":"md/raid10: fix writes_pending and barrier reference leaks on discard failures","status":"backported","project":true,"upstream":[{"sha":"393d687131d8aa8c7e4de2cb494438e145d20fc2","url":"https://git.kernel.org/stable/c/393d687131d8aa8c7e4de2cb494438e145d20fc2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/11b35d1906a7277a3d64afe34224133b44327328","label":"11b35d1906a7","date":"2026-09-21T15:05:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"393d687131d8aa8c7e4de2cb494438e145d20fc2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72438","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72438.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72434","title":"netfilter: ipset: make sure gc is properly stopped","status":"backported","project":false,"upstream":[{"sha":"4a597a87e2e2f608edb6be2c510dc826b4fdfb53","url":"https://git.kernel.org/stable/c/4a597a87e2e2f608edb6be2c510dc826b4fdfb53"}],"evidence":[{"url":"https://git.kernel.org/stable/c/12088da6add5b003657c8506c5b0fcef835083b8","label":"12088da6add5","date":"2026-07-24T16:16:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4a597a87e2e2f608edb6be2c510dc826b4fdfb53","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/4a597a87e2e2f608edb6be2c510dc826b4fdfb53.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72434","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72434.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72413","title":"sctp: fix err_chunk memory leaks in INIT handling","status":"backported","project":true,"upstream":[{"sha":"9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2","url":"https://git.kernel.org/stable/c/9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1cae40d423a2042c7970f29c00028951ec20db8a","label":"1cae40d423a2","date":"2026-09-21T15:05:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72413","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72413.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72402","title":"bpf: Mask pseudo pointer values in verifier logs","status":"backported","project":true,"upstream":[{"sha":"72a85e9464a5332fb2cd7efd26d9295275ceda2d","url":"https://git.kernel.org/stable/c/72a85e9464a5332fb2cd7efd26d9295275ceda2d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b96cb1235fcaa687291b1e1d910f0930d1939919","label":"b96cb1235fca","date":"2026-09-21T15:05:02+02:00","lore":["https://lore.kernel.org/r/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-1-a190ebb8f3e2@mails.tsinghua.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"72a85e9464a5332fb2cd7efd26d9295275ceda2d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72402","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72402.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72397","title":"hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()","status":"unfixed","project":false,"upstream":[{"sha":"828cd614e2af053ca5e1d6da767bbd8a1b5cabfb","url":"https://git.kernel.org/stable/c/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"828cd614e2af053ca5e1d6da767bbd8a1b5cabfb","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72397","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72397.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72377","title":"afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints","status":"unfixed","project":false,"upstream":[{"sha":"81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459","url":"https://git.kernel.org/stable/c/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72377","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72377.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72376","title":"afs: Fix misplaced inc of net->cells_outstanding","status":"backported","project":false,"upstream":[{"sha":"c9c3b615a462a4023bd148f02c564e175ed10502","url":"https://git.kernel.org/stable/c/c9c3b615a462a4023bd148f02c564e175ed10502"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5ea289ca751c47125f6a4138c93ba10c05cd28f0","label":"5ea289ca751c","date":"2026-07-24T16:16:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c9c3b615a462a4023bd148f02c564e175ed10502","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c9c3b615a462a4023bd148f02c564e175ed10502.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72376","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72376.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72373","title":"afs: Fix missing NULL pointer check in afs_break_some_callbacks()","status":"backported","project":false,"upstream":[{"sha":"794a01110390c1b76f59ece773fb0fbfd89c6f5c","url":"https://git.kernel.org/stable/c/794a01110390c1b76f59ece773fb0fbfd89c6f5c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5492799ec5d27be3bd454dcaf046bc7054f637ae","label":"5492799ec5d2","date":"2026-07-24T16:16:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"794a01110390c1b76f59ece773fb0fbfd89c6f5c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/794a01110390c1b76f59ece773fb0fbfd89c6f5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72373","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72373.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72369","title":"minix: avoid overflow in bitmap block count calculation","status":"backported","project":false,"upstream":[{"sha":"fb3e566cafc38fe3ba35e6843a2d529a3748870c","url":"https://git.kernel.org/stable/c/fb3e566cafc38fe3ba35e6843a2d529a3748870c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/abe3536a4bedcc43de80b6d4d7e3d57e9ba382a5","label":"abe3536a4bed","date":"2026-07-24T16:16:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb3e566cafc38fe3ba35e6843a2d529a3748870c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/fb3e566cafc38fe3ba35e6843a2d529a3748870c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72369","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72369.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72367","title":"iomap: guard io_size EOF trim against concurrent truncate underflow","status":"backported","project":false,"upstream":[{"sha":"55ec50d046c03b3724741957f7b007856e36dbe7","url":"https://git.kernel.org/stable/c/55ec50d046c03b3724741957f7b007856e36dbe7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1f38f65bf965fce9aa159d45c5347538f56c5973","label":"1f38f65bf965","date":"2026-07-24T16:16:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"55ec50d046c03b3724741957f7b007856e36dbe7","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/55ec50d046c03b3724741957f7b007856e36dbe7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72367","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72367.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72365","title":"netfs: Fix writethrough to use collection offload","status":"backported","project":false,"upstream":[{"sha":"ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4","url":"https://git.kernel.org/stable/c/ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7838131e296dfbb639ea278901a53c018322c11e","label":"7838131e296d","date":"2026-07-24T16:16:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72365","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72365.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72355","title":"netfs: Fix barriering when walking subrequest list","status":"backported","project":true,"upstream":[{"sha":"5c6ce05e406520290c1d89da97fb3cd70c09137d","url":"https://git.kernel.org/stable/c/5c6ce05e406520290c1d89da97fb3cd70c09137d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4cca4b44e561a19c77cb1949ae6846da0539db40","label":"4cca4b44e561","date":"2026-09-21T15:05:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5c6ce05e406520290c1d89da97fb3cd70c09137d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/5c6ce05e406520290c1d89da97fb3cd70c09137d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72345","title":"net/mlx5: LAG, Fix off-by-one in single-FDB error rollback","status":"backported","project":false,"upstream":[{"sha":"0f0e4ae6975c773f7854fc48932a267f6c79088f","url":"https://git.kernel.org/stable/c/0f0e4ae6975c773f7854fc48932a267f6c79088f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0be672071d6e8c4d3be6a8f796d8e47198763770","label":"0be672071d6e","date":"2026-10-15T11:57:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-72345","series":"6.18.y","upstream":["0f0e4ae6975c773f7854fc48932a267f6c79088f"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"Equivalent single-FDB rollback in lag.c starts its reverse loop at failed index i, so failure cleanup can tear down the failing/uninitialized entry; upstream begins at i-1.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n665"},{"label":"Upstream fix 0f0e4ae6975c","url":"https://git.kernel.org/stable/c/0f0e4ae6975c773f7854fc48932a267f6c79088f"}]},"size":{"status":"within-limit","patches":[{"sha":"0f0e4ae6975c773f7854fc48932a267f6c79088f","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0f0e4ae6975c773f7854fc48932a267f6c79088f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72345","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72345.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72334","title":"Bluetooth: ISO: fix malformed ISO_END/CONT handling","status":"backported","project":true,"upstream":[{"sha":"e054c1a6ae7310d2815778fddb87da616e11c255","url":"https://git.kernel.org/stable/c/e054c1a6ae7310d2815778fddb87da616e11c255"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5e53e285f8c989662e34d4938c728a94226bff34","label":"5e53e285f8c9","date":"2026-09-21T15:05:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e054c1a6ae7310d2815778fddb87da616e11c255","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72324","title":"gpio: mvebu: free generic chips on unbind","status":"backported","project":false,"upstream":[{"sha":"b11c513ad943f35cf5e8007d3a56279c79b7ed4b","url":"https://git.kernel.org/stable/c/b11c513ad943f35cf5e8007d3a56279c79b7ed4b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3bfcce441c552133adeeb99c294d0ce8a62612ef","label":"3bfcce441c55","date":"2026-07-24T16:16:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b11c513ad943f35cf5e8007d3a56279c79b7ed4b","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b11c513ad943f35cf5e8007d3a56279c79b7ed4b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72324","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72324.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72315","title":"smb: client: fix busy dentry warning on unmount after DIO","status":"backported","project":false,"upstream":[{"sha":"75f5c412fa867efa0bf9b646bffe0d912109e84a","url":"https://git.kernel.org/stable/c/75f5c412fa867efa0bf9b646bffe0d912109e84a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9fc87899276af941ecf3045798887db7deb85605","label":"9fc87899276a","date":"2026-09-25T16:35:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"75f5c412fa867efa0bf9b646bffe0d912109e84a","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/75f5c412fa867efa0bf9b646bffe0d912109e84a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72203","title":"ntfs: skip extent mft records in writeback to prevent deadlock","status":"backported","project":false,"upstream":[{"sha":"76bc14c7097ff678b2b5dbfd4fa33b46897d87ce","url":"https://git.kernel.org/stable/c/76bc14c7097ff678b2b5dbfd4fa33b46897d87ce"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"76bc14c7097ff678b2b5dbfd4fa33b46897d87ce","lines":154,"reason":"","source":"https://github.com/torvalds/linux/commit/76bc14c7097ff678b2b5dbfd4fa33b46897d87ce.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72203","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72203.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72200","title":"ntfs: detect mapping-pairs LCN accumulator overflow","status":"backported","project":false,"upstream":[{"sha":"ec4f061f2219e0f0c6465d56d0380bf749235a53","url":"https://git.kernel.org/stable/c/ec4f061f2219e0f0c6465d56d0380bf749235a53"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ec4f061f2219e0f0c6465d56d0380bf749235a53","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/ec4f061f2219e0f0c6465d56d0380bf749235a53.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72200","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72200.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72198","title":"ntfs: reject non-resident records for resident-only attributes","status":"backported","project":false,"upstream":[{"sha":"097cdfd0a55df5af82c9753833f39a8bfadbcfcb","url":"https://git.kernel.org/stable/c/097cdfd0a55df5af82c9753833f39a8bfadbcfcb"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"097cdfd0a55df5af82c9753833f39a8bfadbcfcb","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/097cdfd0a55df5af82c9753833f39a8bfadbcfcb.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72198","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72198.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72073","title":"mmc: vub300: fix use-after-free on probe failure","status":"backported","project":false,"upstream":[{"sha":"a3b5f242997a3be7404112fd48784881560aea57","url":"https://git.kernel.org/stable/c/a3b5f242997a3be7404112fd48784881560aea57"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5b82af744e06cd741938c3da54fdbe564a7e52d9","label":"5b82af744e06","date":"2026-08-03T11:22:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a3b5f242997a3be7404112fd48784881560aea57","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/a3b5f242997a3be7404112fd48784881560aea57.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72042","title":"ipmi: Fix user refcount underflow in event delivery","status":"backported","project":false,"upstream":[{"sha":"6aa9e61c46465d231e9beddf56af7effd71be682","url":"https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ddbb6e3dc9bb4743de686aa1598c31e745cee76b","label":"ddbb6e3dc9bb","date":"2026-07-24T16:17:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6aa9e61c46465d231e9beddf56af7effd71be682","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/6aa9e61c46465d231e9beddf56af7effd71be682.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72042","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72042.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72028","title":"riscv: probes: save original sp in rethook trampoline","status":"backported","project":false,"upstream":[{"sha":"bc7b086a45521a986a49045907f017e3e46c763e","url":"https://git.kernel.org/stable/c/bc7b086a45521a986a49045907f017e3e46c763e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2faf0198168d2017cb528a79f76c560fda3b6e94","label":"2faf0198168d","date":"2026-07-24T16:17:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"bc7b086a45521a986a49045907f017e3e46c763e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72009","title":"pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI","status":"backported","project":false,"upstream":[{"sha":"99611233f8cda833169fa6487d5dacdf189e5cb0","url":"https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67","label":"4fd5b33faf09","date":"2026-08-03T11:22:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"99611233f8cda833169fa6487d5dacdf189e5cb0","lines":126,"reason":"","source":"https://github.com/torvalds/linux/commit/99611233f8cda833169fa6487d5dacdf189e5cb0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72009","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72009.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72007","title":"pmdomain: imx: Fix i.MX8MP VC8000E power up sequence","status":"backported","project":false,"upstream":[{"sha":"25e252bcf1593b420b12a7231d9dd64b885a2ae2","url":"https://git.kernel.org/stable/c/25e252bcf1593b420b12a7231d9dd64b885a2ae2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4ff3960f3527189bc115a927ed3561c758f562f1","label":"4ff3960f3527","date":"2026-07-24T16:17:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"25e252bcf1593b420b12a7231d9dd64b885a2ae2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72007","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72007.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68480","title":"x86/bugs: Make Safe-RET robust against interrupt injection","status":"backported","project":false,"upstream":[{"sha":"7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9","url":"https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9"},{"sha":"52db77a13be224e09eb4ba6b4252ae8ab9085c2c","url":"https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c"},{"sha":"dfefa3c51370f84acb643cddf98bb42c885d0483","url":"https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483"}],"evidence":[],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9","lines":187,"reason":"","source":"https://github.com/torvalds/linux/commit/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9.patch"},{"sha":"52db77a13be224e09eb4ba6b4252ae8ab9085c2c","lines":190,"reason":"","source":"https://github.com/torvalds/linux/commit/52db77a13be224e09eb4ba6b4252ae8ab9085c2c.patch"},{"sha":"dfefa3c51370f84acb643cddf98bb42c885d0483","lines":190,"reason":"","source":"https://github.com/torvalds/linux/commit/dfefa3c51370f84acb643cddf98bb42c885d0483.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68480","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68480.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68471","title":"wifi: ieee80211: validate MLE common info length","status":"backported","project":false,"upstream":[{"sha":"293baeae9b2434a3e432629d7720b5603db2d77e","url":"https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/90576bd6921a91eb038bffbb4b9467c2dc26aa1d","label":"90576bd6921a","date":"2026-07-24T16:17:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"293baeae9b2434a3e432629d7720b5603db2d77e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68471","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68471.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68470","title":"wifi: mac80211: validate extension-frame layout before RX","status":"backported","project":false,"upstream":[{"sha":"57d503ce32eccfa7650065ca4c560f7e29a2e676","url":"https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1c3d9c6bd5b795f3b952b40d574c8e424e14a39b","label":"1c3d9c6bd5b7","date":"2026-10-15T11:57:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"57d503ce32eccfa7650065ca4c560f7e29a2e676","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/57d503ce32eccfa7650065ca4c560f7e29a2e676.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68470","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68470.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68447","title":"drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size","status":"unfixed","project":false,"upstream":[{"sha":"426ffae6ecc7ec77d32bf8be065c21a1b881b084","url":"https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"426ffae6ecc7ec77d32bf8be065c21a1b881b084","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/426ffae6ecc7ec77d32bf8be065c21a1b881b084.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68447","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68447.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68421","title":"sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()","status":"backported","project":false,"upstream":[{"sha":"b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da","url":"https://git.kernel.org/stable/c/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2907e9d0f05b506dfd58aec589a23042a56ef36b","label":"2907e9d0f05b","date":"2026-08-03T11:21:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68421","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68421.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68412","title":"wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()","status":"backported","project":false,"upstream":[{"sha":"c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6","url":"https://git.kernel.org/stable/c/c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e67dc2b8d5ac4bb804000b6732768a9ae678912f","label":"e67dc2b8d5ac","date":"2026-08-03T11:21:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68412","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68412.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68391","title":"Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds","status":"backported","project":false,"upstream":[{"sha":"da55f570191d5d72f10c607a7043b947eb05ea46","url":"https://git.kernel.org/stable/c/da55f570191d5d72f10c607a7043b947eb05ea46"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d5b3b484b62bb0f4542e7622789d28871626cdf0","label":"d5b3b484b62b","date":"2026-08-03T11:21:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"da55f570191d5d72f10c607a7043b947eb05ea46","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68391","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68391.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68382","title":"drm/xe/guc: Hold device ref until queue teardown completes","status":"backported","project":false,"upstream":[{"sha":"9b7e60184f4b22e893d4ae95234d5f26261a430c","url":"https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/81f70f130eff985fb678d8b891c960381bc7e900","label":"81f70f130eff","date":"2026-10-15T11:57:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"9b7e60184f4b22e893d4ae95234d5f26261a430c","lines":263,"reason":"","source":"https://github.com/torvalds/linux/commit/9b7e60184f4b22e893d4ae95234d5f26261a430c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68382","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68382.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68337","title":"bpf: Reject redirect helpers without a bpf_net_context","status":"backported","project":true,"upstream":[{"sha":"3f4920d165b29052255527d8ae7619e7ec132ece","url":"https://git.kernel.org/stable/c/3f4920d165b29052255527d8ae7619e7ec132ece"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aafb093adffad91d4d071e8a7e0dcd9b1d91c94a","label":"aafb093adffa","date":"2026-09-21T15:05:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f4920d165b29052255527d8ae7619e7ec132ece","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/3f4920d165b29052255527d8ae7619e7ec132ece.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68303","title":"drm/vc4: hvs/v3d: Fix null dereference in unbind","status":"backported","project":true,"upstream":[{"sha":"7dc3680b7ffe01add3e9299fde8471d2dd53a8ae","url":"https://git.kernel.org/stable/c/7dc3680b7ffe01add3e9299fde8471d2dd53a8ae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/708688ec31ac6b35103ba364dc300a09930079d4","label":"708688ec31ac","date":"2026-09-21T15:05:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7dc3680b7ffe01add3e9299fde8471d2dd53a8ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68303","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68303.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68290","title":"rds: tcp: unregister sysctl before tearing down listen socket","status":"backported","project":false,"upstream":[{"sha":"167e54c703ccd4fa028feb568b0d1002020cff86","url":"https://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86"}],"evidence":[{"url":"https://git.kernel.org/stable/c/16df2d154ec82e2f7e7585b4fa154751ba37729a","label":"16df2d154ec8","date":"2026-08-03T11:21:47+02:00","lore":["https://lore.kernel.org/all/20260719203718.9680-1-blbllhy@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"167e54c703ccd4fa028feb568b0d1002020cff86","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/167e54c703ccd4fa028feb568b0d1002020cff86.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68290","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68290.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68289","title":"tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()","status":"backported","project":true,"upstream":[{"sha":"47f42ff521b4eeb46e82f9a46a4783a99f7570d7","url":"https://git.kernel.org/stable/c/47f42ff521b4eeb46e82f9a46a4783a99f7570d7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7364014fdc289225229eb08de8bcbf4580e78e4d","label":"7364014fdc28","date":"2026-09-21T15:05:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"47f42ff521b4eeb46e82f9a46a4783a99f7570d7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68288","title":"net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD","status":"backported","project":true,"upstream":[{"sha":"5e9c8baee0329fbefe7c67aea945e2a07f15e98b","url":"https://git.kernel.org/stable/c/5e9c8baee0329fbefe7c67aea945e2a07f15e98b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/89178ffe5bddc99c057ba2768db1f8d9c5e1408c","label":"89178ffe5bdd","date":"2026-09-21T15:05:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5e9c8baee0329fbefe7c67aea945e2a07f15e98b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68287","title":"drop_monitor: fix size calculations for 64-bit attributes","status":"backported","project":true,"upstream":[{"sha":"7089f7ab99c89f443c92d8fcc585e63f2727f0b3","url":"https://git.kernel.org/stable/c/7089f7ab99c89f443c92d8fcc585e63f2727f0b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/925669d4cfd47a9019ab29b40676215bab5dae35","label":"925669d4cfd4","date":"2026-09-21T15:05:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"7089f7ab99c89f443c92d8fcc585e63f2727f0b3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68287","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68287.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68286","title":"drop_monitor: perform u64_stats updates under IRQ-disabled section","status":"backported","project":true,"upstream":[{"sha":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","url":"https://git.kernel.org/stable/c/fd098a23bf8fda7eae48db9b06e7c34fc4d228fa"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7d857cf5f0120bb0e020fa20b03bd21b9d3e0c04","label":"7d857cf5f012","date":"2026-09-21T15:05:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68286","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68286.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68245","title":"drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()","status":"backported","project":false,"upstream":[{"sha":"04cc4aa3617b0ed67e859f91f09de5d896a46f3a","url":"https://git.kernel.org/stable/c/04cc4aa3617b0ed67e859f91f09de5d896a46f3a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1173190412fb9d12e7efce76734118d9712ff970","label":"1173190412fb","date":"2026-08-03T11:21:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"04cc4aa3617b0ed67e859f91f09de5d896a46f3a","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/04cc4aa3617b0ed67e859f91f09de5d896a46f3a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68245","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68245.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68205","title":"media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()","status":"backported","project":false,"upstream":[{"sha":"06cb687a5132fcffe624c0070576ab852ac6b568","url":"https://git.kernel.org/stable/c/06cb687a5132fcffe624c0070576ab852ac6b568"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cf9732fd6c4f2f803ccfc46d89489b6635590270","label":"cf9732fd6c4f","date":"2026-08-03T11:21:56+02:00","lore":["https://lore.kernel.org/linux-media/20240315073125.275501-2-sakari.ailus@linux.intel.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"06cb687a5132fcffe624c0070576ab852ac6b568","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/06cb687a5132fcffe624c0070576ab852ac6b568.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68205","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68205.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68161","title":"sctp: close UDP tunnel sockets during netns teardown","status":"backported","project":false,"upstream":[{"sha":"ffb2bd7ade36ec4da32c46a6eddbf4515316d08c","url":"https://git.kernel.org/stable/c/ffb2bd7ade36ec4da32c46a6eddbf4515316d08c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3bf0e349cbb4f975f35eb22753acc346b89c66a0","label":"3bf0e349cbb4","date":"2026-08-03T11:22:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ffb2bd7ade36ec4da32c46a6eddbf4515316d08c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68152","title":"amt: fix use-after-free in AMT delayed works","status":"backported","project":false,"upstream":[{"sha":"ea20c44935d6142daecfa9b39d635033a7553e1b","url":"https://git.kernel.org/stable/c/ea20c44935d6142daecfa9b39d635033a7553e1b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1a644db2cf59f164cdf3c75995bab5aadc097528","label":"1a644db2cf59","date":"2026-08-03T11:22:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ea20c44935d6142daecfa9b39d635033a7553e1b","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/ea20c44935d6142daecfa9b39d635033a7553e1b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68152","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68152.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68112","title":"drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()","status":"backported","project":false,"upstream":[{"sha":"00f4050f7c367d7bdce347ca279ce467c434cf15","url":"https://git.kernel.org/stable/c/00f4050f7c367d7bdce347ca279ce467c434cf15"}],"evidence":[{"url":"https://git.kernel.org/stable/c/05aea3344c422fe95299bb1b21a04de30c7ea198","label":"05aea3344c42","date":"2026-08-03T11:22:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00f4050f7c367d7bdce347ca279ce467c434cf15","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/00f4050f7c367d7bdce347ca279ce467c434cf15.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68112","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68112.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68103","title":"drm/amdgpu: reject mapping a reserved doorbell to a new queue","status":"unfixed","project":false,"upstream":[{"sha":"a609b6278bf3cde17eeee6620091465521e4b02c","url":"https://git.kernel.org/stable/c/a609b6278bf3cde17eeee6620091465521e4b02c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"a609b6278bf3cde17eeee6620091465521e4b02c","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a609b6278bf3cde17eeee6620091465521e4b02c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68097","title":"ksmbd: validate ACE size against SID sub-authorities","status":"backported","project":false,"upstream":[{"sha":"5152c6d49e3fd4e9f2e857c57527aead752f1f87","url":"https://git.kernel.org/stable/c/5152c6d49e3fd4e9f2e857c57527aead752f1f87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/337022d9dfac441c3b35e4455a51aa981996e02e","label":"337022d9dfac","date":"2026-08-03T11:22:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5152c6d49e3fd4e9f2e857c57527aead752f1f87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68086","title":"mm/khugepaged: write all dirty file folios when collapsing","status":"unfixed","project":false,"upstream":[{"sha":"2dfe9f5c91d0963058f8a5e46e1c2a908382cc46","url":"https://git.kernel.org/stable/c/2dfe9f5c91d0963058f8a5e46e1c2a908382cc46"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2dfe9f5c91d0963058f8a5e46e1c2a908382cc46","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/2dfe9f5c91d0963058f8a5e46e1c2a908382cc46.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68086","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68086.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68085","title":"Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled","status":"backported","project":false,"upstream":[{"sha":"1b0d946d6f08bd39211385bc703a440911b41e46","url":"https://git.kernel.org/stable/c/1b0d946d6f08bd39211385bc703a440911b41e46"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b9dd39cf1667e378b25a082ca796d495d578c5d3","label":"b9dd39cf1667","date":"2026-07-18T16:53:17+02:00","lore":["https://lore.kernel.org/linux-bluetooth/07e0a28650773abec711ee492fdb1bf5d21a6c98.camel@iki.fi/"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"1b0d946d6f08bd39211385bc703a440911b41e46","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/1b0d946d6f08bd39211385bc703a440911b41e46.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64525","title":"xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit","status":"backported","project":false,"upstream":[{"sha":"3e52417318473782012b236d0325bf7d2266a597","url":"https://git.kernel.org/stable/c/3e52417318473782012b236d0325bf7d2266a597"}],"evidence":[{"url":"https://git.kernel.org/stable/c/91cc13978ab0bc6f669139f53e7e613a860d10e0","label":"91cc13978ab0","date":"2026-06-09T12:28:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"3e52417318473782012b236d0325bf7d2266a597","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/3e52417318473782012b236d0325bf7d2266a597.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64525","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64525.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64520","title":"firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies","status":"backported","project":false,"upstream":[{"sha":"3974ea1938406f9bfa7c1f48d4e43533f447bb08","url":"https://git.kernel.org/stable/c/3974ea1938406f9bfa7c1f48d4e43533f447bb08"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95","label":"f39bc7ebe75e","date":"2026-06-01T17:50:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3974ea1938406f9bfa7c1f48d4e43533f447bb08","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/3974ea1938406f9bfa7c1f48d4e43533f447bb08.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64520","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64520.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64513","title":"KVM: x86: Unconditionally recompute CR8 intercept on PPR update","status":"backported","project":false,"upstream":[{"sha":"bb365a506b1e6fb050c0fceaad354fe395385ef0","url":"https://git.kernel.org/stable/c/bb365a506b1e6fb050c0fceaad354fe395385ef0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ff9c4c6428883182960cfe5c78928f0896d80ebc","label":"ff9c4c642888","date":"2026-07-18T16:53:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bb365a506b1e6fb050c0fceaad354fe395385ef0","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/bb365a506b1e6fb050c0fceaad354fe395385ef0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64513","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64513.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64481","title":"ALSA: hda/cs35l41: Fix firmware load work teardown","status":"backported","project":false,"upstream":[{"sha":"b65020d5398f499c09498c9786dba6d67ae57664","url":"https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ce0a903d0591e3e2c790c5b628802b08d1b287cc","label":"ce0a903d0591","date":"2026-07-18T16:53:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"b65020d5398f499c09498c9786dba6d67ae57664","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64481","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64481.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64424","title":"netpoll: fix a use-after-free on shutdown path","status":"backported","project":false,"upstream":[{"sha":"45f1458a85017a023f138b22ac5c76abd477db42","url":"https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a33f37f8d079da7236ed7b7e2aed2a34ab81e7cf","label":"a33f37f8d079","date":"2026-07-18T16:53:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"45f1458a85017a023f138b22ac5c76abd477db42","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/45f1458a85017a023f138b22ac5c76abd477db42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64305","title":"crypto: qat - protect service table iterations with service_lock","status":"backported","project":false,"upstream":[{"sha":"5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e","url":"https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c3c5925791cff3b84d313293fd60f384d877d793","label":"c3c5925791cf","date":"2026-07-18T16:53:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64305","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64305.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64255","title":"wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers","status":"backported","project":false,"upstream":[{"sha":"f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","url":"https://git.kernel.org/stable/c/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1de92789ce31e46fa7e7d8e89c90b19cdb1c103b","label":"1de92789ce31","date":"2026-07-04T13:44:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64255","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64255.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64241","title":"gpio: rockchip: teardown bugs and resource leaks","status":"backported","project":false,"upstream":[{"sha":"9500077678230e36d22bf16d2b9539c13e59a801","url":"https://git.kernel.org/stable/c/9500077678230e36d22bf16d2b9539c13e59a801"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7f945f7f10f442270518dfd768d230227c495fcf","label":"7f945f7f10f4","date":"2026-06-09T12:28:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9500077678230e36d22bf16d2b9539c13e59a801","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/9500077678230e36d22bf16d2b9539c13e59a801.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64241","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64241.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64212","title":"wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it","status":"backported","project":false,"upstream":[{"sha":"d733ed481fd20a8e7bfe5119c4e77761ba3f87ee","url":"https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3a74aaad047353da3344aed32e9042d4f334f926","label":"3a74aaad0473","date":"2026-06-01T17:51:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"d733ed481fd20a8e7bfe5119c4e77761ba3f87ee","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64212","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64212.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64190","title":"net: team: fix NULL pointer dereference in team_xmit during mode change","status":"backported","project":false,"upstream":[{"sha":"25fe708bbc59289d3d1ea4b126fbc1b460a072a5","url":"https://git.kernel.org/stable/c/25fe708bbc59289d3d1ea4b126fbc1b460a072a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/03e9405c518c4d61f28079492f252d6d4e2bac5c","label":"03e9405c518c","date":"2026-06-09T12:28:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"25fe708bbc59289d3d1ea4b126fbc1b460a072a5","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64190","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64190.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64163","title":"test_kprobes: clear kprobes between test runs","status":"backported","project":false,"upstream":[{"sha":"ef5581bb30efb939cc2bf093475c6cc85258e5cd","url":"https://git.kernel.org/stable/c/ef5581bb30efb939cc2bf093475c6cc85258e5cd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1c24cf1fd67f6702c719ab73499392cb7af956ae","label":"1c24cf1fd67f","date":"2026-06-01T17:50:54+02:00","lore":["https://lore.kernel.org/all/20260507134615.1010905-1-martin@kaiser.cx/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ef5581bb30efb939cc2bf093475c6cc85258e5cd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64163","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64163.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64160","title":"netfs: Fix potential for tearing in ->remote_i_size and ->zero_point","status":"unfixed","project":false,"upstream":[{"sha":"2c8f4742bb76117d735f92a3932d85239b16c494","url":"https://git.kernel.org/stable/c/2c8f4742bb76117d735f92a3932d85239b16c494"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"2c8f4742bb76117d735f92a3932d85239b16c494","lines":953,"reason":"","source":"https://github.com/torvalds/linux/commit/2c8f4742bb76117d735f92a3932d85239b16c494.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64160","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64160.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64112","title":"rbd: eliminate a race in lock_dwork draining on unmap","status":"backported","project":false,"upstream":[{"sha":"9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90","url":"https://git.kernel.org/stable/c/9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9dcd4f5c99b491c37be90b0bd9988db48225fb75","label":"9dcd4f5c99b4","date":"2026-06-01T17:50:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64112","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64112.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64109","title":"af_unix: Fix UAF read of tail->len in unix_stream_data_wait()","status":"backported","project":false,"upstream":[{"sha":"be309f8eae8b474a4a617eaae01324da996fc719","url":"https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719"}],"evidence":[{"url":"https://git.kernel.org/stable/c/acdff9907478e82208475b1151700d0b71dcdc63","label":"acdff9907478","date":"2026-06-01T17:50:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"be309f8eae8b474a4a617eaae01324da996fc719","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/be309f8eae8b474a4a617eaae01324da996fc719.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64109","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64109.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64082","title":"riscv: Fix register corruption from uninitialized cregs on error","status":"backported","project":false,"upstream":[{"sha":"6ebcbb53fc9bc30843054ed99fd60b8e542628f4","url":"https://git.kernel.org/stable/c/6ebcbb53fc9bc30843054ed99fd60b8e542628f4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0599aa23734c48de9bce36d043a9ec90c23945a1","label":"0599aa23734c","date":"2026-09-02T14:31:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6ebcbb53fc9bc30843054ed99fd60b8e542628f4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64082","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64082.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64079","title":"netfilter: x_tables: allocate hook ops while under mutex","status":"backported","project":false,"upstream":[{"sha":"b62eb8dcf2c47d4d676a434efbd57c4f776f7829","url":"https://git.kernel.org/stable/c/b62eb8dcf2c47d4d676a434efbd57c4f776f7829"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f669571a2bf5067f50091cc598df9613663ee226","label":"f669571a2bf5","date":"2026-10-15T11:57:53+02:00","lore":["https://lore.kernel.org/netfilter-devel/20260429175613.1459342-1-tristmd@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"b62eb8dcf2c47d4d676a434efbd57c4f776f7829","lines":271,"reason":"","source":"https://github.com/torvalds/linux/commit/b62eb8dcf2c47d4d676a434efbd57c4f776f7829.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64078","title":"netfilter: x_tables: add and use xtables_unregister_table_exit","status":"backported","project":false,"upstream":[{"sha":"b4597d5fd7d2f8cebfffd40dffb5e003cc78964c","url":"https://git.kernel.org/stable/c/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/86ee5bc9c0f0e652e19f395675a432de11b75514","label":"86ee5bc9c0f0","date":"2026-06-01T17:50:53+02:00","lore":["https://lore.kernel.org/netfilter-devel/20260429175613.1459342-1-tristmd@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"b4597d5fd7d2f8cebfffd40dffb5e003cc78964c","lines":246,"reason":"","source":"https://github.com/torvalds/linux/commit/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64078","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64078.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64070","title":"powerpc/hv-gpci: fix preempt count leak in sysfs show paths","status":"backported","project":false,"upstream":[{"sha":"dbc30a57bd8e026995e9fa8e8c31cffd18542c01","url":"https://git.kernel.org/stable/c/dbc30a57bd8e026995e9fa8e8c31cffd18542c01"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b61ebb2826ca1852c2bbd92a676fb622c358cab4","label":"b61ebb2826ca","date":"2026-09-02T14:31:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"dbc30a57bd8e026995e9fa8e8c31cffd18542c01","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64070","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64070.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64068","title":"netfs: Fix missing locking around retry adding new subreqs","status":"backported","project":true,"upstream":[{"sha":"cce18c263e9623872327ba3c956012f73c1179cc","url":"https://git.kernel.org/stable/c/cce18c263e9623872327ba3c956012f73c1179cc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d5c9d19b0ff2f7153532ac238a5e96fed2df315c","label":"d5c9d19b0ff2","date":"2026-09-07T17:22:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"cce18c263e9623872327ba3c956012f73c1179cc","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64068","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64068.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64067","title":"netfs: Fix missing barriers when accessing stream->subrequests locklessly","status":"backported","project":false,"upstream":[{"sha":"b5782e2d462c028096f922abca46318cec890670","url":"https://git.kernel.org/stable/c/b5782e2d462c028096f922abca46318cec890670"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f048f297d93fdb19d72d01d22f04c419d8b16602","label":"f048f297d93f","date":"2026-10-15T11:57:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5782e2d462c028096f922abca46318cec890670","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/b5782e2d462c028096f922abca46318cec890670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64067","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64067.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64066","title":"netfs: Fix netfs_read_to_pagecache() to pause on subreq failure","status":"backported","project":false,"upstream":[{"sha":"8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4","url":"https://git.kernel.org/stable/c/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/884c4c4f35e577aba6a0593c80cbea9ca5e6e2b8","label":"884c4c4f35e5","date":"2026-06-01T17:50:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64066","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64066.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64060","title":"netfs: Fix leak of request in netfs_write_begin() error handling","status":"backported","project":false,"upstream":[{"sha":"5046a34f0643441f05b0253ea64e1a3af87efe14","url":"https://git.kernel.org/stable/c/5046a34f0643441f05b0253ea64e1a3af87efe14"}],"evidence":[{"url":"https://git.kernel.org/stable/c/22ae28aae43623be235ff455558cdd13fbe2daeb","label":"22ae28aae436","date":"2026-06-01T17:50:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5046a34f0643441f05b0253ea64e1a3af87efe14","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/5046a34f0643441f05b0253ea64e1a3af87efe14.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64060","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64060.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64026","title":"rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg","status":"backported","project":false,"upstream":[{"sha":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","url":"https://git.kernel.org/stable/c/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/46cb765e2e5ad52303ea157e10d370bb6b7acbbf","label":"46cb765e2e5a","date":"2026-06-09T12:28:50+02:00","lore":["https://lore.kernel.org/r/afKV2zGR6rrelPC7@v4bel/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","lines":534,"reason":"","source":"https://github.com/torvalds/linux/commit/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64017","title":"blk-mq: pop cached request if it is usable","status":"backported","project":false,"upstream":[{"sha":"dc278e9bf2b9513a763353e6b9cc21e0f532954e","url":"https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/97e2d08de282ef76f84ab4ccd00f1acb3f5f999e","label":"97e2d08de282","date":"2026-08-19T18:18:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"dc278e9bf2b9513a763353e6b9cc21e0f532954e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64001","title":"ALSA: pcm: oss: Fix setup list UAF on proc write error","status":"backported","project":false,"upstream":[{"sha":"4cc54bdd54b337e77115be5b55577d1c58608eae","url":"https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e13922bb97b4e6f94f8ac02d034f2d4bd65eeb3c","label":"e13922bb97b4","date":"2026-06-09T12:28:25+02:00","lore":["https://lore.kernel.org/all/6a1062b7.170a0220.35b2b7.0003.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4cc54bdd54b337e77115be5b55577d1c58608eae","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/4cc54bdd54b337e77115be5b55577d1c58608eae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64001","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64001.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63999","title":"ethtool: rss: fix indir_table and hkey leak on get_rxfh failure","status":"backported","project":false,"upstream":[{"sha":"266297692f97008ca48bc311775c087c59bd7fe3","url":"https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/33d05c22d6f227c5ae171c46df2f6f8bf48047ea","label":"33d05c22d6f2","date":"2026-06-09T12:28:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"266297692f97008ca48bc311775c087c59bd7fe3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/266297692f97008ca48bc311775c087c59bd7fe3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63983","title":"net/sched: fix packet loop on netem when duplicate is on","status":"backported","project":false,"upstream":[{"sha":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","url":"https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4ec3a8ca97394f17e73a4d8d4c79c1c78b322772","label":"4ec3a8ca9739","date":"2026-10-15T11:57:52+02:00","lore":["https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/9552b11e3edabc97cfcd9f29103d5afbce7ae183.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63983","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63983.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63977","title":"dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work","status":"unfixed","project":false,"upstream":[{"sha":"d733f519f6443540f8359461a34e3b0042099bbe","url":"https://git.kernel.org/stable/c/d733f519f6443540f8359461a34e3b0042099bbe"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"d733f519f6443540f8359461a34e3b0042099bbe","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/d733f519f6443540f8359461a34e3b0042099bbe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63977","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63977.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63959","title":"usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT","status":"backported","project":false,"upstream":[{"sha":"aa2f716327be1818e1cb156da8a2844804aaec2f","url":"https://git.kernel.org/stable/c/aa2f716327be1818e1cb156da8a2844804aaec2f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9b496e3371c04f0a03b7faa5d2442536d00e3998","label":"9b496e3371c0","date":"2026-06-09T12:28:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"aa2f716327be1818e1cb156da8a2844804aaec2f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63959","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63959.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63941","title":"KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor","status":"backported","project":false,"upstream":[{"sha":"83726330748981372bde86ed5411d7b306612991","url":"https://git.kernel.org/stable/c/83726330748981372bde86ed5411d7b306612991"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2090c1a2368339eab0e14dcde12fdf6a5ea6359d","label":"2090c1a23683","date":"2026-10-15T11:57:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"83726330748981372bde86ed5411d7b306612991","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/83726330748981372bde86ed5411d7b306612991.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63941","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63941.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63871","title":"Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls","status":"backported","project":false,"upstream":[{"sha":"9ca7053d6215d89c33f28893bfd1625a32919d3f","url":"https://git.kernel.org/stable/c/9ca7053d6215d89c33f28893bfd1625a32919d3f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ab84fd7779a2a7ff5d2c8eac212c43733f56216e","label":"ab84fd7779a2","date":"2026-06-19T13:43:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"9ca7053d6215d89c33f28893bfd1625a32919d3f","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/9ca7053d6215d89c33f28893bfd1625a32919d3f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63871","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63871.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63858","title":"netfilter: nf_tables: add hook transactions for device deletions","status":"backported","project":false,"upstream":[{"sha":"10f79dbd7719d1da9f5884d13060322d8729f091","url":"https://git.kernel.org/stable/c/10f79dbd7719d1da9f5884d13060322d8729f091"}],"evidence":[{"url":"https://git.kernel.org/stable/c/768daa9f4276be4007e88dea61a378c8582ba008","label":"768daa9f4276","date":"2026-10-15T11:57:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"10f79dbd7719d1da9f5884d13060322d8729f091","lines":525,"reason":"","source":"https://github.com/torvalds/linux/commit/10f79dbd7719d1da9f5884d13060322d8729f091.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63858","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63858.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63839","title":"platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()","status":"backported","project":true,"upstream":[{"sha":"0c3887a134f191723b53e2a47e501b534c8723ee","url":"https://git.kernel.org/stable/c/0c3887a134f191723b53e2a47e501b534c8723ee"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ce493f9261cd3f4bffe2f72481d8c3ee01c559a3","label":"ce493f9261cd","date":"2026-09-07T17:22:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0c3887a134f191723b53e2a47e501b534c8723ee","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63839","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63839.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63819","title":"f2fs: fix to do sanity check on f2fs_get_node_folio_ra()","status":"backported","project":false,"upstream":[{"sha":"8712353ed80f87271d732297567dcdbe4b84e8c7","url":"https://git.kernel.org/stable/c/8712353ed80f87271d732297567dcdbe4b84e8c7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/406c28af75123432d38cf9bbaa6f1476f7b14770","label":"406c28af7512","date":"2026-07-18T16:53:05+02:00","lore":["https://lore.kernel.org/all/69fa3697.170a0220.59368.0018.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8712353ed80f87271d732297567dcdbe4b84e8c7","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8712353ed80f87271d732297567dcdbe4b84e8c7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63819","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63819.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63816","title":"f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode","status":"backported","project":false,"upstream":[{"sha":"e0288584baa5dc41df4a829a023c4c1b33fe53d7","url":"https://git.kernel.org/stable/c/e0288584baa5dc41df4a829a023c4c1b33fe53d7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a499f77c06050a28c897bdbd86cd2f0721ae0743","label":"a499f77c0605","date":"2026-07-18T16:53:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"e0288584baa5dc41df4a829a023c4c1b33fe53d7","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/e0288584baa5dc41df4a829a023c4c1b33fe53d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63816","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63816.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63805","title":"crypto: nx - fix nx_crypto_ctx_exit argument","status":"backported","project":false,"upstream":[{"sha":"4e67f504ee9ded15e256b64f4fde150e917381d7","url":"https://git.kernel.org/stable/c/4e67f504ee9ded15e256b64f4fde150e917381d7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8d8507a457667f23477a15496b91908a5b5b7cf3","label":"8d8507a45766","date":"2026-07-04T13:44:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4e67f504ee9ded15e256b64f4fde150e917381d7","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/4e67f504ee9ded15e256b64f4fde150e917381d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63805","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63805.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53368","title":"f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage","status":"backported","project":false,"upstream":[{"sha":"019f9dda7f66e55eb94cd32e1d3fff5835f73fbc","url":"https://git.kernel.org/stable/c/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bedb710b63ae1bd617e65d0a8cf6cea1200b3753","label":"bedb710b63ae","date":"2026-05-14T15:30:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"019f9dda7f66e55eb94cd32e1d3fff5835f73fbc","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53368","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53368.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53313","title":"drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths","status":"backported","project":true,"upstream":[{"sha":"4ae3e16f4b3bf64140f773629b765d605ee079a9","url":"https://git.kernel.org/stable/c/4ae3e16f4b3bf64140f773629b765d605ee079a9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2ab18de5ebb11c76bfc8087c5a09fbcccd0dea8a","label":"2ab18de5ebb1","date":"2026-09-07T17:22:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"4ae3e16f4b3bf64140f773629b765d605ee079a9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53285","title":"drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED","status":"backported","project":false,"upstream":[{"sha":"183182235f6d53bac62c6c39014738a54a68dfa6","url":"https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a8c1480bb066cf0f6e79129b7292e1c99ff68b9b","label":"a8c1480bb066","date":"2026-10-15T11:57:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"183182235f6d53bac62c6c39014738a54a68dfa6","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/183182235f6d53bac62c6c39014738a54a68dfa6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53285","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53285.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53246","title":"sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing","status":"backported","project":false,"upstream":[{"sha":"0861615c28de668669d748ef4eb913ea9262d13b","url":"https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cc272185c9a9a4b7febc2de52eeaa3d00f19091e","label":"cc272185c9a9","date":"2026-06-19T13:43:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0861615c28de668669d748ef4eb913ea9262d13b","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/0861615c28de668669d748ef4eb913ea9262d13b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53246","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53246.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53226","title":"gpio: rockchip: fix generic IRQ chip leak on remove","status":"backported","project":false,"upstream":[{"sha":"1c1e0fc88d6ef65bf15d517853251f75ab9d18c3","url":"https://git.kernel.org/stable/c/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bace7b99bfa555fe833aee8827b8004c43666d02","label":"bace7b99bfa5","date":"2026-06-19T13:43:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c1e0fc88d6ef65bf15d517853251f75ab9d18c3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53226","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53226.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53185","title":"zram: fix use-after-free in zram_bvec_write_partial()","status":"backported","project":false,"upstream":[{"sha":"732fd9f0b9c1cdc6dfd77162ded60df005182cc0","url":"https://git.kernel.org/stable/c/732fd9f0b9c1cdc6dfd77162ded60df005182cc0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c96786d6ff1acc1d54d9241e97767554c1dfdd5b","label":"c96786d6ff1a","date":"2026-06-19T13:44:05+02:00","lore":["https://lore.kernel.org/20260528-zram-v3-1-cab86eef8764@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"732fd9f0b9c1cdc6dfd77162ded60df005182cc0","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/732fd9f0b9c1cdc6dfd77162ded60df005182cc0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53185","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53185.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53179","title":"staging: rtl8723bs: fix buffer over-read in rtw_update_protection","status":"backported","project":false,"upstream":[{"sha":"514ab98364595007d4557ecc85d7e5f012c504d3","url":"https://git.kernel.org/stable/c/514ab98364595007d4557ecc85d7e5f012c504d3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/735dabdf21561a24d8bcae456c9c32f7f961a029","label":"735dabdf2156","date":"2026-06-19T13:44:07+02:00","lore":["https://lore.kernel.org/linux-staging/DI2H39EAAFBZ.3KI5NWN02AQ2S@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"514ab98364595007d4557ecc85d7e5f012c504d3","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/514ab98364595007d4557ecc85d7e5f012c504d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53179","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53179.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53178","title":"staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction","status":"backported","project":false,"upstream":[{"sha":"88e994c57a79f62d5338231d8d37ee8dd98baffe","url":"https://git.kernel.org/stable/c/88e994c57a79f62d5338231d8d37ee8dd98baffe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/637e0ea73f690028796ee2fc72a2ac4ec32968c6","label":"637e0ea73f69","date":"2026-09-14T13:36:19+02:00","lore":["https://lore.kernel.org/linux-staging/DI2H39EAAFBZ.3KI5NWN02AQ2S@linux.dev/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"88e994c57a79f62d5338231d8d37ee8dd98baffe","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/88e994c57a79f62d5338231d8d37ee8dd98baffe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53178","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53178.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53156","title":"nvmem: core: fix use-after-free bugs in error paths","status":"backported","project":false,"upstream":[{"sha":"5b6b6fc491899d583eaa75344e094796ae9b530b","url":"https://git.kernel.org/stable/c/5b6b6fc491899d583eaa75344e094796ae9b530b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cb85ef5a227b3662b88f4d849a1aad43bfe7f5ae","label":"cb85ef5a227b","date":"2026-06-19T13:44:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5b6b6fc491899d583eaa75344e094796ae9b530b","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/5b6b6fc491899d583eaa75344e094796ae9b530b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53156","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53156.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53143","title":"drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11","status":"backported","project":false,"upstream":[{"sha":"352ea59028ea48a6fff77f19ae28f98f71946a80","url":"https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64","label":"d3efcadfe3ee","date":"2026-06-19T13:44:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"352ea59028ea48a6fff77f19ae28f98f71946a80","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/352ea59028ea48a6fff77f19ae28f98f71946a80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53143","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53143.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53132","title":"vsock/virtio: fix potential unbounded skb queue","status":"backported","project":false,"upstream":[{"sha":"059b7dbd20a6f0c539a45ddff1573cb8946685b5","url":"https://git.kernel.org/stable/c/059b7dbd20a6f0c539a45ddff1573cb8946685b5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9bdc637fde66b63d6cad0caacd034888bb7bf5f5","label":"9bdc637fde66","date":"2026-06-19T13:44:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"059b7dbd20a6f0c539a45ddff1573cb8946685b5","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/059b7dbd20a6f0c539a45ddff1573cb8946685b5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53132","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53132.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53123","title":"md: wake raid456 reshape waiters before suspend","status":"backported","project":false,"upstream":[{"sha":"cf86bb53b9c92354904a328e947a05ffbfdd1840","url":"https://git.kernel.org/stable/c/cf86bb53b9c92354904a328e947a05ffbfdd1840"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ff6b93410192b812d73cc54062529715b2dc849f","label":"ff6b93410192","date":"2026-05-23T13:06:23+02:00","lore":["https://lore.kernel.org/linux-raid/20260327140729.2030564-1-yukuai@fnnas.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf86bb53b9c92354904a328e947a05ffbfdd1840","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/cf86bb53b9c92354904a328e947a05ffbfdd1840.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53120","title":"PCI: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"10a4206a24013be4d558d476010cbf2eb4c9fa64","url":"https://git.kernel.org/stable/c/10a4206a24013be4d558d476010cbf2eb4c9fa64"}],"evidence":[{"url":"https://git.kernel.org/stable/c/58a42be0d70307d765594fc581f5f5e5ef059712","label":"58a42be0d703","date":"2026-05-23T13:06:24+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"10a4206a24013be4d558d476010cbf2eb4c9fa64","lines":131,"reason":"","source":"https://github.com/torvalds/linux/commit/10a4206a24013be4d558d476010cbf2eb4c9fa64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53120","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53120.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53118","title":"vdpa: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"85bb534ff12aab6916058897b39c748940a7a4c6","url":"https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/654ef9c33e138ede6734ac286282df9faf83cd11","label":"654ef9c33e13","date":"2026-05-23T13:06:24+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"85bb534ff12aab6916058897b39c748940a7a4c6","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/85bb534ff12aab6916058897b39c748940a7a4c6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53117","title":"s390/cio: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4","url":"https://git.kernel.org/stable/c/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2081957d8c323ffb58a10bc64837717ac5a042a1","label":"2081957d8c32","date":"2026-05-23T13:06:24+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53117","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53117.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53115","title":"bus: fsl-mc: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"6c8dfb0362732bf1e4829867a2a5239fedc592d0","url":"https://git.kernel.org/stable/c/6c8dfb0362732bf1e4829867a2a5239fedc592d0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8139ce66b52a4a5638bfb445b037c07d4abeb08e","label":"8139ce66b52a","date":"2026-05-23T13:06:24+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6c8dfb0362732bf1e4829867a2a5239fedc592d0","lines":99,"reason":"","source":"https://github.com/torvalds/linux/commit/6c8dfb0362732bf1e4829867a2a5239fedc592d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53113","title":"wifi: ath11k: fix memory leaks in beacon template setup","status":"backported","project":true,"upstream":[{"sha":"ff49eba595df500e4ddccc593088c8a4ab5f2c27","url":"https://git.kernel.org/stable/c/ff49eba595df500e4ddccc593088c8a4ab5f2c27"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5fc3d921512d31839227a2d22a2990de02acefeb","label":"5fc3d921512d","date":"2026-09-07T17:22:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ff49eba595df500e4ddccc593088c8a4ab5f2c27","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53113","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53113.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53107","title":"wifi: libertas: don't kill URBs in interrupt context","status":"backported","project":false,"upstream":[{"sha":"7c5c2b661bdb78c1472b8833265c9ed1ee880039","url":"https://git.kernel.org/stable/c/7c5c2b661bdb78c1472b8833265c9ed1ee880039"}],"evidence":[{"url":"https://git.kernel.org/stable/c/00c0317cebf44151df18fb647781f315268cdd98","label":"00c0317cebf4","date":"2026-05-23T13:06:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c5c2b661bdb78c1472b8833265c9ed1ee880039","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/7c5c2b661bdb78c1472b8833265c9ed1ee880039.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53107","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53107.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53106","title":"bpf: Do not allow deleting local storage in NMI","status":"unfixed","project":false,"upstream":[{"sha":"350de5b8a9befaa2a68861c51f671d4f5f751ca5","url":"https://git.kernel.org/stable/c/350de5b8a9befaa2a68861c51f671d4f5f751ca5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"350de5b8a9befaa2a68861c51f671d4f5f751ca5","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/350de5b8a9befaa2a68861c51f671d4f5f751ca5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53106","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53106.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53102","title":"wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()","status":"backported","project":true,"upstream":[{"sha":"c41075ce8cf05ed8c0e7b7efef000dce548ffc42","url":"https://git.kernel.org/stable/c/c41075ce8cf05ed8c0e7b7efef000dce548ffc42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8527ac1bce87aaabde6755e8e6eb2a9f439d1292","label":"8527ac1bce87","date":"2026-09-07T17:22:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"c41075ce8cf05ed8c0e7b7efef000dce548ffc42","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53091","title":"net: pull headers in qdisc_pkt_len_segs_init()","status":"unfixed","project":false,"upstream":[{"sha":"7fb4c19670110f052c04e1ec1d2b953b9f4f57e4","url":"https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"7fb4c19670110f052c04e1ec1d2b953b9f4f57e4","lines":118,"reason":"","source":"https://github.com/torvalds/linux/commit/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53091","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53091.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53089","title":"bpf: Fix use-after-free in offloaded map/prog info fill","status":"backported","project":false,"upstream":[{"sha":"a0c584fc18056709c8e047a82a6045d6c209f4ce","url":"https://git.kernel.org/stable/c/a0c584fc18056709c8e047a82a6045d6c209f4ce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/85dc711f742b192eb97c0e00b521312f5a7a415e","label":"85dc711f742b","date":"2026-09-02T14:31:46+02:00","lore":["https://lore.kernel.org/bpf/f0aa3678-79c9-47ae-9e8c-02a3d1df160a@hust.edu.cn/","https://lore.kernel.org/r/20260409023733.168050-1-jiayuan.chen@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a0c584fc18056709c8e047a82a6045d6c209f4ce","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53078","title":"bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops","status":"backported","project":false,"upstream":[{"sha":"10f86a2a5c91fc4c4d001960f1c21abe52545ef6","url":"https://git.kernel.org/stable/c/10f86a2a5c91fc4c4d001960f1c21abe52545ef6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/22400725de070b787cd6d806c5795370ab46d269","label":"22400725de07","date":"2026-08-03T11:22:07+02:00","lore":["https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"10f86a2a5c91fc4c4d001960f1c21abe52545ef6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53078","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53078.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53070","title":"sctp: disable BH before calling udp_tunnel_xmit_skb()","status":"backported","project":false,"upstream":[{"sha":"2cd7e6971fc2787408ceef17906ea152791448cf","url":"https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f","label":"0de7db2eb27e","date":"2026-06-27T11:06:48+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2cd7e6971fc2787408ceef17906ea152791448cf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53070","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53070.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53024","title":"greybus: raw: fix use-after-free if write is called after disconnect","status":"unfixed","project":false,"upstream":[{"sha":"84265cbd96b97058ef67e3f8be3933667a000835","url":"https://git.kernel.org/stable/c/84265cbd96b97058ef67e3f8be3933667a000835"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"84265cbd96b97058ef67e3f8be3933667a000835","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/84265cbd96b97058ef67e3f8be3933667a000835.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53024","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53024.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53015","title":"erofs: unify lcn as u64 for 32-bit platforms","status":"backported","project":false,"upstream":[{"sha":"2d8c7edcb661812249469f4a5b62e9339118846f","url":"https://git.kernel.org/stable/c/2d8c7edcb661812249469f4a5b62e9339118846f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/858e4d98a86adf34584767388deb6c9b217f70c5","label":"858e4d98a86a","date":"2026-05-23T13:06:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2d8c7edcb661812249469f4a5b62e9339118846f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53010","title":"ksmbd: fix use-after-free in smb2_open during durable reconnect","status":"backported","project":false,"upstream":[{"sha":"1baff47b81f94f9231c91236aa511420d0e266b9","url":"https://git.kernel.org/stable/c/1baff47b81f94f9231c91236aa511420d0e266b9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ce2e164c1c51c3f7813b80f8c926836e896bcbb3","label":"ce2e164c1c51","date":"2026-05-23T13:07:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"1baff47b81f94f9231c91236aa511420d0e266b9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52994","title":"vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting","status":"backported","project":false,"upstream":[{"sha":"1cb36e252211506f51095fe7ced8286cc77b4c80","url":"https://git.kernel.org/stable/c/1cb36e252211506f51095fe7ced8286cc77b4c80"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6af1736b5810bc8a4a43a8518530113f5a757dc1","label":"6af1736b5810","date":"2026-05-23T13:07:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1cb36e252211506f51095fe7ced8286cc77b4c80","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/1cb36e252211506f51095fe7ced8286cc77b4c80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52994","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52994.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52961","title":"ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size","status":"backported","project":false,"upstream":[{"sha":"0c22d9511cbde746622f8e4c11aaa63fe76d45f9","url":"https://git.kernel.org/stable/c/0c22d9511cbde746622f8e4c11aaa63fe76d45f9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d5bd8b4e39cfa8b087448adcd48088065cd629d5","label":"d5bd8b4e39cf","date":"2026-05-23T13:07:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0c22d9511cbde746622f8e4c11aaa63fe76d45f9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52960","title":"ceph: put folios not suitable for writeback","status":"backported","project":false,"upstream":[{"sha":"544576f0f05c4a759806acddfaaeb686f14fb4b0","url":"https://git.kernel.org/stable/c/544576f0f05c4a759806acddfaaeb686f14fb4b0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/349499a65b6b5fb6f66ba3673598ab558f48c544","label":"349499a65b6b","date":"2026-10-15T11:57:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"544576f0f05c4a759806acddfaaeb686f14fb4b0","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/544576f0f05c4a759806acddfaaeb686f14fb4b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52960","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52960.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52953","title":"iommu/vt-d: Fix oops due to out of scope access","status":"backported","project":false,"upstream":[{"sha":"a6dea58d8625c06b9654c0555f101742481335c3","url":"https://git.kernel.org/stable/c/a6dea58d8625c06b9654c0555f101742481335c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/88397fad7914ee74a7880fa5ce01f9eb6bfe0743","label":"88397fad7914","date":"2026-05-23T13:07:19+02:00","lore":["https://lore.kernel.org/r/20260421031347.1408890-1-zhenzhong.duan@intel.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6dea58d8625c06b9654c0555f101742481335c3","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a6dea58d8625c06b9654c0555f101742481335c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52953","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52953.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52944","title":"ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE","status":"backported","project":false,"upstream":[{"sha":"cc57232cae23c0df91b4a59d0f519141ce9b5b02","url":"https://git.kernel.org/stable/c/cc57232cae23c0df91b4a59d0f519141ce9b5b02"}],"evidence":[{"url":"https://git.kernel.org/stable/c/de9eb0b44fa9123170e6245b49638e0e453c10f8","label":"de9eb0b44fa9","date":"2026-06-09T12:28:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"cc57232cae23c0df91b4a59d0f519141ce9b5b02","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46317","title":"KVM: arm64: Reassign nested_mmus array behind mmu_lock","status":"backported","project":false,"upstream":[{"sha":"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8","url":"https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/918450ad6010df6ecd2efde12a1409e011da22d6","label":"918450ad6010","date":"2026-06-09T12:28:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46314","title":"drm/v3d: Reject empty multisync extension to prevent infinite loop","status":"backported","project":false,"upstream":[{"sha":"fb44d589bf3148e13452185a6e772a7efbf2d684","url":"https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433","label":"4fa42a249e8c","date":"2026-05-23T13:07:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb44d589bf3148e13452185a6e772a7efbf2d684","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/fb44d589bf3148e13452185a6e772a7efbf2d684.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46314","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46314.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46282","title":"iio: frequency: admv1013: fix NULL pointer dereference on str","status":"backported","project":false,"upstream":[{"sha":"aac0a51b16700b403a55b67ba495de021db78763","url":"https://git.kernel.org/stable/c/aac0a51b16700b403a55b67ba495de021db78763"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5e9f1bad26df3d3afb3cbbfa408b6d6e809708ac","label":"5e9f1bad26df","date":"2026-05-07T06:12:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aac0a51b16700b403a55b67ba495de021db78763","lines":93,"reason":"","source":"https://github.com/torvalds/linux/commit/aac0a51b16700b403a55b67ba495de021db78763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46282","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46282.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46279","title":"mm/alloc_tag: clear codetag for pages allocated before page_ext initialization","status":"backported","project":false,"upstream":[{"sha":"6b1842775a460245e97d36d3a67d0cfba7c4ff79","url":"https://git.kernel.org/stable/c/6b1842775a460245e97d36d3a67d0cfba7c4ff79"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d5b495ba9de0423ef39f8bd86729a885870c7efe","label":"d5b495ba9de0","date":"2026-05-07T06:11:39+02:00","lore":["https://lore.kernel.org/20260331081312.123719-1-hao.ge@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"6b1842775a460245e97d36d3a67d0cfba7c4ff79","lines":162,"reason":"","source":"https://github.com/torvalds/linux/commit/6b1842775a460245e97d36d3a67d0cfba7c4ff79.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46279","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46279.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46274","title":"io-wq: check that the predecessor is hashed in io_wq_remove_pending()","status":"backported","project":false,"upstream":[{"sha":"d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc","url":"https://git.kernel.org/stable/c/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/252c5051dba9c709b6a72f2866f93e5e618b3f06","label":"252c5051dba9","date":"2026-05-23T13:07:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46274","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46274.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46254","title":"AppArmor: Allow apparmor to handle unaligned dfa tables","status":"backported","project":false,"upstream":[{"sha":"64802f731214a51dfe3c6c27636b3ddafd003eb0","url":"https://git.kernel.org/stable/c/64802f731214a51dfe3c6c27636b3ddafd003eb0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/23f112bd6144e815153462e12d313ac3e7027168","label":"23f112bd6144","date":"2026-02-26T14:59:41-08:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"64802f731214a51dfe3c6c27636b3ddafd003eb0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46254","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46254.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46245","title":"drm/amd/display: Fix dc_link NULL handling in HPD init","status":"backported","project":false,"upstream":[{"sha":"226a40c06a183abaeb7529a4f54d6c203bd14407","url":"https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1d15503e454bf117a0d0078332d48df86a41c828","label":"1d15503e454b","date":"2026-10-15T11:57:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"226a40c06a183abaeb7529a4f54d6c203bd14407","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/226a40c06a183abaeb7529a4f54d6c203bd14407.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46245","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46245.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46157","title":"ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger","status":"backported","project":false,"upstream":[{"sha":"901ac0ff15edf9503162e2cf6579bd11a30f1ed4","url":"https://git.kernel.org/stable/c/901ac0ff15edf9503162e2cf6579bd11a30f1ed4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ac3e9b55b7da6f0be51720bd330a0edc1a8b61f1","label":"ac3e9b55b7da","date":"2026-05-14T15:30:13+02:00","lore":["https://lore.kernel.org/20260423145330.210035-1-jjy600901@snu.ac.kr"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"901ac0ff15edf9503162e2cf6579bd11a30f1ed4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46157","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46157.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46153","title":"8021q: delete cleared egress QoS mappings","status":"unfixed","project":false,"upstream":[{"sha":"7dddc74af369478ba7f9bc136d0fc1dc4570cb66","url":"https://git.kernel.org/stable/c/7dddc74af369478ba7f9bc136d0fc1dc4570cb66"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"7dddc74af369478ba7f9bc136d0fc1dc4570cb66","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7dddc74af369478ba7f9bc136d0fc1dc4570cb66.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46153","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46153.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46147","title":"KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()","status":"backported","project":false,"upstream":[{"sha":"73b9c1e5da84cd69b1a86e374e450817cd051371","url":"https://git.kernel.org/stable/c/73b9c1e5da84cd69b1a86e374e450817cd051371"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7d3c27b54253cda91dc4d2c1bfc109c490837ab9","label":"7d3c27b54253","date":"2026-05-14T15:30:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"73b9c1e5da84cd69b1a86e374e450817cd051371","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/73b9c1e5da84cd69b1a86e374e450817cd051371.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46147","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46147.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46130","title":"dm-verity-fec: fix reading parity bytes split across blocks (take 3)","status":"backported","project":false,"upstream":[{"sha":"430a05cb926f6bdf53e81460a2c3a553257f3f61","url":"https://git.kernel.org/stable/c/430a05cb926f6bdf53e81460a2c3a553257f3f61"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d47281b9a4472cfd73122393e79fbe76b651e46a","label":"d47281b9a447","date":"2026-08-03T11:22:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"430a05cb926f6bdf53e81460a2c3a553257f3f61","lines":129,"reason":"","source":"https://github.com/torvalds/linux/commit/430a05cb926f6bdf53e81460a2c3a553257f3f61.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46130","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46130.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46096","title":"tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()","status":"backported","project":false,"upstream":[{"sha":"f0f75a3d98b7959a8677b6363e23190f3018636b","url":"https://git.kernel.org/stable/c/f0f75a3d98b7959a8677b6363e23190f3018636b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f8775d9d9062da662cc861f9ff7722a65896d4cd","label":"f8775d9d9062","date":"2026-05-07T06:11:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0f75a3d98b7959a8677b6363e23190f3018636b","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/f0f75a3d98b7959a8677b6363e23190f3018636b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46096","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46096.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46068","title":"crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx","status":"backported","project":false,"upstream":[{"sha":"adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c","url":"https://git.kernel.org/stable/c/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5c07962fed66e1238fad7635fa150570bd38b4c5","label":"5c07962fed66","date":"2026-05-07T06:11:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46068","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46068.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46054","title":"selinux: fix overlayfs mmap() and mprotect() access checks","status":"backported","project":false,"upstream":[{"sha":"82544d36b1729153c8aeb179e84750f0c085d3b1","url":"https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d844702198395d3f80222777030f69db6be6b709","label":"d84470219839","date":"2026-07-04T13:44:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"82544d36b1729153c8aeb179e84750f0c085d3b1","lines":373,"reason":"","source":"https://github.com/torvalds/linux/commit/82544d36b1729153c8aeb179e84750f0c085d3b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46054","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46054.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46044","title":"ipmi:ssif: Clean up kthread on errors","status":"backported","project":false,"upstream":[{"sha":"75c486cb1bcaa1a3ec3a6438498176a3a4998ae4","url":"https://git.kernel.org/stable/c/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/858bc8b9edb6eaf0522900128bb9053e2df6b0f6","label":"858bc8b9edb6","date":"2026-05-07T06:11:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75c486cb1bcaa1a3ec3a6438498176a3a4998ae4","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46017","title":"mm: fix deferred split queue races during migration","status":"unfixed","project":false,"upstream":[{"sha":"3bac01168982ec3e3bf87efdc1807c7933590a85","url":"https://git.kernel.org/stable/c/3bac01168982ec3e3bf87efdc1807c7933590a85"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3bac01168982ec3e3bf87efdc1807c7933590a85","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/3bac01168982ec3e3bf87efdc1807c7933590a85.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46014","title":"KVM: SVM: Add missing save/restore handling of LBR MSRs","status":"backported","project":false,"upstream":[{"sha":"3700f0788da6acf73b2df56690f4b201aa4aefd2","url":"https://git.kernel.org/stable/c/3700f0788da6acf73b2df56690f4b201aa4aefd2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2b922a42b531a82d7881add14a7698dcdc5e1f0a","label":"2b922a42b531","date":"2026-05-07T06:11:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3700f0788da6acf73b2df56690f4b201aa4aefd2","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/3700f0788da6acf73b2df56690f4b201aa4aefd2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46014","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46014.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45988","title":"rxrpc: Fix re-decryption of RESPONSE packets","status":"backported","project":false,"upstream":[{"sha":"0422e7a4883f25101903f3e8105c0808aa5f4ce9","url":"https://git.kernel.org/stable/c/0422e7a4883f25101903f3e8105c0808aa5f4ce9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/76cb9a2d252274adfae6e293a292434631a7d472","label":"76cb9a2d2522","date":"2026-05-07T06:11:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0422e7a4883f25101903f3e8105c0808aa5f4ce9","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/0422e7a4883f25101903f3e8105c0808aa5f4ce9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45981","title":"s390/cio: Fix device lifecycle handling in css_alloc_subchannel()","status":"backported","project":false,"upstream":[{"sha":"f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7","url":"https://git.kernel.org/stable/c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6715560527e343a387e4a0d2e6c401748e89fa55","label":"6715560527e3","date":"2026-02-26T14:59:01-08:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45981","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45981.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45963","title":"ASoC: nau8821: Cancel delayed work on component remove","status":"backported","project":false,"upstream":[{"sha":"dbd3fd05cddfdeec1e49b0a66269881c09eebd17","url":"https://git.kernel.org/stable/c/dbd3fd05cddfdeec1e49b0a66269881c09eebd17"}],"evidence":[{"url":"https://git.kernel.org/stable/c/13d20517bee1c9b69c7750026c61e7ec021080a4","label":"13d20517bee1","date":"2026-09-02T14:31:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"dbd3fd05cddfdeec1e49b0a66269881c09eebd17","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45963","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45963.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45901","title":"netfilter: nf_tables: revert commit_mutex usage in reset path","status":"backported","project":false,"upstream":[{"sha":"7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc","url":"https://git.kernel.org/stable/c/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f6410d18c1e2da325df02be989d5bca5ed38b086","label":"f6410d18c1e2","date":"2026-08-03T11:21:25+02:00","lore":["https://lore.kernel.org/all/aUh_3mVRV8OrGsVo@strlen.de/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc","lines":372,"reason":"","source":"https://github.com/torvalds/linux/commit/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45897","title":"netfilter: nft_counter: serialize reset with spinlock","status":"backported","project":false,"upstream":[{"sha":"779c60a5190c42689534172f4b49e927c9959e4e","url":"https://git.kernel.org/stable/c/779c60a5190c42689534172f4b49e927c9959e4e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cd968dcdec6aee79a2d399e4f6e0eca63c3b45e1","label":"cd968dcdec6a","date":"2026-08-03T11:21:25+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"779c60a5190c42689534172f4b49e927c9959e4e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45897","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45897.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45893","title":"apparmor: Fix & Optimize table creation from possibly unaligned memory","status":"backported","project":false,"upstream":[{"sha":"6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a","url":"https://git.kernel.org/stable/c/6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e027999049c493fb728ead5a90db76942181a935","label":"e027999049c4","date":"2026-02-26T14:59:41-08:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45893","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45893.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45877","title":"HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients","status":"backported","project":false,"upstream":[{"sha":"56f7db581ee73af53cd512e00a6261a025bf1d58","url":"https://git.kernel.org/stable/c/56f7db581ee73af53cd512e00a6261a025bf1d58"}],"evidence":[{"url":"https://git.kernel.org/stable/c/feb4bcfd405282de60aba321f13a1272b30c5af4","label":"feb4bcfd4052","date":"2026-02-26T14:59:14-08:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"56f7db581ee73af53cd512e00a6261a025bf1d58","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45877","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45877.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45858","title":"ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1","status":"backported","project":false,"upstream":[{"sha":"1bf6974822d1dba86cf11b5f05498581cf3488a2","url":"https://git.kernel.org/stable/c/1bf6974822d1dba86cf11b5f05498581cf3488a2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d67c8ecf3d8fda9b8ef80e6f665d84b6d6ac9d88","label":"d67c8ecf3d8f","date":"2026-02-26T14:59:45-08:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1bf6974822d1dba86cf11b5f05498581cf3488a2","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/1bf6974822d1dba86cf11b5f05498581cf3488a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45858","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45858.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45855","title":"ata: libata-scsi: avoid Non-NCQ command starvation","status":"backported","project":false,"upstream":[{"sha":"0ea84089dbf62a92dc7889c79e6b18fc89260808","url":"https://git.kernel.org/stable/c/0ea84089dbf62a92dc7889c79e6b18fc89260808"}],"evidence":[{"url":"https://git.kernel.org/stable/c/888cd7e40adb2ef4af1b4d3b6e2e83ad409ae8c2","label":"888cd7e40adb","date":"2026-02-26T14:59:46-08:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"0ea84089dbf62a92dc7889c79e6b18fc89260808","lines":165,"reason":"","source":"https://github.com/torvalds/linux/commit/0ea84089dbf62a92dc7889c79e6b18fc89260808.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45855","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45855.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43500","title":"rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present","status":"backported","project":false,"upstream":[{"sha":"aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","url":"https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c","label":"3eae0f4f9f72","date":"2026-05-11T08:20:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43500","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43500.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43485","title":"nouveau/gsp: drop WARN_ON in ACPI probes","status":"backported","project":false,"upstream":[{"sha":"9478c166c46934160135e197b049b5a05753f2ad","url":"https://git.kernel.org/stable/c/9478c166c46934160135e197b049b5a05753f2ad"}],"evidence":[{"url":"https://git.kernel.org/stable/c/214b6bde0e941a34ba877cf2f26f85d62fb5d598","label":"214b6bde0e94","date":"2026-03-19T16:08:33+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9478c166c46934160135e197b049b5a05753f2ad","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/9478c166c46934160135e197b049b5a05753f2ad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43485","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43485.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43446","title":"accel/amdxdna: Fix runtime suspend deadlock when there is pending job","status":"unfixed","project":false,"upstream":[{"sha":"6b13cb8f48a42ddf6dd98865b673a82e37ff238b","url":"https://git.kernel.org/stable/c/6b13cb8f48a42ddf6dd98865b673a82e37ff238b"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6b13cb8f48a42ddf6dd98865b673a82e37ff238b","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/6b13cb8f48a42ddf6dd98865b673a82e37ff238b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43446","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43446.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43416","title":"powerpc, perf: Check that current->mm is alive before getting user callchain","status":"backported","project":false,"upstream":[{"sha":"e9bbfb4bfa86c6b5515b868d6982ac60505d7e39","url":"https://git.kernel.org/stable/c/e9bbfb4bfa86c6b5515b868d6982ac60505d7e39"}],"evidence":[{"url":"https://git.kernel.org/stable/c/98074e16742ae87fb82e234b419783c5ffc9baea","label":"98074e16742a","date":"2026-03-19T16:08:31+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e9bbfb4bfa86c6b5515b868d6982ac60505d7e39","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/e9bbfb4bfa86c6b5515b868d6982ac60505d7e39.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43416","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43416.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43409","title":"kprobes: avoid crash when rmmod/insmod after ftrace killed","status":"backported","project":false,"upstream":[{"sha":"e113f0b46d19626ec15388bcb91432c9a4fd6261","url":"https://git.kernel.org/stable/c/e113f0b46d19626ec15388bcb91432c9a4fd6261"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cae928e3178c75602c21d67e21255d73e7e9ed4f","label":"cae928e3178c","date":"2026-03-19T16:08:29+01:00","lore":["https://lore.kernel.org/all/176473947565.1727781.13110060700668331950.stgit@mhiramat.tok.corp.google.com/","https://lore.kernel.org/all/20251125020536.2484381-1-yebin@huaweicloud.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e113f0b46d19626ec15388bcb91432c9a4fd6261","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/e113f0b46d19626ec15388bcb91432c9a4fd6261.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43409","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43409.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43408","title":"ceph: add a bunch of missing ceph_path_info initializers","status":"backported","project":false,"upstream":[{"sha":"43323a5934b660afae687e8e4e95ac328615a5c4","url":"https://git.kernel.org/stable/c/43323a5934b660afae687e8e4e95ac328615a5c4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8be8911f590813e6f90bc6407ced1b23e50bc5da","label":"8be8911f5908","date":"2026-03-19T16:08:29+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"43323a5934b660afae687e8e4e95ac328615a5c4","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/43323a5934b660afae687e8e4e95ac328615a5c4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43408","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43408.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43391","title":"nsfs: tighten permission checks for handle opening","status":"backported","project":true,"upstream":[{"sha":"d2324a9317f00013facb0ba00b00440e19d2af5e","url":"https://git.kernel.org/stable/c/d2324a9317f00013facb0ba00b00440e19d2af5e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/24ebaf6676ae4f74f4856eb645959b15e62bc1b4","label":"24ebaf6676ae","date":"2026-09-07T17:22:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d2324a9317f00013facb0ba00b00440e19d2af5e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43391","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43391.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43362","title":"smb: client: fix in-place encryption corruption in SMB2_write()","status":"backported","project":false,"upstream":[{"sha":"d78840a6a38d312dc1a51a65317bb67e46f0b929","url":"https://git.kernel.org/stable/c/d78840a6a38d312dc1a51a65317bb67e46f0b929"}],"evidence":[{"url":"https://git.kernel.org/stable/c/92e64f1852f455f57d0850989e57c30d7fac7d95","label":"92e64f1852f4","date":"2026-03-19T16:08:45+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d78840a6a38d312dc1a51a65317bb67e46f0b929","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/d78840a6a38d312dc1a51a65317bb67e46f0b929.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43362","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43362.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43344","title":"perf/x86/intel/uncore: Fix die ID init and look up bugs","status":"backported","project":true,"upstream":[{"sha":"a16d1ec4dd0cdcf689f324adde6067083bce9099","url":"https://git.kernel.org/stable/c/a16d1ec4dd0cdcf689f324adde6067083bce9099"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c79ef3342632e71ac8612a2a1cc17ac84dd258b4","label":"c79ef3342632","date":"2026-09-07T17:22:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"a16d1ec4dd0cdcf689f324adde6067083bce9099","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43344","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43344.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43326","title":"sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback","status":"unfixed","project":false,"upstream":[{"sha":"415cb193bb9736f0e830286c72a6fa8eb2a9cc5c","url":"https://git.kernel.org/stable/c/415cb193bb9736f0e830286c72a6fa8eb2a9cc5c"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"415cb193bb9736f0e830286c72a6fa8eb2a9cc5c","lines":158,"reason":"","source":"https://github.com/torvalds/linux/commit/415cb193bb9736f0e830286c72a6fa8eb2a9cc5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43326","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43326.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43318","title":"drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify","status":"backported","project":false,"upstream":[{"sha":"b18fc0ab837381c1a6ef28386602cd888f2d9edf","url":"https://git.kernel.org/stable/c/b18fc0ab837381c1a6ef28386602cd888f2d9edf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/89a9389ad70d3c69538e59d87df67d407aef4c26","label":"89a9389ad70d","date":"2026-03-04T07:21:29-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b18fc0ab837381c1a6ef28386602cd888f2d9edf","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/b18fc0ab837381c1a6ef28386602cd888f2d9edf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43318","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43318.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43317","title":"most: core: fix leak on early registration failure","status":"backported","project":false,"upstream":[{"sha":"2c198c272f9c9213b0fdf6b4a879f445c574f416","url":"https://git.kernel.org/stable/c/2c198c272f9c9213b0fdf6b4a879f445c574f416"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f1ba620f9e8d7291f80c0554e4b820f5fb30e819","label":"f1ba620f9e8d","date":"2026-03-04T07:21:36-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c198c272f9c9213b0fdf6b4a879f445c574f416","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/2c198c272f9c9213b0fdf6b4a879f445c574f416.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43309","title":"md raid: fix hang when stopping arrays with metadata through dm-raid","status":"backported","project":false,"upstream":[{"sha":"cefcb9297fbdb6d94b61787b4f8d84f55b741470","url":"https://git.kernel.org/stable/c/cefcb9297fbdb6d94b61787b4f8d84f55b741470"}],"evidence":[{"url":"https://git.kernel.org/stable/c/24783dd06de870d646c25207bae186f78195f912","label":"24783dd06de8","date":"2026-03-04T07:19:36-05:00","lore":["https://lore.kernel.org/linux-raid/CAM23VxqYrwkhKEBeQrZeZwQudbiNey2_8B_SEOLqug=pXxaFrA@mail.gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cefcb9297fbdb6d94b61787b4f8d84f55b741470","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/cefcb9297fbdb6d94b61787b4f8d84f55b741470.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43309","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43309.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43301","title":"media: chips-media: wave5: Fix PM runtime usage count underflow","status":"backported","project":false,"upstream":[{"sha":"9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38","url":"https://git.kernel.org/stable/c/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3a278a55ead50db2444c8f01410c7f5a68723990","label":"3a278a55ead5","date":"2026-03-04T07:20:57-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43301","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43301.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43299","title":"btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()","status":"backported","project":false,"upstream":[{"sha":"8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3","url":"https://git.kernel.org/stable/c/8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/81e1ae665004b99a10686473d99f0a7cb6335f38","label":"81e1ae665004","date":"2026-10-15T11:57:48+02:00","lore":["https://lore.kernel.org/linux-btrfs/20260126045555.GB31641@lst.de/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43299","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43299.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43288","title":"ext4: move ext4_percpu_param_init() before ext4_mb_init()","status":"backported","project":false,"upstream":[{"sha":"270564513489d98b721a1e4a10017978d5213bff","url":"https://git.kernel.org/stable/c/270564513489d98b721a1e4a10017978d5213bff"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bf5b609524497c195f801cd5707252384aed8149","label":"bf5b60952449","date":"2026-03-04T07:20:17-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"270564513489d98b721a1e4a10017978d5213bff","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43234","title":"team: avoid NETDEV_CHANGEMTU event when unregistering slave","status":"backported","project":false,"upstream":[{"sha":"bb4c698633c0e19717586a6524a33196cff01a32","url":"https://git.kernel.org/stable/c/bb4c698633c0e19717586a6524a33196cff01a32"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bce42728ac4887060a24a585c5122fbd24939db7","label":"bce42728ac48","date":"2026-03-04T07:20:51-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"bb4c698633c0e19717586a6524a33196cff01a32","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43234","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43234.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43188","title":"ceph: do not propagate page array emplacement errors as batch errors","status":"backported","project":false,"upstream":[{"sha":"707104682e3c163f7c14cdd6b07a3e95fb374759","url":"https://git.kernel.org/stable/c/707104682e3c163f7c14cdd6b07a3e95fb374759"}],"evidence":[{"url":"https://git.kernel.org/stable/c/746840c87d76b614b14d9337c466ff022fc49823","label":"746840c87d76","date":"2026-03-04T07:21:28-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"707104682e3c163f7c14cdd6b07a3e95fb374759","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/707104682e3c163f7c14cdd6b07a3e95fb374759.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43188","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43188.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43174","title":"io_uring/zcrx: fix post open error handling","status":"unfixed","project":false,"upstream":[{"sha":"5d540e4508950c674d6feef1d95463d039bbf4f5","url":"https://git.kernel.org/stable/c/5d540e4508950c674d6feef1d95463d039bbf4f5"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5d540e4508950c674d6feef1d95463d039bbf4f5","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/5d540e4508950c674d6feef1d95463d039bbf4f5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43173","title":"net: ethernet: xscale: Check for PTP support properly","status":"backported","project":false,"upstream":[{"sha":"594163ea88a03bdb412063af50fc7177ef3cbeae","url":"https://git.kernel.org/stable/c/594163ea88a03bdb412063af50fc7177ef3cbeae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2d74412dfd3621552a394d55cc3dd26a7cbf608e","label":"2d74412dfd36","date":"2026-03-04T07:20:45-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"594163ea88a03bdb412063af50fc7177ef3cbeae","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/594163ea88a03bdb412063af50fc7177ef3cbeae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43173","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43173.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43172","title":"wifi: iwlwifi: fix 22000 series SMEM parsing","status":"backported","project":false,"upstream":[{"sha":"58192b9ce09b0f0f86e2036683bd542130b91a98","url":"https://git.kernel.org/stable/c/58192b9ce09b0f0f86e2036683bd542130b91a98"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1d49a42717bdc8de77eabeb5b7d3e88d141ffea9","label":"1d49a42717bd","date":"2026-03-04T07:20:19-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"58192b9ce09b0f0f86e2036683bd542130b91a98","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/58192b9ce09b0f0f86e2036683bd542130b91a98.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43172","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43172.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43161","title":"iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode","status":"backported","project":false,"upstream":[{"sha":"42662d19839f34735b718129ea200e3734b07e50","url":"https://git.kernel.org/stable/c/42662d19839f34735b718129ea200e3734b07e50"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8","label":"e70d5feb10c5","date":"2026-03-12T07:09:29-04:00","lore":["https://lore.kernel.org/r/20251211035946.2071-2-guojinhui.liam@bytedance.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"42662d19839f34735b718129ea200e3734b07e50","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/42662d19839f34735b718129ea200e3734b07e50.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43137","title":"ASoC: SOF: Intel: hda: Fix NULL pointer dereference","status":"backported","project":false,"upstream":[{"sha":"16c589567a956d46a7c1363af3f64de3d420af20","url":"https://git.kernel.org/stable/c/16c589567a956d46a7c1363af3f64de3d420af20"}],"evidence":[{"url":"https://git.kernel.org/stable/c/42068f7dd42b559c4eeae645e1455ff36518866a","label":"42068f7dd42b","date":"2026-03-04T07:20:08-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"16c589567a956d46a7c1363af3f64de3d420af20","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/16c589567a956d46a7c1363af3f64de3d420af20.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43126","title":"ALSA: mixer: oss: Add card disconnect checkpoints","status":"backported","project":false,"upstream":[{"sha":"084d5d44418148662365eced3e126ad1a81ee3e2","url":"https://git.kernel.org/stable/c/084d5d44418148662365eced3e126ad1a81ee3e2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e6645e625480cdf1079a4265f758d13b70721029","label":"e6645e625480","date":"2026-03-04T07:20:08-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"084d5d44418148662365eced3e126ad1a81ee3e2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43126","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43126.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43115","title":"srcu: Use irq_work to start GP in tiny SRCU","status":"backported","project":false,"upstream":[{"sha":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","url":"https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af"}],"evidence":[{"url":"https://git.kernel.org/stable/c/28768bc7ea0b13f558a70f63cc3cfcd32d55d488","label":"28768bc7ea0b","date":"2026-10-15T11:57:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43095","title":"ASoC: SDCA: Fix errors in IRQ cleanup","status":"unfixed","project":false,"upstream":[{"sha":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","url":"https://git.kernel.org/stable/c/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","lines":145,"reason":"","source":"https://github.com/torvalds/linux/commit/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43095","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43095.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43088","title":"net: af_key: zero aligned sockaddr tail in PF_KEY exports","status":"backported","project":false,"upstream":[{"sha":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","url":"https://git.kernel.org/stable/c/426c355742f02cf743b347d9d7dbdc1bfbfa31ef"}],"evidence":[{"url":"https://git.kernel.org/stable/c/edd446ee7cd3d02cac246168063d5b3e9ea68460","label":"edd446ee7cd3","date":"2026-05-14T15:30:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43088","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43088.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43073","title":"x86-64: rename misleadingly named '__copy_user_nocache()' function","status":"backported","project":false,"upstream":[{"sha":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","url":"https://git.kernel.org/stable/c/d187a86de793f84766ea40b9ade7ac60aabbb4fe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c6d4e0599e7e73abc04e2488dfeb7940c4039660","label":"c6d4e0599e7e","date":"2026-04-22T13:22:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","lines":84,"reason":"","source":"https://github.com/torvalds/linux/commit/d187a86de793f84766ea40b9ade7ac60aabbb4fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43053","title":"xfs: close crash window in attr dabtree inactivation","status":"backported","project":false,"upstream":[{"sha":"b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61","url":"https://git.kernel.org/stable/c/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7ea3850b9ce005e70f502b308edb2d99ca074ed3","label":"7ea3850b9ce0","date":"2026-10-21T10:32:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61","lines":171,"reason":"","source":"https://github.com/torvalds/linux/commit/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43053","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43053.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43045","title":"mshv: Fix error handling in mshv_region_pin","status":"backported","project":false,"upstream":[{"sha":"c0e296f257671ba10249630fe58026f29e4804d9","url":"https://git.kernel.org/stable/c/c0e296f257671ba10249630fe58026f29e4804d9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d14847cb7f65d419e43451d416a1f50c09a5f3be","label":"d14847cb7f65","date":"2026-10-15T11:57:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":{"id":"CVE-2026-43045","series":"6.18.y","upstream":["c0e296f257671ba10249630fe58026f29e4804d9"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"applicable","applicability":"affected","reason":"VP state pin loop advances by partial pin count without zero-progress/short-count validation","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/hv/mshv_root_main.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/hv/mshv_root_main.c?id=1b357ecb321392158d507b04672ffee57bfa071d"},{"label":"Upstream fix c0e296f25767","url":"https://git.kernel.org/stable/c/c0e296f257671ba10249630fe58026f29e4804d9"}]},"size":{"status":"within-limit","patches":[{"sha":"c0e296f257671ba10249630fe58026f29e4804d9","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/c0e296f257671ba10249630fe58026f29e4804d9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43045","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43045.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43042","title":"mpls: add seqcount to protect the platform_label{,s} pair","status":"unfixed","project":false,"upstream":[{"sha":"629ec78ef8608d955ce217880cdc3e1873af3a15","url":"https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"629ec78ef8608d955ce217880cdc3e1873af3a15","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/629ec78ef8608d955ce217880cdc3e1873af3a15.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43042","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43042.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43029","title":"mptcp: fix soft lockup in mptcp_recvmsg()","status":"backported","project":false,"upstream":[{"sha":"5dd8025a49c268ab6b94d978532af3ad341132a7","url":"https://git.kernel.org/stable/c/5dd8025a49c268ab6b94d978532af3ad341132a7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/58b58b9ba89c43914eea90c18928e51852d10c24","label":"58b58b9ba89c","date":"2026-04-11T14:26:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5dd8025a49c268ab6b94d978532af3ad341132a7","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/5dd8025a49c268ab6b94d978532af3ad341132a7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43029","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43029.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43009","title":"bpf: Fix incorrect pruning due to atomic fetch precision tracking","status":"backported","project":true,"upstream":[{"sha":"179ee84a89114b854ac2dd1d293633a7f6c8dac1","url":"https://git.kernel.org/stable/c/179ee84a89114b854ac2dd1d293633a7f6c8dac1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ea150ffa9fc9f78c5cf22e1f7b06b6d016b1017c","label":"ea150ffa9fc9","date":"2026-09-07T17:22:19+02:00","lore":["https://lore.kernel.org/r/20260331222020.401848-1-daniel@iogearbox.net"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"179ee84a89114b854ac2dd1d293633a7f6c8dac1","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43009","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43009.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31777","title":"ALSA: ctxfi: Check the error for index mapping","status":"backported","project":false,"upstream":[{"sha":"277c6960d4ddb94d16198afd70c92c3d4593d131","url":"https://git.kernel.org/stable/c/277c6960d4ddb94d16198afd70c92c3d4593d131"}],"evidence":[{"url":"https://git.kernel.org/stable/c/971854e7b6ddda78669d3d0cf6566c7b8aca1fdb","label":"971854e7b6dd","date":"2026-10-15T11:57:47+02:00","lore":["https://lore.kernel.org/87cy149n6k.wl-tiwai@suse.de"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"277c6960d4ddb94d16198afd70c92c3d4593d131","lines":162,"reason":"","source":"https://github.com/torvalds/linux/commit/277c6960d4ddb94d16198afd70c92c3d4593d131.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31777","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31777.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31729","title":"usb: typec: ucsi: validate connector number in ucsi_notify_common()","status":"backported","project":false,"upstream":[{"sha":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","url":"https://git.kernel.org/stable/c/d2d8c17ac01a1b1f638ea5d340a884ccc5015186"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f4e608fe12b7ac6a4a57176ab0296bb5a110a078","label":"f4e608fe12b7","date":"2026-04-11T14:26:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/d2d8c17ac01a1b1f638ea5d340a884ccc5015186.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31729","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31729.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31710","title":"smb: client: fix dir separator in SMB1 UNIX mounts","status":"unfixed","project":false,"upstream":[{"sha":"c4d3fc5844d685441befd0caaab648321013cdfd","url":"https://git.kernel.org/stable/c/c4d3fc5844d685441befd0caaab648321013cdfd"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c4d3fc5844d685441befd0caaab648321013cdfd","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/c4d3fc5844d685441befd0caaab648321013cdfd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31710","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31710.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31692","title":"rtnetlink: add missing netlink_ns_capable() check for peer netns","status":"backported","project":false,"upstream":[{"sha":"7b735ef81286007794a227ce2539419479c02a5f","url":"https://git.kernel.org/stable/c/7b735ef81286007794a227ce2539419479c02a5f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0975b64ffb34560042090a5986c3a02e6c80f36f","label":"0975b64ffb34","date":"2026-04-22T13:22:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7b735ef81286007794a227ce2539419479c02a5f","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/7b735ef81286007794a227ce2539419479c02a5f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31692","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31692.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31655","title":"pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled","status":"backported","project":false,"upstream":[{"sha":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","url":"https://git.kernel.org/stable/c/e91d5f94acf68618ea3ad9c92ac28614e791ae7d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e44919669f07b8f113ad49a248b44ca4f119bc94","label":"e44919669f07","date":"2026-04-18T10:44:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31655","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31655.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31648","title":"mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()","status":"backported","project":false,"upstream":[{"sha":"f58df566524ebcdfa394329c64f47e3c9257516e","url":"https://git.kernel.org/stable/c/f58df566524ebcdfa394329c64f47e3c9257516e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/576543bedd616254032d4ebe54a90076f9e31740","label":"576543bedd61","date":"2026-04-18T10:45:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f58df566524ebcdfa394329c64f47e3c9257516e","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/f58df566524ebcdfa394329c64f47e3c9257516e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31648","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31648.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31591","title":"KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish","status":"backported","project":false,"upstream":[{"sha":"cb923ee6a80f4e604e6242a4702b59251e61a380","url":"https://git.kernel.org/stable/c/cb923ee6a80f4e604e6242a4702b59251e61a380"}],"evidence":[{"url":"https://git.kernel.org/stable/c/30fd9d8c82087742168db779929d8be0459b0716","label":"30fd9d8c8208","date":"2026-04-22T13:22:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cb923ee6a80f4e604e6242a4702b59251e61a380","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/cb923ee6a80f4e604e6242a4702b59251e61a380.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31579","title":"wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit","status":"backported","project":false,"upstream":[{"sha":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","url":"https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9a9e69155b2091b8297afaf1533b8d68a3096841","label":"9a9e69155b20","date":"2026-04-22T13:22:33+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31579","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31579.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31573","title":"media: verisilicon: Fix kernel panic due to __initconst misuse","status":"backported","project":false,"upstream":[{"sha":"e8d97c270cb46a2a88739019d0f8547adc7d97da","url":"https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da"}],"evidence":[{"url":"https://git.kernel.org/stable/c/07861e84b766c6db8014bc34138f3be4a62aad2a","label":"07861e84b766","date":"2026-10-15T11:58:18+02:00","lore":["https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/","https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/"]}],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e8d97c270cb46a2a88739019d0f8547adc7d97da","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/e8d97c270cb46a2a88739019d0f8547adc7d97da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31573","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31573.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31537","title":"smb: server: make use of smbdirect_socket.send_io.bcredits","status":"backported","project":false,"upstream":[{"sha":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","url":"https://git.kernel.org/stable/c/34abd408c8ba24d7c97bd02ba874d8c714f49db1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7","label":"5ef18a2e66f2","date":"2026-02-16T10:19:41+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/34abd408c8ba24d7c97bd02ba874d8c714f49db1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31537","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31537.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31536","title":"smb: server: let send_done handle a completion without IB_SEND_SIGNALED","status":"backported","project":false,"upstream":[{"sha":"9da82dc73cb03e85d716a2609364572367a5ff47","url":"https://git.kernel.org/stable/c/9da82dc73cb03e85d716a2609364572367a5ff47"}],"evidence":[{"url":"https://git.kernel.org/stable/c/24082642654f3e5149913946e89c00a297a8868f","label":"24082642654f","date":"2026-02-16T10:19:42+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9da82dc73cb03e85d716a2609364572367a5ff47","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/9da82dc73cb03e85d716a2609364572367a5ff47.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31536","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31536.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31527","title":"driver core: platform: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","url":"https://git.kernel.org/stable/c/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7c02a9bd7d14a89065fcf672b86d8e1d1a41d3b1","label":"7c02a9bd7d14","date":"2026-04-02T13:22:54+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31527","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31527.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31516","title":"xfrm: prevent policy_hthresh.work from racing with netns teardown","status":"backported","project":false,"upstream":[{"sha":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","url":"https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8854e9367465d784046362698731c1111e3b39b8","label":"8854e9367465","date":"2026-04-02T13:23:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/29fe3a61bcdce398ee3955101c39f89c01a8a77e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31516","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31516.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31502","title":"team: fix header_ops type confusion with non-Ethernet ports","status":"backported","project":false,"upstream":[{"sha":"425000dbf17373a4ab8be9428f5dc055ef870a56","url":"https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0","label":"0a7468ed49a6","date":"2026-04-02T13:23:08+02:00","lore":["https://lore.kernel.org/all/69b46af7.050a0220.36eb34.000e.GAE@google.com/T/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"425000dbf17373a4ab8be9428f5dc055ef870a56","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31502","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31502.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31499","title":"Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()","status":"backported","project":false,"upstream":[{"sha":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","url":"https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3f26ecbd9cde621dd94be7ef252c7210b965a5c7","label":"3f26ecbd9cde","date":"2026-04-02T13:23:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/00fdebbbc557a2fc21321ff2eaa22fd70c078608.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31493","title":"RDMA/efa: Fix use of completion ctx after free","status":"backported","project":false,"upstream":[{"sha":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","url":"https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0dd98aea1c0c45987fa2dd92f988b0eb1a72c125","label":"0dd98aea1c0c","date":"2026-04-02T13:23:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","lines":179,"reason":"","source":"https://github.com/torvalds/linux/commit/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31487","title":"spi: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","url":"https://git.kernel.org/stable/c/cc34d77dd48708d810c12bfd6f5bf03304f6c824"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c73a58661a760373d08a6883af4f0bb5cc991a67","label":"c73a58661a76","date":"2026-04-02T13:23:14+02:00","lore":["https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/cc34d77dd48708d810c12bfd6f5bf03304f6c824.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31487","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31487.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31458","title":"mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]","status":"backported","project":false,"upstream":[{"sha":"1bfe9fb5ed2667fb075682408b776b5273162615","url":"https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615"}],"evidence":[{"url":"https://git.kernel.org/stable/c/708033c231bd782858f4ddbb46ee874a5a5fbdab","label":"708033c231bd","date":"2026-04-02T13:23:25+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1bfe9fb5ed2667fb075682408b776b5273162615","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/1bfe9fb5ed2667fb075682408b776b5273162615.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31458","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31458.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31435","title":"netfs: Fix read abandonment during retry","status":"backported","project":false,"upstream":[{"sha":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","url":"https://git.kernel.org/stable/c/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3e5fd8f53b575ff2188f82071da19c977ca56c41","label":"3e5fd8f53b57","date":"2026-04-02T13:23:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31435","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31435.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31420","title":"bridge: mrp: reject zero test interval to avoid OOM panic","status":"backported","project":false,"upstream":[{"sha":"fa6e24963342de4370e3a3c9af41e38277b74cf3","url":"https://git.kernel.org/stable/c/fa6e24963342de4370e3a3c9af41e38277b74cf3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e8ec80430bfa520e7352155d6ac632e527cba7aa","label":"e8ec80430bfa","date":"2026-06-01T17:50:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"fa6e24963342de4370e3a3c9af41e38277b74cf3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31420","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31420.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23459","title":"ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS","status":"backported","project":true,"upstream":[{"sha":"8431c602f551549f082bbfa67f3003f2d8e3e132","url":"https://git.kernel.org/stable/c/8431c602f551549f082bbfa67f3003f2d8e3e132"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5d562153b4719234227f99c2fb529f98a6a44d15","label":"5d562153b471","date":"2026-09-07T17:22:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8431c602f551549f082bbfa67f3003f2d8e3e132","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23459","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23459.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23448","title":"net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check","status":"backported","project":false,"upstream":[{"sha":"2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a","url":"https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/403f94ddcb36c552fbef51dea735b131e3dcde8b","label":"403f94ddcb36","date":"2026-03-25T11:10:41+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23448","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23448.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23447","title":"net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check","status":"backported","project":false,"upstream":[{"sha":"77914255155e68a20aa41175edeecf8121dac391","url":"https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a5bd5a2710310c965ea4153cba4210988a3454e2","label":"a5bd5a271031","date":"2026-03-25T11:10:41+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"77914255155e68a20aa41175edeecf8121dac391","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23447","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23447.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23393","title":"bridge: cfm: Fix race condition in peer_mep deletion","status":"backported","project":false,"upstream":[{"sha":"3715a00855316066cdda69d43648336367422127","url":"https://git.kernel.org/stable/c/3715a00855316066cdda69d43648336367422127"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d8f35767bacb3c7769d470a41cf161e3f3c07e70","label":"d8f35767bacb","date":"2026-03-25T11:10:40+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3715a00855316066cdda69d43648336367422127","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/3715a00855316066cdda69d43648336367422127.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23393","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23393.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23371","title":"sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting","status":"backported","project":false,"upstream":[{"sha":"d658686a1331db3bb108ca079d76deb3208ed949","url":"https://git.kernel.org/stable/c/d658686a1331db3bb108ca079d76deb3208ed949"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0638bf16b7a73a2fe63624bd0d16d9fd904805c3","label":"0638bf16b7a7","date":"2026-06-01T17:50:37+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"d658686a1331db3bb108ca079d76deb3208ed949","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23371","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23371.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23348","title":"cxl: Fix race of nvdimm_bus object when creating nvdimm objects","status":"backported","project":false,"upstream":[{"sha":"96a1fd0d84b17360840f344826897fa71049870e","url":"https://git.kernel.org/stable/c/96a1fd0d84b17360840f344826897fa71049870e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5fc4e150c5ada5f7d20d8f9f1b351f10481fbdf7","label":"5fc4e150c5ad","date":"2026-03-12T07:09:15-04:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"96a1fd0d84b17360840f344826897fa71049870e","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/96a1fd0d84b17360840f344826897fa71049870e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23348","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23348.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23346","title":"arm64: io: Extract user memory type in ioremap_prot()","status":"backported","project":false,"upstream":[{"sha":"8f098037139b294050053123ab2bc0f819d08932","url":"https://git.kernel.org/stable/c/8f098037139b294050053123ab2bc0f819d08932"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3d64dcc0799c2d6921ba027716b7be721eb19fa8","label":"3d64dcc0799c","date":"2026-03-12T07:09:18-04:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f098037139b294050053123ab2bc0f819d08932","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8f098037139b294050053123ab2bc0f819d08932.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23346","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23346.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23295","title":"accel/amdxdna: Fix dead lock for suspend and resume","status":"unfixed","project":false,"upstream":[{"sha":"1aa82181a3c285c7351523d587f7981ae4c015c8","url":"https://git.kernel.org/stable/c/1aa82181a3c285c7351523d587f7981ae4c015c8"}],"evidence":[],"submission_lore":[],"basis":"CNA affected range","review":null,"size":{"status":"over-limit","patches":[{"sha":"1aa82181a3c285c7351523d587f7981ae4c015c8","lines":144,"reason":"","source":"https://github.com/torvalds/linux/commit/1aa82181a3c285c7351523d587f7981ae4c015c8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23295","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23295.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23276","title":"net: add xmit recursion limit to tunnel xmit functions","status":"backported","project":false,"upstream":[{"sha":"6f1a9140ecda3baba3d945b9a6155af4268aafc4","url":"https://git.kernel.org/stable/c/6f1a9140ecda3baba3d945b9a6155af4268aafc4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8a57deeb256069f262957d8012418559ff66c385","label":"8a57deeb2560","date":"2026-03-19T16:08:17+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"6f1a9140ecda3baba3d945b9a6155af4268aafc4","lines":152,"reason":"","source":"https://github.com/torvalds/linux/commit/6f1a9140ecda3baba3d945b9a6155af4268aafc4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23276","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23276.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23265","title":"f2fs: fix to do sanity check on node footer in {read,write}_end_io","status":"backported","project":false,"upstream":[{"sha":"50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4","url":"https://git.kernel.org/stable/c/50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/855c54f1803e3ebc613677b4f389c7f92656a1fc","label":"855c54f1803e","date":"2026-02-19T16:31:36+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4","lines":107,"reason":"","source":"https://github.com/torvalds/linux/commit/50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23265","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23265.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23240","title":"tls: Fix race condition in tls_sw_cancel_work_tx()","status":"backported","project":false,"upstream":[{"sha":"7bb09315f93dce6acc54bf59e5a95ba7365c2be4","url":"https://git.kernel.org/stable/c/7bb09315f93dce6acc54bf59e5a95ba7365c2be4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/854cd32bc74fe573353095e90958490e4e4d641b","label":"854cd32bc74f","date":"2026-03-04T07:20:48-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7bb09315f93dce6acc54bf59e5a95ba7365c2be4","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7bb09315f93dce6acc54bf59e5a95ba7365c2be4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23240","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23240.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23239","title":"espintcp: Fix race condition in espintcp_close()","status":"backported","project":false,"upstream":[{"sha":"e1512c1db9e8794d8d130addd2615ec27231d994","url":"https://git.kernel.org/stable/c/e1512c1db9e8794d8d130addd2615ec27231d994"}],"evidence":[{"url":"https://git.kernel.org/stable/c/664e9df53226b4505a0894817ecad2c610ab11d8","label":"664e9df53226","date":"2026-03-04T07:20:44-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e1512c1db9e8794d8d130addd2615ec27231d994","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/e1512c1db9e8794d8d130addd2615ec27231d994.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23239","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23239.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23152","title":"wifi: mac80211: correctly decode TTLM with default link map","status":"backported","project":false,"upstream":[{"sha":"1eab33aa63c993685dd341e03bd5b267dd7403fa","url":"https://git.kernel.org/stable/c/1eab33aa63c993685dd341e03bd5b267dd7403fa"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aabc36857bd39da65fe2d047bfaf63a0a09917d4","label":"aabc36857bd3","date":"2026-02-06T16:57:34+01:00","lore":["https://lore.kernel.org/linux-wireless/CAFD3drMqc9YWvTCSHLyP89AOpBZsHdZ+pak6zVftYoZcUyF7gw@mail.gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1eab33aa63c993685dd341e03bd5b267dd7403fa","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/1eab33aa63c993685dd341e03bd5b267dd7403fa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23152","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23152.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23137","title":"of: unittest: Fix memory leak in unittest_data_add()","status":"backported","project":false,"upstream":[{"sha":"235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b","url":"https://git.kernel.org/stable/c/235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f09b0f705bd7197863b90256ef533a6414d1db2c","label":"f09b0f705bd7","date":"2026-01-17T16:35:18+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23102","title":"arm64/fpsimd: signal: Fix restoration of SVE context","status":"backported","project":false,"upstream":[{"sha":"d2907cbe9ea0a54cbe078076f9d089240ee1e2d9","url":"https://git.kernel.org/stable/c/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7b5a52cf252a0d2e89787b645290ad288878f332","label":"7b5a52cf252a","date":"2026-01-30T10:32:24+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2907cbe9ea0a54cbe078076f9d089240ee1e2d9","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23088","title":"tracing: Fix crash on synthetic stacktrace field usage","status":"backported","project":false,"upstream":[{"sha":"90f9f5d64cae4e72defd96a2a22760173cb3c9ec","url":"https://git.kernel.org/stable/c/90f9f5d64cae4e72defd96a2a22760173cb3c9ec"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3b90d099efa2b67239bd3b3dc3521ec584261748","label":"3b90d099efa2","date":"2026-01-30T10:32:25+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"90f9f5d64cae4e72defd96a2a22760173cb3c9ec","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/90f9f5d64cae4e72defd96a2a22760173cb3c9ec.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23088","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23088.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23035","title":"net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv","status":"backported","project":false,"upstream":[{"sha":"4ef8512e1427111f7ba92b4a847d181ff0aeec42","url":"https://git.kernel.org/stable/c/4ef8512e1427111f7ba92b4a847d181ff0aeec42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/66a25f6b7c0bfd84e6d27b536f5d24116dbd52da","label":"66a25f6b7c0b","date":"2026-01-23T11:21:17+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4ef8512e1427111f7ba92b4a847d181ff0aeec42","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/4ef8512e1427111f7ba92b4a847d181ff0aeec42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23035","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23035.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23007","title":"block: zero non-PI portion of auto integrity buffer","status":"backported","project":false,"upstream":[{"sha":"ca22c566b89164f6e670af56ecc45f47ef3df819","url":"https://git.kernel.org/stable/c/ca22c566b89164f6e670af56ecc45f47ef3df819"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d6072557b90e0c557df319a56f4a9dc482706d2c","label":"d6072557b90e","date":"2026-01-23T11:21:16+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ca22c566b89164f6e670af56ecc45f47ef3df819","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/ca22c566b89164f6e670af56ecc45f47ef3df819.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23007","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23007.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23000","title":"net/mlx5e: Fix crash on profile change rollback failure","status":"backported","project":false,"upstream":[{"sha":"4dadc4077e3f77d6d31e199a925fc7a705e7adeb","url":"https://git.kernel.org/stable/c/4dadc4077e3f77d6d31e199a925fc7a705e7adeb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e05b8084a20f6bd5827d338c928e5e0fcbafa496","label":"e05b8084a20f","date":"2026-01-23T11:21:16+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"4dadc4077e3f77d6d31e199a925fc7a705e7adeb","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/4dadc4077e3f77d6d31e199a925fc7a705e7adeb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23000","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23000.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-22996","title":"net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv","status":"backported","project":false,"upstream":[{"sha":"123eda2e5b1638e298e3a66bb1e64a8da92de5e1","url":"https://git.kernel.org/stable/c/123eda2e5b1638e298e3a66bb1e64a8da92de5e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a3d4f87d41f5140f1cf5c02fce5cdad2637f6244","label":"a3d4f87d41f5","date":"2026-01-23T11:21:17+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"123eda2e5b1638e298e3a66bb1e64a8da92de5e1","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/123eda2e5b1638e298e3a66bb1e64a8da92de5e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-22996","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-22996.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71315","title":"drm/vkms: Convert to DRM's vblank timer","status":"backported","project":false,"upstream":[{"sha":"02e2681ffe1addde1fc8c35d05657b16bfa79613","url":"https://git.kernel.org/stable/c/02e2681ffe1addde1fc8c35d05657b16bfa79613"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a0582cc923985c6b72fe871b5f7aa7c682bfc230","label":"a0582cc92398","date":"2026-06-01T17:50:39+02:00","lore":["https://lore.kernel.org/r/20250916083816.30275-4-tzimmermann@suse.de"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"02e2681ffe1addde1fc8c35d05657b16bfa79613","lines":130,"reason":"","source":"https://github.com/torvalds/linux/commit/02e2681ffe1addde1fc8c35d05657b16bfa79613.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71302","title":"drm/panthor: fix for dma-fence safe access rules","status":"backported","project":false,"upstream":[{"sha":"efe24898485c5c831e629d9c6fb9350c35cb576f","url":"https://git.kernel.org/stable/c/efe24898485c5c831e629d9c6fb9350c35cb576f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ab8c0de60f16d7e0b162ccbbb35fcf1f277c97c2","label":"ab8c0de60f16","date":"2026-03-04T07:20:53-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"efe24898485c5c831e629d9c6fb9350c35cb576f","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/efe24898485c5c831e629d9c6fb9350c35cb576f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71302","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71302.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71272","title":"most: core: fix resource leak in most_register_interface error paths","status":"backported","project":false,"upstream":[{"sha":"1f4c9d8a1021281750c6cda126d6f8a40cc24e71","url":"https://git.kernel.org/stable/c/1f4c9d8a1021281750c6cda126d6f8a40cc24e71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/af0b99b2214a10554adb5b868240d23af6e64e71","label":"af0b99b2214a","date":"2026-03-04T07:20:32-05:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1f4c9d8a1021281750c6cda126d6f8a40cc24e71","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/1f4c9d8a1021281750c6cda126d6f8a40cc24e71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71272","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71272.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71225","title":"md: suspend array while updating raid_disks via sysfs","status":"backported","project":false,"upstream":[{"sha":"2cc583653bbe050bacd1cadcc9776d39bf449740","url":"https://git.kernel.org/stable/c/2cc583653bbe050bacd1cadcc9776d39bf449740"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0107b18cd8ac17eb3e54786adc05a85cdbb6ef22","label":"0107b18cd8ac","date":"2026-02-11T13:41:47+01:00","lore":["https://lore.kernel.org/linux-raid/20251226101816.4506-1-dannyshih@synology.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2cc583653bbe050bacd1cadcc9776d39bf449740","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/2cc583653bbe050bacd1cadcc9776d39bf449740.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71225","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71225.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71202","title":"iommu/sva: invalidate stale IOTLB entries for kernel address space","status":"backported","project":false,"upstream":[{"sha":"e37d5a2d60a338c5917c45296bac65da1382eda5","url":"https://git.kernel.org/stable/c/e37d5a2d60a338c5917c45296bac65da1382eda5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9f0a7ab700f8620e433b05c57fbd26c92ea186d9","label":"9f0a7ab700f8","date":"2026-01-23T11:21:35+01:00","lore":["https://lore.kernel.org/linux-iommu/04983c62-3b1d-40d4-93ae-34ca04b827e5@intel.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"e37d5a2d60a338c5917c45296bac65da1382eda5","lines":110,"reason":"","source":"https://github.com/torvalds/linux/commit/e37d5a2d60a338c5917c45296bac65da1382eda5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71202","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71202.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71160","title":"netfilter: nf_tables: avoid chain re-validation if possible","status":"backported","project":false,"upstream":[{"sha":"8e1a1bc4f5a42747c08130b8242ebebd1210b32f","url":"https://git.kernel.org/stable/c/8e1a1bc4f5a42747c08130b8242ebebd1210b32f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/09d6074995c186e449979fe6c1b0f1a69cf9bd3b","label":"09d6074995c1","date":"2026-01-17T16:35:32+01:00","lore":["https://lore.kernel.org/netfilter-devel/20251118221735.GA5477@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8e1a1bc4f5a42747c08130b8242ebebd1210b32f","lines":177,"reason":"","source":"https://github.com/torvalds/linux/commit/8e1a1bc4f5a42747c08130b8242ebebd1210b32f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71160","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71160.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71129","title":"LoongArch: BPF: Sign extend kfunc call arguments","status":"backported","project":false,"upstream":[{"sha":"3f5a238f24d7b75f9efe324d3539ad388f58536e","url":"https://git.kernel.org/stable/c/3f5a238f24d7b75f9efe324d3539ad388f58536e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/321993a874f571a94b5a596f1132f798c663b56e","label":"321993a874f5","date":"2026-01-08T10:17:13+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f5a238f24d7b75f9efe324d3539ad388f58536e","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/3f5a238f24d7b75f9efe324d3539ad388f58536e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71117","title":"block: Remove queue freezing from several sysfs store callbacks","status":"backported","project":false,"upstream":[{"sha":"935a20d1bebf6236076785fac3ff81e3931834e9","url":"https://git.kernel.org/stable/c/935a20d1bebf6236076785fac3ff81e3931834e9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3997b3147c7b68b0308378fa95a766015f8ceb1c","label":"3997b3147c7b","date":"2026-01-02T12:57:11+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"935a20d1bebf6236076785fac3ff81e3931834e9","lines":113,"reason":"","source":"https://github.com/torvalds/linux/commit/935a20d1bebf6236076785fac3ff81e3931834e9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71117","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71117.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71065","title":"f2fs: fix to avoid potential deadlock","status":"backported","project":false,"upstream":[{"sha":"ca8b201f28547e28343a6f00a6e91fa8c09572fe","url":"https://git.kernel.org/stable/c/ca8b201f28547e28343a6f00a6e91fa8c09572fe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/86a85a7b622e6e8dba69810257733ce5eab5ed55","label":"86a85a7b622e","date":"2026-01-02T12:57:17+01:00","lore":["https://lore.kernel.org/linux-f2fs-devel/68eae49b.050a0220.ac43.0001.GAE@google.com","https://lore.kernel.org/lkml/CANypQFa-Gy9sD-N35o3PC+FystOWkNuN8pv6S75HLT0ga-Tzgw@mail.gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ca8b201f28547e28343a6f00a6e91fa8c09572fe","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/ca8b201f28547e28343a6f00a6e91fa8c09572fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71065","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71065.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68781","title":"usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal","status":"backported","project":false,"upstream":[{"sha":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","url":"https://git.kernel.org/stable/c/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2e7c47e2eb3cfeadf78a1ccbac8492c60d508f23","label":"2e7c47e2eb3c","date":"2026-01-02T12:57:13+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68781","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68781.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68768","title":"inet: frags: flush pending skbs in fqdir_pre_exit()","status":"backported","project":false,"upstream":[{"sha":"006a5035b495dec008805df249f92c22c89c3d2e","url":"https://git.kernel.org/stable/c/006a5035b495dec008805df249f92c22c89c3d2e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c70df25214ac9b32b53e18e6ae3b8f073ffa6903","label":"c70df25214ac","date":"2026-01-02T12:56:46+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"006a5035b495dec008805df249f92c22c89c3d2e","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/006a5035b495dec008805df249f92c22c89c3d2e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68751","title":"s390/fpu: Fix false-positive kmsan report in fpu_vstl()","status":"backported","project":false,"upstream":[{"sha":"14e4e4175b64dd9216b522f6ece8af6997d063b2","url":"https://git.kernel.org/stable/c/14e4e4175b64dd9216b522f6ece8af6997d063b2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/13dcd6308cb8f67134ee5d5d762b2a66363c695b","label":"13dcd6308cb8","date":"2025-12-18T14:03:00+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"14e4e4175b64dd9216b522f6ece8af6997d063b2","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/14e4e4175b64dd9216b522f6ece8af6997d063b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68751","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68751.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68338","title":"net: dsa: microchip: Don't free uninitialized ksz_irq","status":"backported","project":false,"upstream":[{"sha":"25b62cc5b22c45face094ae3e8717258e46d1d19","url":"https://git.kernel.org/stable/c/25b62cc5b22c45face094ae3e8717258e46d1d19"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"25b62cc5b22c45face094ae3e8717258e46d1d19","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/25b62cc5b22c45face094ae3e8717258e46d1d19.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68338","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68338.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68334","title":"platform/x86/amd/pmc: Add support for Van Gogh SoC","status":"backported","project":false,"upstream":[{"sha":"db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb","url":"https://git.kernel.org/stable/c/db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68322","title":"parisc: Avoid crash due to unaligned access in unwinder","status":"backported","project":false,"upstream":[{"sha":"fd9f30d1038ee1624baa17a6ff11effe5f7617cb","url":"https://git.kernel.org/stable/c/fd9f30d1038ee1624baa17a6ff11effe5f7617cb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd9f30d1038ee1624baa17a6ff11effe5f7617cb","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/fd9f30d1038ee1624baa17a6ff11effe5f7617cb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68322","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68322.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68313","title":"x86/CPU/AMD: Add RDSEED fix for Zen5","status":"backported","project":false,"upstream":[{"sha":"607b9fb2ce248cc5b633c5949e0153838992c152","url":"https://git.kernel.org/stable/c/607b9fb2ce248cc5b633c5949e0153838992c152"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"607b9fb2ce248cc5b633c5949e0153838992c152","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/607b9fb2ce248cc5b633c5949e0153838992c152.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68304","title":"Bluetooth: hci_core: lookup hci_conn on RX path on protocol side","status":"backported","project":false,"upstream":[{"sha":"79a2d4678ba90bdba577dc3af88cc900d6dcd5ee","url":"https://git.kernel.org/stable/c/79a2d4678ba90bdba577dc3af88cc900d6dcd5ee"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"79a2d4678ba90bdba577dc3af88cc900d6dcd5ee","lines":327,"reason":"","source":"https://github.com/torvalds/linux/commit/79a2d4678ba90bdba577dc3af88cc900d6dcd5ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68304","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68304.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68296","title":"drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup","status":"backported","project":false,"upstream":[{"sha":"eb76d0f5553575599561010f24c277cc5b31d003","url":"https://git.kernel.org/stable/c/eb76d0f5553575599561010f24c277cc5b31d003"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb76d0f5553575599561010f24c277cc5b31d003","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/eb76d0f5553575599561010f24c277cc5b31d003.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68296","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68296.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68251","title":"erofs: avoid infinite loops due to corrupted subpage compact indexes","status":"backported","project":false,"upstream":[{"sha":"e13d315ae077bb7c3c6027cc292401bc0f4ec683","url":"https://git.kernel.org/stable/c/e13d315ae077bb7c3c6027cc292401bc0f4ec683"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e13d315ae077bb7c3c6027cc292401bc0f4ec683","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68251","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68251.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68174","title":"amd/amdkfd: enhance kfd process check in switch partition","status":"backported","project":false,"upstream":[{"sha":"45da20e00d5da842e17dfc633072b127504f0d0e","url":"https://git.kernel.org/stable/c/45da20e00d5da842e17dfc633072b127504f0d0e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"45da20e00d5da842e17dfc633072b127504f0d0e","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/45da20e00d5da842e17dfc633072b127504f0d0e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40355","title":"sysfs: check visibility before changing group attribute ownership","status":"backported","project":false,"upstream":[{"sha":"c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33","url":"https://git.kernel.org/stable/c/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40354","title":"drm/amd/display: increase max link count and fix link->enc NULL pointer access","status":"backported","project":false,"upstream":[{"sha":"bec947cbe9a65783adb475a5fb47980d7b4f4796","url":"https://git.kernel.org/stable/c/bec947cbe9a65783adb475a5fb47980d7b4f4796"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"bec947cbe9a65783adb475a5fb47980d7b4f4796","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/bec947cbe9a65783adb475a5fb47980d7b4f4796.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40354","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40354.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40339","title":"drm/amdgpu: fix nullptr err of vm_handle_moved","status":"backported","project":false,"upstream":[{"sha":"859958a7faefe5b7742b7b8cdbc170713d4bf158","url":"https://git.kernel.org/stable/c/859958a7faefe5b7742b7b8cdbc170713d4bf158"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"859958a7faefe5b7742b7b8cdbc170713d4bf158","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/859958a7faefe5b7742b7b8cdbc170713d4bf158.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40339","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40339.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40333","title":"f2fs: fix infinite loop in __insert_extent_tree()","status":"backported","project":false,"upstream":[{"sha":"23361bd54966b437e1ed3eb1a704572f4b279e58","url":"https://git.kernel.org/stable/c/23361bd54966b437e1ed3eb1a704572f4b279e58"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"23361bd54966b437e1ed3eb1a704572f4b279e58","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/23361bd54966b437e1ed3eb1a704572f4b279e58.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40311","title":"accel/habanalabs: support mapping cb with vmalloc-backed coherent memory","status":"backported","project":false,"upstream":[{"sha":"513024d5a0e34fd34247043f1876b6138ca52847","url":"https://git.kernel.org/stable/c/513024d5a0e34fd34247043f1876b6138ca52847"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"513024d5a0e34fd34247043f1876b6138ca52847","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40311","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40311.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40303","title":"btrfs: ensure no dirty metadata is written back for an fs with errors","status":"backported","project":false,"upstream":[{"sha":"2618849f31e7cf51fadd4a5242458501a6d5b315","url":"https://git.kernel.org/stable/c/2618849f31e7cf51fadd4a5242458501a6d5b315"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2618849f31e7cf51fadd4a5242458501a6d5b315","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/2618849f31e7cf51fadd4a5242458501a6d5b315.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40303","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40303.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40266","title":"KVM: arm64: Check the untrusted offset in FF-A memory share","status":"backported","project":false,"upstream":[{"sha":"103e17aac09cdd358133f9e00998b75d6c1f1518","url":"https://git.kernel.org/stable/c/103e17aac09cdd358133f9e00998b75d6c1f1518"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"103e17aac09cdd358133f9e00998b75d6c1f1518","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/103e17aac09cdd358133f9e00998b75d6c1f1518.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40266","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40266.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40247","title":"drm/msm: Fix pgtable prealloc error path","status":"backported","project":false,"upstream":[{"sha":"830d68f2cb8ab6fb798bb9555016709a9e012af0","url":"https://git.kernel.org/stable/c/830d68f2cb8ab6fb798bb9555016709a9e012af0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"830d68f2cb8ab6fb798bb9555016709a9e012af0","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/830d68f2cb8ab6fb798bb9555016709a9e012af0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40247","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40247.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40217","title":"pidfs: validate extensible ioctls","status":"backported","project":false,"upstream":[{"sha":"3c17001b21b9f168c957ced9384abe969019b609","url":"https://git.kernel.org/stable/c/3c17001b21b9f168c957ced9384abe969019b609"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3c17001b21b9f168c957ced9384abe969019b609","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/3c17001b21b9f168c957ced9384abe969019b609.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40168","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().","status":"backported","project":false,"upstream":[{"sha":"235f81045c008169cc4e1955b4a64e118eebe61b","url":"https://git.kernel.org/stable/c/235f81045c008169cc4e1955b4a64e118eebe61b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"235f81045c008169cc4e1955b4a64e118eebe61b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40168","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40168.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40146","title":"blk-mq: fix potential deadlock while nr_requests grown","status":"backported","project":false,"upstream":[{"sha":"b86433721f46d934940528f28d49c1dedb690df1","url":"https://git.kernel.org/stable/c/b86433721f46d934940528f28d49c1dedb690df1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"b86433721f46d934940528f28d49c1dedb690df1","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/b86433721f46d934940528f28d49c1dedb690df1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40146","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40146.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40139","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().","status":"backported","project":false,"upstream":[{"sha":"935d783e5de9b64587f3adb25641dd8385e64ddb","url":"https://git.kernel.org/stable/c/935d783e5de9b64587f3adb25641dd8385e64ddb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"935d783e5de9b64587f3adb25641dd8385e64ddb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40139","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40139.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40102","title":"KVM: arm64: Prevent access to vCPU events before init","status":"backported","project":false,"upstream":[{"sha":"0aa1b76fe1429629215a7c79820e4b96233ac4a3","url":"https://git.kernel.org/stable/c/0aa1b76fe1429629215a7c79820e4b96233ac4a3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0aa1b76fe1429629215a7c79820e4b96233ac4a3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40079","title":"riscv, bpf: Sign extend struct ops return values properly","status":"backported","project":false,"upstream":[{"sha":"fd2e08128944a7679e753f920e9eda72057e427c","url":"https://git.kernel.org/stable/c/fd2e08128944a7679e753f920e9eda72057e427c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd2e08128944a7679e753f920e9eda72057e427c","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/fd2e08128944a7679e753f920e9eda72057e427c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40064","title":"smc: Fix use-after-free in __pnet_find_base_ndev().","status":"backported","project":false,"upstream":[{"sha":"3d3466878afd8d43ec0ca2facfbc7f03e40d0f79","url":"https://git.kernel.org/stable/c/3d3466878afd8d43ec0ca2facfbc7f03e40d0f79"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3d3466878afd8d43ec0ca2facfbc7f03e40d0f79","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40064","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40064.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40025","title":"f2fs: fix to do sanity check on node footer for non inode dnode","status":"backported","project":false,"upstream":[{"sha":"c18ecd99e0c707ef8f83cace861cbc3162f4fdf1","url":"https://git.kernel.org/stable/c/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c18ecd99e0c707ef8f83cace861cbc3162f4fdf1","lines":144,"reason":"","source":"https://github.com/torvalds/linux/commit/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40025","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40025.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40000","title":"wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()","status":"backported","project":false,"upstream":[{"sha":"3e31a6bc07312b448fad3b45de578471f86f0e77","url":"https://git.kernel.org/stable/c/3e31a6bc07312b448fad3b45de578471f86f0e77"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"3e31a6bc07312b448fad3b45de578471f86f0e77","lines":172,"reason":"","source":"https://github.com/torvalds/linux/commit/3e31a6bc07312b448fad3b45de578471f86f0e77.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40000","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40000.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39990","title":"bpf: Check the helper function is valid in get_helper_proto","status":"backported","project":false,"upstream":[{"sha":"e4414b01c1cd9887bbde92f946c1ba94e40d6d64","url":"https://git.kernel.org/stable/c/e4414b01c1cd9887bbde92f946c1ba94e40d6d64"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"e4414b01c1cd9887bbde92f946c1ba94e40d6d64","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/e4414b01c1cd9887bbde92f946c1ba94e40d6d64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39981","title":"Bluetooth: MGMT: Fix possible UAFs","status":"backported","project":false,"upstream":[{"sha":"302a1f674c00dd5581ab8e493ef44767c5101aab","url":"https://git.kernel.org/stable/c/302a1f674c00dd5581ab8e493ef44767c5101aab"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"302a1f674c00dd5581ab8e493ef44767c5101aab","lines":615,"reason":"","source":"https://github.com/torvalds/linux/commit/302a1f674c00dd5581ab8e493ef44767c5101aab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39981","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39981.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39961","title":"iommu/amd/pgtbl: Fix possible race while increase page table level","status":"backported","project":false,"upstream":[{"sha":"1e56310b40fd2e7e0b9493da9ff488af145bdd0c","url":"https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1e56310b40fd2e7e0b9493da9ff488af145bdd0c","lines":76,"reason":"","source":"https://github.com/torvalds/linux/commit/1e56310b40fd2e7e0b9493da9ff488af145bdd0c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39947","title":"net/mlx5e: Harden uplink netdev access against device unbind","status":"backported","project":false,"upstream":[{"sha":"6b4be64fd9fec16418f365c2d8e47a7566e9eba5","url":"https://git.kernel.org/stable/c/6b4be64fd9fec16418f365c2d8e47a7566e9eba5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6b4be64fd9fec16418f365c2d8e47a7566e9eba5","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/6b4be64fd9fec16418f365c2d8e47a7566e9eba5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39940","title":"dm-stripe: fix a possible integer overflow","status":"backported","project":false,"upstream":[{"sha":"1071d560afb4c245c2076494226df47db5a35708","url":"https://git.kernel.org/stable/c/1071d560afb4c245c2076494226df47db5a35708"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1071d560afb4c245c2076494226df47db5a35708","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/1071d560afb4c245c2076494226df47db5a35708.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39940","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39940.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39932","title":"smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)","status":"backported","project":false,"upstream":[{"sha":"d9dcbbcf9145b68aa85c40947311a6907277e097","url":"https://git.kernel.org/stable/c/d9dcbbcf9145b68aa85c40947311a6907277e097"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d9dcbbcf9145b68aa85c40947311a6907277e097","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d9dcbbcf9145b68aa85c40947311a6907277e097.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39927","title":"ceph: fix race condition validating r_parent before applying state","status":"backported","project":false,"upstream":[{"sha":"15f519e9f883b316d86e2bb6b767a023aafd9d83","url":"https://git.kernel.org/stable/c/15f519e9f883b316d86e2bb6b767a023aafd9d83"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"15f519e9f883b316d86e2bb6b767a023aafd9d83","lines":556,"reason":"","source":"https://github.com/torvalds/linux/commit/15f519e9f883b316d86e2bb6b767a023aafd9d83.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39927","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39927.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39925","title":"can: j1939: implement NETDEV_UNREGISTER notification handler","status":"backported","project":false,"upstream":[{"sha":"7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a","url":"https://git.kernel.org/stable/c/7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39925","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39925.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39862","title":"wifi: mt76: mt7915: fix list corruption after hardware restart","status":"backported","project":false,"upstream":[{"sha":"065c79df595af21d6d1b27d642860faa1d938774","url":"https://git.kernel.org/stable/c/065c79df595af21d6d1b27d642860faa1d938774"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"065c79df595af21d6d1b27d642860faa1d938774","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/065c79df595af21d6d1b27d642860faa1d938774.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39834","title":"net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow","status":"backported","project":false,"upstream":[{"sha":"a630f83592cdad1253523a1b760cfe78fef6cd9c","url":"https://git.kernel.org/stable/c/a630f83592cdad1253523a1b760cfe78fef6cd9c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a630f83592cdad1253523a1b760cfe78fef6cd9c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/a630f83592cdad1253523a1b760cfe78fef6cd9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39833","title":"mISDN: hfcpci: Fix warning when deleting uninitialized timer","status":"backported","project":false,"upstream":[{"sha":"97766512a9951b9fd6fc97f1b93211642bb0b220","url":"https://git.kernel.org/stable/c/97766512a9951b9fd6fc97f1b93211642bb0b220"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"97766512a9951b9fd6fc97f1b93211642bb0b220","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39833","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39833.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39830","title":"net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path","status":"backported","project":false,"upstream":[{"sha":"2c0a959bebdc1ada13cf9a8242f177c5400299e6","url":"https://git.kernel.org/stable/c/2c0a959bebdc1ada13cf9a8242f177c5400299e6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c0a959bebdc1ada13cf9a8242f177c5400299e6","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/2c0a959bebdc1ada13cf9a8242f177c5400299e6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39830","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39830.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39822","title":"io_uring/kbuf: fix signedness in this_len calculation","status":"backported","project":false,"upstream":[{"sha":"c64eff368ac676e8540344d27a3de47e0ad90d21","url":"https://git.kernel.org/stable/c/c64eff368ac676e8540344d27a3de47e0ad90d21"},{"sha":"c4dbca5be33c6203d2f611dbd7502f887e4cd954","url":"https://git.kernel.org/stable/c/c4dbca5be33c6203d2f611dbd7502f887e4cd954"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c64eff368ac676e8540344d27a3de47e0ad90d21","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/c64eff368ac676e8540344d27a3de47e0ad90d21.patch"},{"sha":"c4dbca5be33c6203d2f611dbd7502f887e4cd954","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/c4dbca5be33c6203d2f611dbd7502f887e4cd954.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39822","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39822.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39789","title":"crypto: x86/aegis - Add missing error checks","status":"backported","project":false,"upstream":[{"sha":"3d9eb180fbe8828cce43bce4c370124685b205c3","url":"https://git.kernel.org/stable/c/3d9eb180fbe8828cce43bce4c370124685b205c3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3d9eb180fbe8828cce43bce4c370124685b205c3","lines":97,"reason":"","source":"https://github.com/torvalds/linux/commit/3d9eb180fbe8828cce43bce4c370124685b205c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39789","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39789.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39779","title":"btrfs: subpage: keep TOWRITE tag until folio is cleaned","status":"backported","project":false,"upstream":[{"sha":"b1511360c8ac882b0c52caa263620538e8d73220","url":"https://git.kernel.org/stable/c/b1511360c8ac882b0c52caa263620538e8d73220"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b1511360c8ac882b0c52caa263620538e8d73220","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/b1511360c8ac882b0c52caa263620538e8d73220.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39779","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39779.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39775","title":"mm/mremap: fix WARN with uffd that has remap events disabled","status":"backported","project":false,"upstream":[{"sha":"772e5b4a5e8360743645b9a466842d16092c4f94","url":"https://git.kernel.org/stable/c/772e5b4a5e8360743645b9a466842d16092c4f94"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"772e5b4a5e8360743645b9a466842d16092c4f94","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/772e5b4a5e8360743645b9a466842d16092c4f94.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39762","title":"drm/amd/display: add null check","status":"backported","project":false,"upstream":[{"sha":"158b9201c17fc93ed4253c2f03b77fd2671669a1","url":"https://git.kernel.org/stable/c/158b9201c17fc93ed4253c2f03b77fd2671669a1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"158b9201c17fc93ed4253c2f03b77fd2671669a1","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/158b9201c17fc93ed4253c2f03b77fd2671669a1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39747","title":"drm/msm: Add error handling for krealloc in metadata setup","status":"backported","project":false,"upstream":[{"sha":"1c8c354098ea9d4376a58c96ae6b65288a6f15d8","url":"https://git.kernel.org/stable/c/1c8c354098ea9d4376a58c96ae6b65288a6f15d8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c8c354098ea9d4376a58c96ae6b65288a6f15d8","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/1c8c354098ea9d4376a58c96ae6b65288a6f15d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39747","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39747.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39746","title":"wifi: ath10k: shutdown driver when hardware is unreliable","status":"backported","project":false,"upstream":[{"sha":"c256a94d1b1b15109740306f7f2a7c2173e12072","url":"https://git.kernel.org/stable/c/c256a94d1b1b15109740306f7f2a7c2173e12072"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c256a94d1b1b15109740306f7f2a7c2173e12072","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/c256a94d1b1b15109740306f7f2a7c2173e12072.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39746","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39746.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39732","title":"wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()","status":"backported","project":false,"upstream":[{"sha":"65c12b104cb942d588a1a093acc4537fb3d3b129","url":"https://git.kernel.org/stable/c/65c12b104cb942d588a1a093acc4537fb3d3b129"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"65c12b104cb942d588a1a093acc4537fb3d3b129","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/65c12b104cb942d588a1a093acc4537fb3d3b129.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39732","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39732.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39707","title":"drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities","status":"backported","project":false,"upstream":[{"sha":"b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288","url":"https://git.kernel.org/stable/c/b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39707","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39707.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38722","title":"habanalabs: fix UAF in export_dmabuf()","status":"backported","project":false,"upstream":[{"sha":"33927f3d0ecdcff06326d6e4edb6166aed42811c","url":"https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"33927f3d0ecdcff06326d6e4edb6166aed42811c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38722","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38722.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38717","title":"net: kcm: Fix race condition in kcm_unattach()","status":"backported","project":false,"upstream":[{"sha":"52565a935213cd6a8662ddb8efe5b4219343a25d","url":"https://git.kernel.org/stable/c/52565a935213cd6a8662ddb8efe5b4219343a25d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"52565a935213cd6a8662ddb8efe5b4219343a25d","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/52565a935213cd6a8662ddb8efe5b4219343a25d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38717","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38717.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38716","title":"hfs: fix general protection fault in hfs_find_init()","status":"backported","project":false,"upstream":[{"sha":"736a0516a16268995f4898eded49bfef077af709","url":"https://git.kernel.org/stable/c/736a0516a16268995f4898eded49bfef077af709"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"736a0516a16268995f4898eded49bfef077af709","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/736a0516a16268995f4898eded49bfef077af709.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38716","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38716.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38675","title":"xfrm: state: initialize state_ptrs earlier in xfrm_state_find","status":"backported","project":false,"upstream":[{"sha":"94d077c331730510d5611b438640a292097341f0","url":"https://git.kernel.org/stable/c/94d077c331730510d5611b438640a292097341f0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"94d077c331730510d5611b438640a292097341f0","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/94d077c331730510d5611b438640a292097341f0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38675","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38675.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38660","title":"[ceph] parse_longname(): strrchr() expects NUL-terminated string","status":"backported","project":false,"upstream":[{"sha":"101841c38346f4ca41dc1802c867da990ffb32eb","url":"https://git.kernel.org/stable/c/101841c38346f4ca41dc1802c867da990ffb32eb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"101841c38346f4ca41dc1802c867da990ffb32eb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38660","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38660.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38656","title":"wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()","status":"not-applicable","project":false,"upstream":[{"sha":"cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6","url":"https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38656","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38656.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38636","title":"rv: Use strings in da monitors tracepoints","status":"backported","project":false,"upstream":[{"sha":"7f904ff6e58d398c4336f3c19c42b338324451f7","url":"https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7f904ff6e58d398c4336f3c19c42b338324451f7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38636","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38636.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38621","title":"md: make rdev_addable usable for rcu mode","status":"backported","project":false,"upstream":[{"sha":"13017b427118f4311471ee47df74872372ca8482","url":"https://git.kernel.org/stable/c/13017b427118f4311471ee47df74872372ca8482"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"13017b427118f4311471ee47df74872372ca8482","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38621","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38621.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38616","title":"tls: handle data disappearing from under the TLS ULP","status":"backported","project":false,"upstream":[{"sha":"6db015fc4b5d5f63a64a193f65d98da3a7fc811d","url":"https://git.kernel.org/stable/c/6db015fc4b5d5f63a64a193f65d98da3a7fc811d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"6db015fc4b5d5f63a64a193f65d98da3a7fc811d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38616","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38616.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38591","title":"bpf: Reject narrower access to pointer ctx fields","status":"backported","project":false,"upstream":[{"sha":"e09299225d5ba3916c91ef70565f7d2187e4cca0","url":"https://git.kernel.org/stable/c/e09299225d5ba3916c91ef70565f7d2187e4cca0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e09299225d5ba3916c91ef70565f7d2187e4cca0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38585","title":"staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()","status":"backported","project":false,"upstream":[{"sha":"ee4cf798202d285dcbe85e4467a094c44f5ed8e6","url":"https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","url":"https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"ee4cf798202d285dcbe85e4467a094c44f5ed8e6","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/ee4cf798202d285dcbe85e4467a094c44f5ed8e6.patch"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","lines":168072,"reason":"","source":"https://github.com/torvalds/linux/commit/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38585","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38585.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38449","title":"drm/gem: Acquire references on GEM handles for framebuffers","status":"backported","project":false,"upstream":[{"sha":"5307dce878d4126e1b375587318955bd019c3741","url":"https://git.kernel.org/stable/c/5307dce878d4126e1b375587318955bd019c3741"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"5307dce878d4126e1b375587318955bd019c3741","lines":122,"reason":"","source":"https://github.com/torvalds/linux/commit/5307dce878d4126e1b375587318955bd019c3741.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38438","title":"ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.","status":"backported","project":false,"upstream":[{"sha":"6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e","url":"https://git.kernel.org/stable/c/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38438","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38438.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38426","title":"drm/amdgpu: Add basic validation for RAS header","status":"backported","project":false,"upstream":[{"sha":"5df0d6addb7e9b6f71f7162d1253762a5be9138e","url":"https://git.kernel.org/stable/c/5df0d6addb7e9b6f71f7162d1253762a5be9138e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5df0d6addb7e9b6f71f7162d1253762a5be9138e","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/5df0d6addb7e9b6f71f7162d1253762a5be9138e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38426","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38426.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38372","title":"RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling","status":"backported","project":false,"upstream":[{"sha":"2c6b640ea08bff1a192bf87fa45246ff1e40767c","url":"https://git.kernel.org/stable/c/2c6b640ea08bff1a192bf87fa45246ff1e40767c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c6b640ea08bff1a192bf87fa45246ff1e40767c","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/2c6b640ea08bff1a192bf87fa45246ff1e40767c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38372","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38372.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38369","title":"dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using","status":"backported","project":false,"upstream":[{"sha":"17502e7d7b7113346296f6758324798d536c31fd","url":"https://git.kernel.org/stable/c/17502e7d7b7113346296f6758324798d536c31fd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"17502e7d7b7113346296f6758324798d536c31fd","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/17502e7d7b7113346296f6758324798d536c31fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38369","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38369.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38333","title":"f2fs: fix to bail out in get_new_segment()","status":"backported","project":false,"upstream":[{"sha":"bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2","url":"https://git.kernel.org/stable/c/bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38311","title":"iavf: get rid of the crit lock","status":"backported","project":false,"upstream":[{"sha":"120f28a6f314fef7f282c99f196923fe44081cad","url":"https://git.kernel.org/stable/c/120f28a6f314fef7f282c99f196923fe44081cad"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"120f28a6f314fef7f282c99f196923fe44081cad","lines":513,"reason":"","source":"https://github.com/torvalds/linux/commit/120f28a6f314fef7f282c99f196923fe44081cad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38311","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38311.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38264","title":"nvme-tcp: sanitize request list handling","status":"backported","project":false,"upstream":[{"sha":"0bf04c874fcb1ae46a863034296e4b33d8fbd66c","url":"https://git.kernel.org/stable/c/0bf04c874fcb1ae46a863034296e4b33d8fbd66c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0bf04c874fcb1ae46a863034296e4b33d8fbd66c","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/0bf04c874fcb1ae46a863034296e4b33d8fbd66c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38264","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38264.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38237","title":"media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()","status":"backported","project":false,"upstream":[{"sha":"bd9f6ce7d512fa21249415c16af801a4ed5d97b6","url":"https://git.kernel.org/stable/c/bd9f6ce7d512fa21249415c16af801a4ed5d97b6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"bd9f6ce7d512fa21249415c16af801a4ed5d97b6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38207","title":"mm: fix uprobe pte be overwritten when expanding vma","status":"backported","project":false,"upstream":[{"sha":"2b12d06c37fd3a394376f42f026a7478d826ed63","url":"https://git.kernel.org/stable/c/2b12d06c37fd3a394376f42f026a7478d826ed63"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b12d06c37fd3a394376f42f026a7478d826ed63","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/2b12d06c37fd3a394376f42f026a7478d826ed63.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38207","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38207.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38206","title":"exfat: fix double free in delayed_free","status":"backported","project":false,"upstream":[{"sha":"1f3d9724e16d62c7d42c67d6613b8512f2887c22","url":"https://git.kernel.org/stable/c/1f3d9724e16d62c7d42c67d6613b8512f2887c22"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1f3d9724e16d62c7d42c67d6613b8512f2887c22","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38206","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38206.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38205","title":"drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1","status":"backported","project":false,"upstream":[{"sha":"7e40f64896e8e3dca471e287672db5ace12ea0be","url":"https://git.kernel.org/stable/c/7e40f64896e8e3dca471e287672db5ace12ea0be"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7e40f64896e8e3dca471e287672db5ace12ea0be","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38205","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38205.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38203","title":"jfs: Fix null-ptr-deref in jfs_ioc_trim","status":"backported","project":false,"upstream":[{"sha":"a4685408ff6c3e2af366ad9a7274f45ff3f394ee","url":"https://git.kernel.org/stable/c/a4685408ff6c3e2af366ad9a7274f45ff3f394ee"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a4685408ff6c3e2af366ad9a7274f45ff3f394ee","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38203","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38203.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38199","title":"wifi: ath12k: Fix memory leak due to multiple rx_stats allocation","status":"backported","project":false,"upstream":[{"sha":"c426497fa2055c8005196922e7d29c41d7e0948a","url":"https://git.kernel.org/stable/c/c426497fa2055c8005196922e7d29c41d7e0948a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c426497fa2055c8005196922e7d29c41d7e0948a","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/c426497fa2055c8005196922e7d29c41d7e0948a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38199","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38199.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38187","title":"drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()","status":"backported","project":false,"upstream":[{"sha":"9802f0a63b641f4cddb2139c814c2e95cb825099","url":"https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"9802f0a63b641f4cddb2139c814c2e95cb825099","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/9802f0a63b641f4cddb2139c814c2e95cb825099.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38187","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38187.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38140","title":"dm: limit swapping tables for devices with zone write plugs","status":"backported","project":false,"upstream":[{"sha":"121218bef4c1df165181f5cd8fc3a2246bac817e","url":"https://git.kernel.org/stable/c/121218bef4c1df165181f5cd8fc3a2246bac817e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"121218bef4c1df165181f5cd8fc3a2246bac817e","lines":166,"reason":"","source":"https://github.com/torvalds/linux/commit/121218bef4c1df165181f5cd8fc3a2246bac817e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38140","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38140.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38137","title":"PCI/pwrctrl: Cancel outstanding rescan work when unregistering","status":"backported","project":false,"upstream":[{"sha":"8b926f237743f020518162c62b93cb7107a2b5eb","url":"https://git.kernel.org/stable/c/8b926f237743f020518162c62b93cb7107a2b5eb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8b926f237743f020518162c62b93cb7107a2b5eb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/8b926f237743f020518162c62b93cb7107a2b5eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38080","title":"drm/amd/display: Increase block_sequence array size","status":"backported","project":false,"upstream":[{"sha":"3a7810c212bcf2f722671dadf4b23ff70a7d23ee","url":"https://git.kernel.org/stable/c/3a7810c212bcf2f722671dadf4b23ff70a7d23ee"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a7810c212bcf2f722671dadf4b23ff70a7d23ee","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3a7810c212bcf2f722671dadf4b23ff70a7d23ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38080","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38080.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38039","title":"net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled","status":"backported","project":false,"upstream":[{"sha":"689805dcc474c2accb5cffbbcea1c06ee4a54570","url":"https://git.kernel.org/stable/c/689805dcc474c2accb5cffbbcea1c06ee4a54570"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"689805dcc474c2accb5cffbbcea1c06ee4a54570","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/689805dcc474c2accb5cffbbcea1c06ee4a54570.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38039","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38039.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38038","title":"cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost","status":"backported","project":false,"upstream":[{"sha":"db1cafc77aaaf871509da06f4a864e9af6d6791f","url":"https://git.kernel.org/stable/c/db1cafc77aaaf871509da06f4a864e9af6d6791f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"db1cafc77aaaf871509da06f4a864e9af6d6791f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/db1cafc77aaaf871509da06f4a864e9af6d6791f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38038","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38038.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38036","title":"drm/xe/vf: Perform early GT MMIO initialization to read GMDID","status":"backported","project":false,"upstream":[{"sha":"13265fe7426ec9ba5aa86baab913417ca361e8a4","url":"https://git.kernel.org/stable/c/13265fe7426ec9ba5aa86baab913417ca361e8a4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"13265fe7426ec9ba5aa86baab913417ca361e8a4","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/13265fe7426ec9ba5aa86baab913417ca361e8a4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38036","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38036.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38014","title":"dmaengine: idxd: Refactor remove call with idxd_cleanup() helper","status":"backported","project":false,"upstream":[{"sha":"a409e919ca321cc0e28f8abf96fde299f0072a81","url":"https://git.kernel.org/stable/c/a409e919ca321cc0e28f8abf96fde299f0072a81"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a409e919ca321cc0e28f8abf96fde299f0072a81","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/a409e919ca321cc0e28f8abf96fde299f0072a81.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38014","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38014.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37907","title":"accel/ivpu: Fix locking order in ivpu_job_submit","status":"backported","project":false,"upstream":[{"sha":"ab680dc6c78aa035e944ecc8c48a1caab9f39924","url":"https://git.kernel.org/stable/c/ab680dc6c78aa035e944ecc8c48a1caab9f39924"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ab680dc6c78aa035e944ecc8c48a1caab9f39924","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/ab680dc6c78aa035e944ecc8c48a1caab9f39924.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37907","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37907.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37880","title":"um: work around sched_yield not yielding in time-travel mode","status":"backported","project":false,"upstream":[{"sha":"887c5c12e80c8424bd471122d2e8b6b462e12874","url":"https://git.kernel.org/stable/c/887c5c12e80c8424bd471122d2e8b6b462e12874"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"887c5c12e80c8424bd471122d2e8b6b462e12874","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/887c5c12e80c8424bd471122d2e8b6b462e12874.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37880","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37880.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37870","title":"drm/amd/display: prevent hang on link training fail","status":"backported","project":false,"upstream":[{"sha":"8058061ed9d6bc259d1e678607b07d259342c08f","url":"https://git.kernel.org/stable/c/8058061ed9d6bc259d1e678607b07d259342c08f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8058061ed9d6bc259d1e678607b07d259342c08f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8058061ed9d6bc259d1e678607b07d259342c08f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37834","title":"mm/vmscan: don't try to reclaim hwpoison folio","status":"backported","project":false,"upstream":[{"sha":"1b0449544c6482179ac84530b61fc192a6527bfd","url":"https://git.kernel.org/stable/c/1b0449544c6482179ac84530b61fc192a6527bfd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1b0449544c6482179ac84530b61fc192a6527bfd","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/1b0449544c6482179ac84530b61fc192a6527bfd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37833","title":"net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads","status":"backported","project":false,"upstream":[{"sha":"fbb429ddff5c8e479edcc7dde5a542c9295944e6","url":"https://git.kernel.org/stable/c/fbb429ddff5c8e479edcc7dde5a542c9295944e6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"fbb429ddff5c8e479edcc7dde5a542c9295944e6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37833","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37833.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37826","title":"scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()","status":"backported","project":false,"upstream":[{"sha":"08a966a917fe3d92150fa3cc15793ad5e57051eb","url":"https://git.kernel.org/stable/c/08a966a917fe3d92150fa3cc15793ad5e57051eb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"08a966a917fe3d92150fa3cc15793ad5e57051eb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/08a966a917fe3d92150fa3cc15793ad5e57051eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37802","title":"ksmbd: fix WARNING \"do not call blocking ops when !TASK_RUNNING\"","status":"backported","project":false,"upstream":[{"sha":"1df0d4c616138784e033ad337961b6e1a6bcd999","url":"https://git.kernel.org/stable/c/1df0d4c616138784e033ad337961b6e1a6bcd999"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1df0d4c616138784e033ad337961b6e1a6bcd999","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/1df0d4c616138784e033ad337961b6e1a6bcd999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37802","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37802.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37800","title":"driver core: fix potential NULL pointer dereference in dev_uevent()","status":"backported","project":false,"upstream":[{"sha":"18daa52418e7e4629ed1703b64777294209d2622","url":"https://git.kernel.org/stable/c/18daa52418e7e4629ed1703b64777294209d2622"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"18daa52418e7e4629ed1703b64777294209d2622","lines":79,"reason":"","source":"https://github.com/torvalds/linux/commit/18daa52418e7e4629ed1703b64777294209d2622.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37800","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37800.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37777","title":"ksmbd: fix use-after-free in __smb2_lease_break_noti()","status":"backported","project":false,"upstream":[{"sha":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","url":"https://git.kernel.org/stable/c/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37777","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37777.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37776","title":"ksmbd: fix use-after-free in smb_break_all_levII_oplock()","status":"backported","project":false,"upstream":[{"sha":"18b4fac5ef17f77fed9417d22210ceafd6525fc7","url":"https://git.kernel.org/stable/c/18b4fac5ef17f77fed9417d22210ceafd6525fc7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"18b4fac5ef17f77fed9417d22210ceafd6525fc7","lines":91,"reason":"","source":"https://github.com/torvalds/linux/commit/18b4fac5ef17f77fed9417d22210ceafd6525fc7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37776","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37776.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37750","title":"smb: client: fix UAF in decryption with multichannel","status":"backported","project":false,"upstream":[{"sha":"9502dd5c7029902f4a425bf959917a5a9e7c0e50","url":"https://git.kernel.org/stable/c/9502dd5c7029902f4a425bf959917a5a9e7c0e50"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9502dd5c7029902f4a425bf959917a5a9e7c0e50","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37750","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37750.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23133","title":"wifi: ath11k: update channel list in reg notifier instead reg worker","status":"backported","project":false,"upstream":[{"sha":"933ab187e679e6fbdeea1835ae39efcc59c022d2","url":"https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"933ab187e679e6fbdeea1835ae39efcc59c022d2","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/933ab187e679e6fbdeea1835ae39efcc59c022d2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23133","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23133.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23132","title":"f2fs: quota: fix to avoid warning in dquot_writeback_dquots()","status":"backported","project":false,"upstream":[{"sha":"eb85c2410d6f581e957cd03a644ff6ddbe592af9","url":"https://git.kernel.org/stable/c/eb85c2410d6f581e957cd03a644ff6ddbe592af9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"eb85c2410d6f581e957cd03a644ff6ddbe592af9","lines":232,"reason":"","source":"https://github.com/torvalds/linux/commit/eb85c2410d6f581e957cd03a644ff6ddbe592af9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23132","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23132.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23130","title":"f2fs: fix to avoid panic once fallocation fails for pinfile","status":"backported","project":false,"upstream":[{"sha":"48ea8b200414ac69ea96f4c231f5c7ef1fbeffef","url":"https://git.kernel.org/stable/c/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"48ea8b200414ac69ea96f4c231f5c7ef1fbeffef","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23130","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23130.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23129","title":"wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path","status":"backported","project":false,"upstream":[{"sha":"68410c5bd381a81bcc92b808e7dc4e6b9ed25d11","url":"https://git.kernel.org/stable/c/68410c5bd381a81bcc92b808e7dc4e6b9ed25d11"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"68410c5bd381a81bcc92b808e7dc4e6b9ed25d11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22127","title":"f2fs: fix potential deadloop in prepare_compress_overwrite()","status":"backported","project":false,"upstream":[{"sha":"3147ee567dd9004a49826ddeaf0a4b12865d4409","url":"https://git.kernel.org/stable/c/3147ee567dd9004a49826ddeaf0a4b12865d4409"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3147ee567dd9004a49826ddeaf0a4b12865d4409","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22127","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22127.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22125","title":"md/raid1,raid10: don't ignore IO flags","status":"backported","project":false,"upstream":[{"sha":"e879a0d9cb086c8e52ce6c04e5bfa63825a6213c","url":"https://git.kernel.org/stable/c/e879a0d9cb086c8e52ce6c04e5bfa63825a6213c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"e879a0d9cb086c8e52ce6c04e5bfa63825a6213c","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/e879a0d9cb086c8e52ce6c04e5bfa63825a6213c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22124","title":"md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb","status":"backported","project":false,"upstream":[{"sha":"6130825f34d41718c98a9b1504a79a23e379701e","url":"https://git.kernel.org/stable/c/6130825f34d41718c98a9b1504a79a23e379701e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"6130825f34d41718c98a9b1504a79a23e379701e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22124","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22124.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22113","title":"ext4: avoid journaling sb update on error if journal is destroying","status":"backported","project":false,"upstream":[{"sha":"ce2f26e73783b4a7c46a86e3af5b5c8de0971790","url":"https://git.kernel.org/stable/c/ce2f26e73783b4a7c46a86e3af5b5c8de0971790"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ce2f26e73783b4a7c46a86e3af5b5c8de0971790","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/ce2f26e73783b4a7c46a86e3af5b5c8de0971790.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22113","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22113.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22108","title":"bnxt_en: Mask the bd_cnt field in the TX BD properly","status":"backported","project":false,"upstream":[{"sha":"107b25db61122d8f990987895c2912927b8b6e3f","url":"https://git.kernel.org/stable/c/107b25db61122d8f990987895c2912927b8b6e3f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"107b25db61122d8f990987895c2912927b8b6e3f","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/107b25db61122d8f990987895c2912927b8b6e3f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22108","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22108.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22104","title":"ibmvnic: Use kernel helpers for hex dumps","status":"backported","project":false,"upstream":[{"sha":"d93a6caab5d7d9b5ce034d75b1e1e993338e3852","url":"https://git.kernel.org/stable/c/d93a6caab5d7d9b5ce034d75b1e1e993338e3852"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d93a6caab5d7d9b5ce034d75b1e1e993338e3852","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22104","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22104.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22103","title":"net: fix NULL pointer dereference in l3mdev_l3_rcv","status":"backported","project":false,"upstream":[{"sha":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","url":"https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22101","title":"net: libwx: fix Tx L4 checksum","status":"backported","project":false,"upstream":[{"sha":"c7d82913d5f9e97860772ee4051eaa66b56a6273","url":"https://git.kernel.org/stable/c/c7d82913d5f9e97860772ee4051eaa66b56a6273"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"c7d82913d5f9e97860772ee4051eaa66b56a6273","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22043","title":"ksmbd: add bounds check for durable handle context","status":"backported","project":false,"upstream":[{"sha":"542027e123fc0bfd61dd59e21ae0ee4ef2101b29","url":"https://git.kernel.org/stable/c/542027e123fc0bfd61dd59e21ae0ee4ef2101b29"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"542027e123fc0bfd61dd59e21ae0ee4ef2101b29","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/542027e123fc0bfd61dd59e21ae0ee4ef2101b29.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22039","title":"ksmbd: fix overflow in dacloffset bounds check","status":"backported","project":false,"upstream":[{"sha":"beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42","url":"https://git.kernel.org/stable/c/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22039","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22039.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22028","title":"media: vimc: skip .s_stream() for stopped entities","status":"backported","project":false,"upstream":[{"sha":"36cef585e2a31e4ddf33a004b0584a7a572246de","url":"https://git.kernel.org/stable/c/36cef585e2a31e4ddf33a004b0584a7a572246de"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"36cef585e2a31e4ddf33a004b0584a7a572246de","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/36cef585e2a31e4ddf33a004b0584a7a572246de.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21985","title":"drm/amd/display: Fix out-of-bound accesses","status":"backported","project":false,"upstream":[{"sha":"8adbb2a98b00926315fd513b5fe2596b5716b82d","url":"https://git.kernel.org/stable/c/8adbb2a98b00926315fd513b5fe2596b5716b82d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8adbb2a98b00926315fd513b5fe2596b5716b82d","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/8adbb2a98b00926315fd513b5fe2596b5716b82d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21985","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21985.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21976","title":"fbdev: hyperv_fb: Allow graceful removal of framebuffer","status":"backported","project":false,"upstream":[{"sha":"ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","url":"https://git.kernel.org/stable/c/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21976","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21976.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21949","title":"LoongArch: Set hugetlb mmap base address aligned with pmd size","status":"backported","project":false,"upstream":[{"sha":"3109d5ff484b7bc7b955f166974c6776d91f247b","url":"https://git.kernel.org/stable/c/3109d5ff484b7bc7b955f166974c6776d91f247b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3109d5ff484b7bc7b955f166974c6776d91f247b","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/3109d5ff484b7bc7b955f166974c6776d91f247b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21942","title":"btrfs: zoned: fix extent range end unlock in cow_file_range()","status":"not-applicable","project":false,"upstream":[{"sha":"5a4041f2c47247575a6c2e53ce14f7b0ac946c33","url":"https://git.kernel.org/stable/c/5a4041f2c47247575a6c2e53ce14f7b0ac946c33"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5a4041f2c47247575a6c2e53ce14f7b0ac946c33","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/5a4041f2c47247575a6c2e53ce14f7b0ac946c33.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21942","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21942.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21907","title":"mm: memory-failure: update ttu flag inside unmap_poisoned_folio","status":"backported","project":false,"upstream":[{"sha":"b81679b1633aa43c0d973adfa816d78c1ed0d032","url":"https://git.kernel.org/stable/c/b81679b1633aa43c0d973adfa816d78c1ed0d032"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"b81679b1633aa43c0d973adfa816d78c1ed0d032","lines":128,"reason":"","source":"https://github.com/torvalds/linux/commit/b81679b1633aa43c0d973adfa816d78c1ed0d032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21907","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21907.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21886","title":"RDMA/mlx5: Fix implicit ODP hang on parent deregistration","status":"not-applicable","project":false,"upstream":[{"sha":"3d8c6f26893d55fab218ad086719de1fc9bb86ba","url":"https://git.kernel.org/stable/c/3d8c6f26893d55fab218ad086719de1fc9bb86ba"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3d8c6f26893d55fab218ad086719de1fc9bb86ba","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/3d8c6f26893d55fab218ad086719de1fc9bb86ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21886","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21886.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21870","title":"ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers","status":"backported","project":false,"upstream":[{"sha":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","url":"https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21836","title":"io_uring/kbuf: reallocate buf lists on upgrade","status":"backported","project":false,"upstream":[{"sha":"8802766324e1f5d414a81ac43365c20142e85603","url":"https://git.kernel.org/stable/c/8802766324e1f5d414a81ac43365c20142e85603"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8802766324e1f5d414a81ac43365c20142e85603","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/8802766324e1f5d414a81ac43365c20142e85603.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21836","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21836.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21825","title":"bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT","status":"backported","project":false,"upstream":[{"sha":"58f038e6d209d2dd862fcf5de55407855856794d","url":"https://git.kernel.org/stable/c/58f038e6d209d2dd862fcf5de55407855856794d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"58f038e6d209d2dd862fcf5de55407855856794d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/58f038e6d209d2dd862fcf5de55407855856794d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21825","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21825.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21817","title":"block: mark GFP_NOIO around sysfs ->store()","status":"not-applicable","project":false,"upstream":[{"sha":"7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c","url":"https://git.kernel.org/stable/c/7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"unknown","patches":[{"sha":"7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21817","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21817.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21752","title":"btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents","status":"backported","project":false,"upstream":[{"sha":"dc14ba10781bd2629835696b7cc1febf914768e9","url":"https://git.kernel.org/stable/c/dc14ba10781bd2629835696b7cc1febf914768e9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"dc14ba10781bd2629835696b7cc1febf914768e9","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/dc14ba10781bd2629835696b7cc1febf914768e9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21732","title":"RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error","status":"backported","project":false,"upstream":[{"sha":"abb604a1a9c87255c7a6f3b784410a9707baf467","url":"https://git.kernel.org/stable/c/abb604a1a9c87255c7a6f3b784410a9707baf467"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"abb604a1a9c87255c7a6f3b784410a9707baf467","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/abb604a1a9c87255c7a6f3b784410a9707baf467.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21732","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21732.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21693","title":"mm: zswap: properly synchronize freeing resources during CPU hotunplug","status":"backported","project":false,"upstream":[{"sha":"12dcb0ef540629a281533f9dedc1b6b8e14cfb65","url":"https://git.kernel.org/stable/c/12dcb0ef540629a281533f9dedc1b6b8e14cfb65"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"12dcb0ef540629a281533f9dedc1b6b8e14cfb65","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/12dcb0ef540629a281533f9dedc1b6b8e14cfb65.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21693","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21693.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21651","title":"net: hns3: don't auto enable misc vector","status":"backported","project":false,"upstream":[{"sha":"98b1e3b27734139c76295754b6c317aa4df6d32e","url":"https://git.kernel.org/stable/c/98b1e3b27734139c76295754b6c317aa4df6d32e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"98b1e3b27734139c76295754b6c317aa4df6d32e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21651","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21651.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21649","title":"net: hns3: fix kernel crash when 1588 is sent on HIP08 devices","status":"backported","project":false,"upstream":[{"sha":"9741e72b2286de8b38de9db685588ac421a95c87","url":"https://git.kernel.org/stable/c/9741e72b2286de8b38de9db685588ac421a95c87"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9741e72b2286de8b38de9db685588ac421a95c87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21649","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21649.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21634","title":"cgroup/cpuset: remove kernfs active break","status":"backported","project":false,"upstream":[{"sha":"3cb97a927fffe443e1e7e8eddbfebfdb062e86ed","url":"https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3cb97a927fffe443e1e7e8eddbfebfdb062e86ed","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58241","title":"Bluetooth: hci_core: Disable works on hci_unregister_dev","status":"backported","project":false,"upstream":[{"sha":"989fa5171f005ecf63440057218d8aeb1795287d","url":"https://git.kernel.org/stable/c/989fa5171f005ecf63440057218d8aeb1795287d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"989fa5171f005ecf63440057218d8aeb1795287d","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/989fa5171f005ecf63440057218d8aeb1795287d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58241","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58241.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58237","title":"bpf: consider that tail calls invalidate packet pointers","status":"backported","project":false,"upstream":[{"sha":"1a4607ffba35bf2a630aab299e34dd3f6e658d70","url":"https://git.kernel.org/stable/c/1a4607ffba35bf2a630aab299e34dd3f6e658d70"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a4607ffba35bf2a630aab299e34dd3f6e658d70","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/1a4607ffba35bf2a630aab299e34dd3f6e658d70.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58100","title":"bpf: check changes_pkt_data property for extension programs","status":"backported","project":false,"upstream":[{"sha":"81f6d0530ba031b5f038a091619bf2ff29568852","url":"https://git.kernel.org/stable/c/81f6d0530ba031b5f038a091619bf2ff29568852"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"81f6d0530ba031b5f038a091619bf2ff29568852","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/81f6d0530ba031b5f038a091619bf2ff29568852.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58100","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58100.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58098","title":"bpf: track changes_pkt_data property for global functions","status":"backported","project":false,"upstream":[{"sha":"51081a3f25c742da5a659d7fc6fd77ebfdd555be","url":"https://git.kernel.org/stable/c/51081a3f25c742da5a659d7fc6fd77ebfdd555be"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"51081a3f25c742da5a659d7fc6fd77ebfdd555be","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/51081a3f25c742da5a659d7fc6fd77ebfdd555be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58098","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58098.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58097","title":"wifi: ath11k: fix RCU stall while reaping monitor destination ring","status":"backported","project":false,"upstream":[{"sha":"16c6c35c03ea73054a1f6d3302a4ce4a331b427d","url":"https://git.kernel.org/stable/c/16c6c35c03ea73054a1f6d3302a4ce4a331b427d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"16c6c35c03ea73054a1f6d3302a4ce4a331b427d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58095","title":"jfs: add check read-only before txBeginAnon() call","status":"backported","project":false,"upstream":[{"sha":"0176e69743ecc02961f2ae1ea42439cd2bf9ed58","url":"https://git.kernel.org/stable/c/0176e69743ecc02961f2ae1ea42439cd2bf9ed58"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0176e69743ecc02961f2ae1ea42439cd2bf9ed58","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58095","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58095.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58094","title":"jfs: add check read-only before truncation in jfs_truncate_nolock()","status":"backported","project":false,"upstream":[{"sha":"b5799dd77054c1ec49b0088b006c9908e256843b","url":"https://git.kernel.org/stable/c/b5799dd77054c1ec49b0088b006c9908e256843b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"b5799dd77054c1ec49b0088b006c9908e256843b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58094","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58094.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58089","title":"btrfs: fix double accounting race when btrfs_run_delalloc_range() failed","status":"backported","project":false,"upstream":[{"sha":"72dad8e377afa50435940adfb697e070d3556670","url":"https://git.kernel.org/stable/c/72dad8e377afa50435940adfb697e070d3556670"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"72dad8e377afa50435940adfb697e070d3556670","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/72dad8e377afa50435940adfb697e070d3556670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58053","title":"rxrpc: Fix handling of received connection abort","status":"backported","project":false,"upstream":[{"sha":"0e56ebde245e4799ce74d38419426f2a80d39950","url":"https://git.kernel.org/stable/c/0e56ebde245e4799ce74d38419426f2a80d39950"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0e56ebde245e4799ce74d38419426f2a80d39950","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/0e56ebde245e4799ce74d38419426f2a80d39950.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58053","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58053.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58015","title":"wifi: ath12k: Fix for out-of bound access error","status":"backported","project":false,"upstream":[{"sha":"eb8c0534713865d190856f10bfc97cf0b88475b1","url":"https://git.kernel.org/stable/c/eb8c0534713865d190856f10bfc97cf0b88475b1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb8c0534713865d190856f10bfc97cf0b88475b1","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/eb8c0534713865d190856f10bfc97cf0b88475b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58012","title":"ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params","status":"backported","project":false,"upstream":[{"sha":"569922b82ca660f8b24e705f6cf674e6b1f99cc7","url":"https://git.kernel.org/stable/c/569922b82ca660f8b24e705f6cf674e6b1f99cc7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"569922b82ca660f8b24e705f6cf674e6b1f99cc7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58012","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58012.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57984","title":"i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition","status":"backported","project":false,"upstream":[{"sha":"b75439c945b94dd8a2b645355bdb56f948052601","url":"https://git.kernel.org/stable/c/b75439c945b94dd8a2b645355bdb56f948052601"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b75439c945b94dd8a2b645355bdb56f948052601","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b75439c945b94dd8a2b645355bdb56f948052601.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57984","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57984.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57975","title":"btrfs: do proper folio cleanup when run_delalloc_nocow() failed","status":"backported","project":false,"upstream":[{"sha":"c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","url":"https://git.kernel.org/stable/c/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","lines":150,"reason":"","source":"https://github.com/torvalds/linux/commit/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57872","title":"scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()","status":"backported","project":false,"upstream":[{"sha":"897df60c16d54ad515a3d0887edab5c63da06d1f","url":"https://git.kernel.org/stable/c/897df60c16d54ad515a3d0887edab5c63da06d1f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"897df60c16d54ad515a3d0887edab5c63da06d1f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/897df60c16d54ad515a3d0887edab5c63da06d1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57857","title":"RDMA/siw: Remove direct link to net_device","status":"backported","project":false,"upstream":[{"sha":"16b87037b48889d21854c8e97aec8a1baf2642b3","url":"https://git.kernel.org/stable/c/16b87037b48889d21854c8e97aec8a1baf2642b3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"16b87037b48889d21854c8e97aec8a1baf2642b3","lines":204,"reason":"","source":"https://github.com/torvalds/linux/commit/16b87037b48889d21854c8e97aec8a1baf2642b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57857","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57857.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57809","title":"PCI: imx6: Fix suspend/resume support on i.MX6QDL","status":"backported","project":false,"upstream":[{"sha":"0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3","url":"https://git.kernel.org/stable/c/0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57809","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57809.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57795","title":"RDMA/rxe: Remove the direct link to net_device","status":"backported","project":false,"upstream":[{"sha":"2ac5415022d16d63d912a39a06f32f1f51140261","url":"https://git.kernel.org/stable/c/2ac5415022d16d63d912a39a06f32f1f51140261"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"2ac5415022d16d63d912a39a06f32f1f51140261","lines":260,"reason":"","source":"https://github.com/torvalds/linux/commit/2ac5415022d16d63d912a39a06f32f1f51140261.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57795","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57795.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56775","title":"drm/amd/display: Fix handling of plane refcount","status":"backported","project":false,"upstream":[{"sha":"27227a234c1487cb7a684615f0749c455218833a","url":"https://git.kernel.org/stable/c/27227a234c1487cb7a684615f0749c455218833a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"27227a234c1487cb7a684615f0749c455218833a","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/27227a234c1487cb7a684615f0749c455218833a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56591","title":"Bluetooth: hci_conn: Use disable_delayed_work_sync","status":"backported","project":false,"upstream":[{"sha":"2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df","url":"https://git.kernel.org/stable/c/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56544","title":"udmabuf: change folios array from kmalloc to kvmalloc","status":"backported","project":false,"upstream":[{"sha":"1c0844c6184e658064e14c4335885785ad3bf84b","url":"https://git.kernel.org/stable/c/1c0844c6184e658064e14c4335885785ad3bf84b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c0844c6184e658064e14c4335885785ad3bf84b","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/1c0844c6184e658064e14c4335885785ad3bf84b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56544","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56544.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56538","title":"drm: zynqmp_kms: Unplug DRM device before removal","status":"backported","project":false,"upstream":[{"sha":"2e07c88914fc5289c21820b1aa94f058feb38197","url":"https://git.kernel.org/stable/c/2e07c88914fc5289c21820b1aa94f058feb38197"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2e07c88914fc5289c21820b1aa94f058feb38197","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53687","title":"riscv: Fix IPIs usage in kfence_protect_page()","status":"backported","project":false,"upstream":[{"sha":"b3431a8bb336cece8adc452437befa7d4534b2fd","url":"https://git.kernel.org/stable/c/b3431a8bb336cece8adc452437befa7d4534b2fd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b3431a8bb336cece8adc452437befa7d4534b2fd","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/b3431a8bb336cece8adc452437befa7d4534b2fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53687","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53687.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53219","title":"virtiofs: use pages instead of pointer for kernel direct IO","status":"backported","project":false,"upstream":[{"sha":"41748675c0bf252b3c5f600a95830f0936d366c1","url":"https://git.kernel.org/stable/c/41748675c0bf252b3c5f600a95830f0936d366c1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"41748675c0bf252b3c5f600a95830f0936d366c1","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/41748675c0bf252b3c5f600a95830f0936d366c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53219","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53219.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53218","title":"f2fs: fix race in concurrent f2fs_stop_gc_thread","status":"backported","project":false,"upstream":[{"sha":"7b0033dbc48340a1c1c3f12448ba17d6587ca092","url":"https://git.kernel.org/stable/c/7b0033dbc48340a1c1c3f12448ba17d6587ca092"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7b0033dbc48340a1c1c3f12448ba17d6587ca092","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/7b0033dbc48340a1c1c3f12448ba17d6587ca092.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53218","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53218.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53201","title":"drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe","status":"backported","project":false,"upstream":[{"sha":"6a057072ddd127255350357dd880903e8fa23f36","url":"https://git.kernel.org/stable/c/6a057072ddd127255350357dd880903e8fa23f36"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6a057072ddd127255350357dd880903e8fa23f36","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/6a057072ddd127255350357dd880903e8fa23f36.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53201","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53201.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53187","title":"io_uring: check for overflows in io_pin_pages","status":"backported","project":false,"upstream":[{"sha":"0c0a4eae26ac78379d0c1db053de168a8febc6c9","url":"https://git.kernel.org/stable/c/0c0a4eae26ac78379d0c1db053de168a8febc6c9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0c0a4eae26ac78379d0c1db053de168a8febc6c9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53187","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53187.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53176","title":"smb: During unmount, ensure all cached dir instances drop their dentry","status":"backported","project":false,"upstream":[{"sha":"3fa640d035e5ae526769615c35cb9ed4be6e3662","url":"https://git.kernel.org/stable/c/3fa640d035e5ae526769615c35cb9ed4be6e3662"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"3fa640d035e5ae526769615c35cb9ed4be6e3662","lines":357,"reason":"","source":"https://github.com/torvalds/linux/commit/3fa640d035e5ae526769615c35cb9ed4be6e3662.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53176","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53176.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53134","title":"pmdomain: imx93-blk-ctrl: correct remove path","status":"backported","project":false,"upstream":[{"sha":"f7c7c5aa556378a2c8da72c1f7f238b6648f95fb","url":"https://git.kernel.org/stable/c/f7c7c5aa556378a2c8da72c1f7f238b6648f95fb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"f7c7c5aa556378a2c8da72c1f7f238b6648f95fb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53134","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53134.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53114","title":"x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client","status":"backported","project":false,"upstream":[{"sha":"a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0","url":"https://git.kernel.org/stable/c/a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53114","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53114.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53089","title":"LoongArch: KVM: Mark hrtimer to expire in hard interrupt context","status":"backported","project":false,"upstream":[{"sha":"73adbd92f3223dc0c3506822b71c6b259d5d537b","url":"https://git.kernel.org/stable/c/73adbd92f3223dc0c3506822b71c6b259d5d537b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"73adbd92f3223dc0c3506822b71c6b259d5d537b","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/73adbd92f3223dc0c3506822b71c6b259d5d537b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53085","title":"tpm: Lock TPM chip in tpm_pm_suspend() first","status":"backported","project":false,"upstream":[{"sha":"9265fed6db601ee2ec47577815387458ef4f047a","url":"https://git.kernel.org/stable/c/9265fed6db601ee2ec47577815387458ef4f047a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"9265fed6db601ee2ec47577815387458ef4f047a","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/9265fed6db601ee2ec47577815387458ef4f047a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53079","title":"mm/thp: fix deferred split unqueue naming and locking","status":"backported","project":false,"upstream":[{"sha":"f8f931bba0f92052cf842b7e30917b1afcc77d5a","url":"https://git.kernel.org/stable/c/f8f931bba0f92052cf842b7e30917b1afcc77d5a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"f8f931bba0f92052cf842b7e30917b1afcc77d5a","lines":214,"reason":"","source":"https://github.com/torvalds/linux/commit/f8f931bba0f92052cf842b7e30917b1afcc77d5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53056","title":"drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()","status":"backported","project":false,"upstream":[{"sha":"4018651ba5c409034149f297d3dd3328b91561fd","url":"https://git.kernel.org/stable/c/4018651ba5c409034149f297d3dd3328b91561fd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"4018651ba5c409034149f297d3dd3328b91561fd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53056","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53056.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53051","title":"drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability","status":"backported","project":false,"upstream":[{"sha":"31b42af516afa1e184d1a9f9dd4096c54044269a","url":"https://git.kernel.org/stable/c/31b42af516afa1e184d1a9f9dd4096c54044269a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"31b42af516afa1e184d1a9f9dd4096c54044269a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53051","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53051.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53050","title":"drm/i915/hdcp: Add encoder check in hdcp2_get_capability","status":"backported","project":false,"upstream":[{"sha":"d34f4f058edf1235c103ca9c921dc54820d14d40","url":"https://git.kernel.org/stable/c/d34f4f058edf1235c103ca9c921dc54820d14d40"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d34f4f058edf1235c103ca9c921dc54820d14d40","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53050","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53050.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50289","title":"media: av7110: fix a spectre vulnerability","status":"backported","project":false,"upstream":[{"sha":"458ea1c0be991573ec436aa0afa23baacfae101a","url":"https://git.kernel.org/stable/c/458ea1c0be991573ec436aa0afa23baacfae101a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"458ea1c0be991573ec436aa0afa23baacfae101a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50282","title":"drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()","status":"backported","project":false,"upstream":[{"sha":"4d75b9468021c73108b4439794d69e892b1d24e3","url":"https://git.kernel.org/stable/c/4d75b9468021c73108b4439794d69e892b1d24e3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4d75b9468021c73108b4439794d69e892b1d24e3","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/4d75b9468021c73108b4439794d69e892b1d24e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50282","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50282.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50225","title":"btrfs: fix error propagation of split bios","status":"backported","project":false,"upstream":[{"sha":"d48e1dea3931de64c26717adc2b89743c7ab6594","url":"https://git.kernel.org/stable/c/d48e1dea3931de64c26717adc2b89743c7ab6594"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d48e1dea3931de64c26717adc2b89743c7ab6594","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/d48e1dea3931de64c26717adc2b89743c7ab6594.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50225","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50225.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50217","title":"btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()","status":"backported","project":false,"upstream":[{"sha":"aec8e6bf839101784f3ef037dcdb9432c3f32343","url":"https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"aec8e6bf839101784f3ef037dcdb9432c3f32343","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/aec8e6bf839101784f3ef037dcdb9432c3f32343.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50211","title":"udf: refactor inode_bmap() to handle error","status":"backported","project":false,"upstream":[{"sha":"c226964ec786f3797ed389a16392ce4357697d24","url":"https://git.kernel.org/stable/c/c226964ec786f3797ed389a16392ce4357697d24"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c226964ec786f3797ed389a16392ce4357697d24","lines":173,"reason":"","source":"https://github.com/torvalds/linux/commit/c226964ec786f3797ed389a16392ce4357697d24.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50166","title":"fsl/fman: Fix refcount handling of fman-related devices","status":"backported","project":false,"upstream":[{"sha":"1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1","url":"https://git.kernel.org/stable/c/1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1","lines":151,"reason":"","source":"https://github.com/torvalds/linux/commit/1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50166","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50166.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50111","title":"LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context","status":"backported","project":false,"upstream":[{"sha":"69cc6fad5df4ce652d969be69acc60e269e5eea1","url":"https://git.kernel.org/stable/c/69cc6fad5df4ce652d969be69acc60e269e5eea1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"69cc6fad5df4ce652d969be69acc60e269e5eea1","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/69cc6fad5df4ce652d969be69acc60e269e5eea1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50111","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50111.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50102","title":"x86: fix user address masking non-canonical speculation issue","status":"backported","project":false,"upstream":[{"sha":"86e6b1547b3d013bc392adf775b89318441403c2","url":"https://git.kernel.org/stable/c/86e6b1547b3d013bc392adf775b89318441403c2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"86e6b1547b3d013bc392adf775b89318441403c2","lines":116,"reason":"","source":"https://github.com/torvalds/linux/commit/86e6b1547b3d013bc392adf775b89318441403c2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50057","title":"usb: typec: tipd: Free IRQ only if it was requested before","status":"backported","project":false,"upstream":[{"sha":"db63d9868f7f310de44ba7bea584e2454f8b4ed0","url":"https://git.kernel.org/stable/c/db63d9868f7f310de44ba7bea584e2454f8b4ed0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"db63d9868f7f310de44ba7bea584e2454f8b4ed0","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/db63d9868f7f310de44ba7bea584e2454f8b4ed0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50057","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50057.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50043","title":"nfsd: fix possible badness in FREE_STATEID","status":"backported","project":false,"upstream":[{"sha":"c88c150a467fcb670a1608e2272beeee3e86df6e","url":"https://git.kernel.org/stable/c/c88c150a467fcb670a1608e2272beeee3e86df6e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c88c150a467fcb670a1608e2272beeee3e86df6e","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/c88c150a467fcb670a1608e2272beeee3e86df6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50028","title":"thermal: core: Reference count the zone in thermal_zone_get_by_id()","status":"backported","project":false,"upstream":[{"sha":"a42a5839f400e929c489bb1b58f54596c4535167","url":"https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a42a5839f400e929c489bb1b58f54596c4535167","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/a42a5839f400e929c489bb1b58f54596c4535167.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50017","title":"x86/mm/ident_map: Use gbpages only where full GB page should be mapped.","status":"backported","project":false,"upstream":[{"sha":"cc31744a294584a36bf764a0ffa3255a8e69f036","url":"https://git.kernel.org/stable/c/cc31744a294584a36bf764a0ffa3255a8e69f036"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"cc31744a294584a36bf764a0ffa3255a8e69f036","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49988","title":"ksmbd: add refcnt to ksmbd_conn struct","status":"backported","project":false,"upstream":[{"sha":"ee426bfb9d09b29987369b897fe9b6485ac2be27","url":"https://git.kernel.org/stable/c/ee426bfb9d09b29987369b897fe9b6485ac2be27"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"ee426bfb9d09b29987369b897fe9b6485ac2be27","lines":186,"reason":"","source":"https://github.com/torvalds/linux/commit/ee426bfb9d09b29987369b897fe9b6485ac2be27.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49970","title":"drm/amd/display: Implement bounds check for stream encoder creation in DCN401","status":"backported","project":false,"upstream":[{"sha":"bdf606810210e8e07a0cdf1af3c467291363b295","url":"https://git.kernel.org/stable/c/bdf606810210e8e07a0cdf1af3c467291363b295"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"bdf606810210e8e07a0cdf1af3c467291363b295","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49970","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49970.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49923","title":"drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags","status":"backported","project":false,"upstream":[{"sha":"5559598742fb4538e4c51c48ef70563c49c2af23","url":"https://git.kernel.org/stable/c/5559598742fb4538e4c51c48ef70563c49c2af23"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5559598742fb4538e4c51c48ef70563c49c2af23","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49923","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49923.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49922","title":"drm/amd/display: Check null pointers before using them","status":"backported","project":false,"upstream":[{"sha":"1ff12bcd7deaeed25efb5120433c6a45dd5504a8","url":"https://git.kernel.org/stable/c/1ff12bcd7deaeed25efb5120433c6a45dd5504a8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1ff12bcd7deaeed25efb5120433c6a45dd5504a8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49922","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49922.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49919","title":"drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer","status":"backported","project":false,"upstream":[{"sha":"f22f4754aaa47d8c59f166ba3042182859e5dff7","url":"https://git.kernel.org/stable/c/f22f4754aaa47d8c59f166ba3042182859e5dff7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"f22f4754aaa47d8c59f166ba3042182859e5dff7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49919","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49919.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49918","title":"drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer","status":"backported","project":false,"upstream":[{"sha":"ac2140449184a26eac99585b7f69814bd3ba8f2d","url":"https://git.kernel.org/stable/c/ac2140449184a26eac99585b7f69814bd3ba8f2d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ac2140449184a26eac99585b7f69814bd3ba8f2d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49916","title":"drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw","status":"backported","project":false,"upstream":[{"sha":"4b6377f0e96085cbec96eb7f0b282430ccdd3d75","url":"https://git.kernel.org/stable/c/4b6377f0e96085cbec96eb7f0b282430ccdd3d75"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b6377f0e96085cbec96eb7f0b282430ccdd3d75","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/4b6377f0e96085cbec96eb7f0b282430ccdd3d75.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49916","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49916.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49914","title":"drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe","status":"backported","project":false,"upstream":[{"sha":"8e4ed3cf1642df0c4456443d865cff61a9598aa8","url":"https://git.kernel.org/stable/c/8e4ed3cf1642df0c4456443d865cff61a9598aa8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"8e4ed3cf1642df0c4456443d865cff61a9598aa8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49910","title":"drm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func","status":"backported","project":false,"upstream":[{"sha":"dd340acd42c24a3f28dd22fae6bf38662334264c","url":"https://git.kernel.org/stable/c/dd340acd42c24a3f28dd22fae6bf38662334264c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"dd340acd42c24a3f28dd22fae6bf38662334264c","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/dd340acd42c24a3f28dd22fae6bf38662334264c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49910","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49910.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49908","title":"drm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2)","status":"backported","project":false,"upstream":[{"sha":"0fe20258b4989b9112b5e9470df33a0939403fd4","url":"https://git.kernel.org/stable/c/0fe20258b4989b9112b5e9470df33a0939403fd4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fe20258b4989b9112b5e9470df33a0939403fd4","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/0fe20258b4989b9112b5e9470df33a0939403fd4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49908","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49908.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49906","title":"drm/amd/display: Check null pointer before try to access it","status":"backported","project":false,"upstream":[{"sha":"1b686053c06ffb9f4524b288110cf2a831ff7a25","url":"https://git.kernel.org/stable/c/1b686053c06ffb9f4524b288110cf2a831ff7a25"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1b686053c06ffb9f4524b288110cf2a831ff7a25","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49893","title":"drm/amd/display: Check stream_status before it is used","status":"backported","project":false,"upstream":[{"sha":"58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9","url":"https://git.kernel.org/stable/c/58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49893","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49893.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47752","title":"media: mediatek: vcodec: Fix H264 stateless decoder smatch warning","status":"backported","project":false,"upstream":[{"sha":"7878d3a385efab560dce793b595447867fb163f2","url":"https://git.kernel.org/stable/c/7878d3a385efab560dce793b595447867fb163f2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7878d3a385efab560dce793b595447867fb163f2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47703","title":"bpf, lsm: Add check for BPF LSM return value","status":"backported","project":false,"upstream":[{"sha":"5d99e198be279045e6ecefe220f5c52f8ce9bfd5","url":"https://git.kernel.org/stable/c/5d99e198be279045e6ecefe220f5c52f8ce9bfd5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"5d99e198be279045e6ecefe220f5c52f8ce9bfd5","lines":200,"reason":"","source":"https://github.com/torvalds/linux/commit/5d99e198be279045e6ecefe220f5c52f8ce9bfd5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47703","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47703.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47702","title":"bpf: Fail verification for sign-extension of packet data/data_end/data_meta","status":"backported","project":false,"upstream":[{"sha":"92de36080c93296ef9005690705cba260b9bd68a","url":"https://git.kernel.org/stable/c/92de36080c93296ef9005690705cba260b9bd68a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"92de36080c93296ef9005690705cba260b9bd68a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47702","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47702.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47691","title":"f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()","status":"backported","project":false,"upstream":[{"sha":"c7f114d864ac91515bb07ac271e9824a20f5ed95","url":"https://git.kernel.org/stable/c/c7f114d864ac91515bb07ac271e9824a20f5ed95"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7f114d864ac91515bb07ac271e9824a20f5ed95","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/c7f114d864ac91515bb07ac271e9824a20f5ed95.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47691","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47691.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47683","title":"drm/amd/display: Skip Recompute DSC Params if no Stream on Link","status":"backported","project":false,"upstream":[{"sha":"8151a6c13111b465dbabe07c19f572f7cbd16fef","url":"https://git.kernel.org/stable/c/8151a6c13111b465dbabe07c19f572f7cbd16fef"},{"sha":"50e376f1fe3bf571d0645ddf48ad37eb58323919","url":"https://git.kernel.org/stable/c/50e376f1fe3bf571d0645ddf48ad37eb58323919"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8151a6c13111b465dbabe07c19f572f7cbd16fef","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/8151a6c13111b465dbabe07c19f572f7cbd16fef.patch"},{"sha":"50e376f1fe3bf571d0645ddf48ad37eb58323919","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/50e376f1fe3bf571d0645ddf48ad37eb58323919.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47683","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47683.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47662","title":"drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection","status":"backported","project":false,"upstream":[{"sha":"466423c6dd8af23ebb3a69d43434d01aed0db356","url":"https://git.kernel.org/stable/c/466423c6dd8af23ebb3a69d43434d01aed0db356"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"466423c6dd8af23ebb3a69d43434d01aed0db356","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/466423c6dd8af23ebb3a69d43434d01aed0db356.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47662","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47662.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47661","title":"drm/amd/display: Avoid overflow from uint32_t to uint8_t","status":"backported","project":false,"upstream":[{"sha":"d6b54900c564e35989cf6813e4071504fa0a90e0","url":"https://git.kernel.org/stable/c/d6b54900c564e35989cf6813e4071504fa0a90e0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d6b54900c564e35989cf6813e4071504fa0a90e0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46870","title":"drm/amd/display: Disable DMCUB timeout for DCN35","status":"backported","project":false,"upstream":[{"sha":"7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f","url":"https://git.kernel.org/stable/c/7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46842","title":"scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info","status":"backported","project":false,"upstream":[{"sha":"ede596b1434b57c0b3fd5c02b326efe5c54f6e48","url":"https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ede596b1434b57c0b3fd5c02b326efe5c54f6e48","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46842","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46842.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46834","title":"ethtool: fail closed if we can't get max channel used in indirection tables","status":"backported","project":false,"upstream":[{"sha":"2899d58462ba868287d6ff3acad3675e7adf934f","url":"https://git.kernel.org/stable/c/2899d58462ba868287d6ff3acad3675e7adf934f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2899d58462ba868287d6ff3acad3675e7adf934f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46813","title":"drm/amd/display: Check link_index before accessing dc->links[]","status":"backported","project":false,"upstream":[{"sha":"8aa2864044b9d13e95fe224f32e808afbf79ecdf","url":"https://git.kernel.org/stable/c/8aa2864044b9d13e95fe224f32e808afbf79ecdf"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"8aa2864044b9d13e95fe224f32e808afbf79ecdf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46813","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46813.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46808","title":"drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range","status":"backported","project":false,"upstream":[{"sha":"5524fa301ba649f8cf00848f91468e0ba7e4f24c","url":"https://git.kernel.org/stable/c/5524fa301ba649f8cf00848f91468e0ba7e4f24c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5524fa301ba649f8cf00848f91468e0ba7e4f24c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46806","title":"drm/amdgpu: Fix the warning division or modulo by zero","status":"backported","project":false,"upstream":[{"sha":"1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c","url":"https://git.kernel.org/stable/c/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46776","title":"drm/amd/display: Run DC_LOG_DC after checking link->link_enc","status":"backported","project":false,"upstream":[{"sha":"3a82f62b0d9d7687eac47603bb6cd14a50fa718b","url":"https://git.kernel.org/stable/c/3a82f62b0d9d7687eac47603bb6cd14a50fa718b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a82f62b0d9d7687eac47603bb6cd14a50fa718b","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/3a82f62b0d9d7687eac47603bb6cd14a50fa718b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46776","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46776.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46775","title":"drm/amd/display: Validate function returns","status":"backported","project":false,"upstream":[{"sha":"673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c","url":"https://git.kernel.org/stable/c/673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46760","title":"wifi: rtw88: usb: schedule rx work after everything is set up","status":"backported","project":false,"upstream":[{"sha":"adc539784c98a7cc602cbf557debfc2e7b9be8b3","url":"https://git.kernel.org/stable/c/adc539784c98a7cc602cbf557debfc2e7b9be8b3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"adc539784c98a7cc602cbf557debfc2e7b9be8b3","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/adc539784c98a7cc602cbf557debfc2e7b9be8b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46760","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46760.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46754","title":"bpf: Remove tst_run from lwt_seg6local_prog_ops.","status":"backported","project":false,"upstream":[{"sha":"c13fda93aca118b8e5cd202e339046728ee7dddb","url":"https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"c13fda93aca118b8e5cd202e339046728ee7dddb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46754","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46754.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46730","title":"drm/amd/display: Ensure array index tg_inst won't be -1","status":"backported","project":false,"upstream":[{"sha":"687fe329f18ab0ab0496b20ed2cb003d4879d931","url":"https://git.kernel.org/stable/c/687fe329f18ab0ab0496b20ed2cb003d4879d931"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"687fe329f18ab0ab0496b20ed2cb003d4879d931","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46730","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46730.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46729","title":"drm/amd/display: Fix incorrect size calculation for loop","status":"backported","project":false,"upstream":[{"sha":"3941a3aa4b653b69876d894d08f3fff1cc965267","url":"https://git.kernel.org/stable/c/3941a3aa4b653b69876d894d08f3fff1cc965267"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3941a3aa4b653b69876d894d08f3fff1cc965267","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3941a3aa4b653b69876d894d08f3fff1cc965267.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46729","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46729.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46728","title":"drm/amd/display: Check index for aux_rd_interval before using","status":"backported","project":false,"upstream":[{"sha":"9ba2ea6337b4f159aecb177555a6a81da92d302e","url":"https://git.kernel.org/stable/c/9ba2ea6337b4f159aecb177555a6a81da92d302e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9ba2ea6337b4f159aecb177555a6a81da92d302e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46728","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46728.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46727","title":"drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update","status":"backported","project":false,"upstream":[{"sha":"871cd9d881fa791d3f82885000713de07041c0ae","url":"https://git.kernel.org/stable/c/871cd9d881fa791d3f82885000713de07041c0ae"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"871cd9d881fa791d3f82885000713de07041c0ae","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/871cd9d881fa791d3f82885000713de07041c0ae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46727","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46727.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46701","title":"libfs: fix infinite directory reads for offset dir","status":"backported","project":false,"upstream":[{"sha":"64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a","url":"https://git.kernel.org/stable/c/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46701","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46701.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46698","title":"video/aperture: optionally match the device in sysfb_disable()","status":"backported","project":false,"upstream":[{"sha":"b49420d6a1aeb399e5b107fc6eb8584d0860fbd7","url":"https://git.kernel.org/stable/c/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"b49420d6a1aeb399e5b107fc6eb8584d0860fbd7","lines":108,"reason":"","source":"https://github.com/torvalds/linux/commit/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46698","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46698.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46682","title":"nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open","status":"backported","project":false,"upstream":[{"sha":"a204501e1743d695ca2930ed25a2be9f8ced96d3","url":"https://git.kernel.org/stable/c/a204501e1743d695ca2930ed25a2be9f8ced96d3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a204501e1743d695ca2930ed25a2be9f8ced96d3","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/a204501e1743d695ca2930ed25a2be9f8ced96d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46682","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46682.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46678","title":"bonding: change ipsec_lock from spin lock to mutex","status":"backported","project":false,"upstream":[{"sha":"2aeeef906d5a526dc60cf4af92eda69836c39b1f","url":"https://git.kernel.org/stable/c/2aeeef906d5a526dc60cf4af92eda69836c39b1f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"2aeeef906d5a526dc60cf4af92eda69836c39b1f","lines":199,"reason":"","source":"https://github.com/torvalds/linux/commit/2aeeef906d5a526dc60cf4af92eda69836c39b1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46678","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46678.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-45015","title":"drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()","status":"backported","project":false,"upstream":[{"sha":"aedf02e46eb549dac8db4821a6b9f0c6bf6e3990","url":"https://git.kernel.org/stable/c/aedf02e46eb549dac8db4821a6b9f0c6bf6e3990"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"aedf02e46eb549dac8db4821a6b9f0c6bf6e3990","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/aedf02e46eb549dac8db4821a6b9f0c6bf6e3990.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-45015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-45015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43901","title":"drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401","status":"backported","project":false,"upstream":[{"sha":"5af757124792817f8eb1bd0c80ad60fab519586b","url":"https://git.kernel.org/stable/c/5af757124792817f8eb1bd0c80ad60fab519586b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5af757124792817f8eb1bd0c80ad60fab519586b","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/5af757124792817f8eb1bd0c80ad60fab519586b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43899","title":"drm/amd/display: Fix null pointer deref in dcn20_resource.c","status":"backported","project":false,"upstream":[{"sha":"ecbf60782662f0a388493685b85a645a0ba1613c","url":"https://git.kernel.org/stable/c/ecbf60782662f0a388493685b85a645a0ba1613c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ecbf60782662f0a388493685b85a645a0ba1613c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43888","title":"mm: list_lru: fix UAF for memory cgroup","status":"backported","project":false,"upstream":[{"sha":"5161b48712dcd08ec427c450399d4d1483e21dea","url":"https://git.kernel.org/stable/c/5161b48712dcd08ec427c450399d4d1483e21dea"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5161b48712dcd08ec427c450399d4d1483e21dea","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/5161b48712dcd08ec427c450399d4d1483e21dea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43888","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43888.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43872","title":"RDMA/hns: Fix soft lockup under heavy CEQE load","status":"backported","project":false,"upstream":[{"sha":"2fdf34038369c0a27811e7b4680662a14ada1d6b","url":"https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"2fdf34038369c0a27811e7b4680662a14ada1d6b","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/2fdf34038369c0a27811e7b4680662a14ada1d6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43824","title":"PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()","status":"backported","project":false,"upstream":[{"sha":"5a5095a8bd1bd349cce1c879e5e44407a34dda8a","url":"https://git.kernel.org/stable/c/5a5095a8bd1bd349cce1c879e5e44407a34dda8a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5a5095a8bd1bd349cce1c879e5e44407a34dda8a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43824","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43824.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43819","title":"kvm: s390: Reject memory region operations for ucontrol VMs","status":"backported","project":false,"upstream":[{"sha":"7816e58967d0e6cadce05c8540b47ed027dc2499","url":"https://git.kernel.org/stable/c/7816e58967d0e6cadce05c8540b47ed027dc2499"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7816e58967d0e6cadce05c8540b47ed027dc2499","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43819","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43819.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42317","title":"mm/huge_memory: avoid PMD-size page cache if needed","status":"backported","project":false,"upstream":[{"sha":"d659b715e94ac039803d7601505d3473393fc0be","url":"https://git.kernel.org/stable/c/d659b715e94ac039803d7601505d3473393fc0be"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d659b715e94ac039803d7601505d3473393fc0be","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/d659b715e94ac039803d7601505d3473393fc0be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42239","title":"bpf: Fail bpf_timer_cancel when callback is being cancelled","status":"backported","project":false,"upstream":[{"sha":"d4523831f07a267a943f0dde844bf8ead7495f13","url":"https://git.kernel.org/stable/c/d4523831f07a267a943f0dde844bf8ead7495f13"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d4523831f07a267a943f0dde844bf8ead7495f13","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42239","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42239.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42162","title":"gve: Account for stopped queues when reading NIC stats","status":"backported","project":false,"upstream":[{"sha":"af9bcf910b1f86244f39e15e701b2dc564b469a6","url":"https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"af9bcf910b1f86244f39e15e701b2dc564b469a6","lines":107,"reason":"","source":"https://github.com/torvalds/linux/commit/af9bcf910b1f86244f39e15e701b2dc564b469a6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42162","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42162.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42158","title":"s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings","status":"backported","project":false,"upstream":[{"sha":"22e6824622e8a8889df0f8fc4ed5aea0e702a694","url":"https://git.kernel.org/stable/c/22e6824622e8a8889df0f8fc4ed5aea0e702a694"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"22e6824622e8a8889df0f8fc4ed5aea0e702a694","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/22e6824622e8a8889df0f8fc4ed5aea0e702a694.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42158","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42158.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42123","title":"drm/amdgpu: fix double free err_addr pointer warnings","status":"backported","project":false,"upstream":[{"sha":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","url":"https://git.kernel.org/stable/c/506c245f3f1cd989cb89811a7f06e04ff8813a0d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42118","title":"drm/amd/display: Do not return negative stream id for array","status":"backported","project":false,"upstream":[{"sha":"3ac31c9a707dd1c7c890b95333182f955e9dcb57","url":"https://git.kernel.org/stable/c/3ac31c9a707dd1c7c890b95333182f955e9dcb57"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3ac31c9a707dd1c7c890b95333182f955e9dcb57","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/3ac31c9a707dd1c7c890b95333182f955e9dcb57.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41932","title":"sched: fix warning in sched_setaffinity","status":"backported","project":false,"upstream":[{"sha":"70ee7947a29029736a1a06c73a48ff37674a851b","url":"https://git.kernel.org/stable/c/70ee7947a29029736a1a06c73a48ff37674a851b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"70ee7947a29029736a1a06c73a48ff37674a851b","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/70ee7947a29029736a1a06c73a48ff37674a851b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41085","title":"cxl/mem: Fix no cxl_nvd during pmem region auto-assembling","status":"backported","project":false,"upstream":[{"sha":"84ec985944ef34a34a1605b93ce401aa8737af96","url":"https://git.kernel.org/stable/c/84ec985944ef34a34a1605b93ce401aa8737af96"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"84ec985944ef34a34a1605b93ce401aa8737af96","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41082","title":"nvme-fabrics: use reserved tag for reg read/write command","status":"backported","project":false,"upstream":[{"sha":"7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa","url":"https://git.kernel.org/stable/c/7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41082","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41082.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41045","title":"bpf: Defer work in bpf_timer_cancel_and_free","status":"backported","project":false,"upstream":[{"sha":"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69","url":"https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41045","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41045.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41023","title":"sched/deadline: Fix task_struct reference leak","status":"backported","project":false,"upstream":[{"sha":"b58652db66c910c2245f5bee7deca41c12d707b9","url":"https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"b58652db66c910c2245f5bee7deca41c12d707b9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41023","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41023.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40999","title":"net: ena: Add validation for completion descriptors consistency","status":"backported","project":false,"upstream":[{"sha":"b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7","url":"https://git.kernel.org/stable/c/b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40979","title":"wifi: ath12k: fix kernel crash during resume","status":"backported","project":false,"upstream":[{"sha":"303c017821d88ebad887814114d4e5966d320b28","url":"https://git.kernel.org/stable/c/303c017821d88ebad887814114d4e5966d320b28"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"303c017821d88ebad887814114d4e5966d320b28","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40979","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40979.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40975","title":"platform/x86: x86-android-tablets: Unregister devices in reverse order","status":"backported","project":false,"upstream":[{"sha":"3de0f2627ef849735f155c1818247f58404dddfe","url":"https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3de0f2627ef849735f155c1818247f58404dddfe","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40969","title":"f2fs: don't set RO when shutting down f2fs","status":"backported","project":false,"upstream":[{"sha":"3bdb7f161697e2d5123b89fe1778ef17a44858e7","url":"https://git.kernel.org/stable/c/3bdb7f161697e2d5123b89fe1778ef17a44858e7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3bdb7f161697e2d5123b89fe1778ef17a44858e7","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/3bdb7f161697e2d5123b89fe1778ef17a44858e7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40969","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40969.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40965","title":"i2c: lpi2c: Avoid calling clk_get_rate during transfer","status":"backported","project":false,"upstream":[{"sha":"4268254a39484fc11ba991ae148bacbe75d9cc0a","url":"https://git.kernel.org/stable/c/4268254a39484fc11ba991ae148bacbe75d9cc0a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4268254a39484fc11ba991ae148bacbe75d9cc0a","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/4268254a39484fc11ba991ae148bacbe75d9cc0a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40965","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40965.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40918","title":"parisc: Try to fix random segmentation faults in package builds","status":"backported","project":false,"upstream":[{"sha":"72d95924ee35c8cd16ef52f912483ee938a34d49","url":"https://git.kernel.org/stable/c/72d95924ee35c8cd16ef52f912483ee938a34d49"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"72d95924ee35c8cd16ef52f912483ee938a34d49","lines":655,"reason":"","source":"https://github.com/torvalds/linux/commit/72d95924ee35c8cd16ef52f912483ee938a34d49.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-39508","title":"io_uring/io-wq: Use set_bit() and test_bit() at worker->flags","status":"backported","project":false,"upstream":[{"sha":"8a565304927fbd28c9f028c492b5c1714002cbab","url":"https://git.kernel.org/stable/c/8a565304927fbd28c9f028c492b5c1714002cbab"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"8a565304927fbd28c9f028c492b5c1714002cbab","lines":137,"reason":"","source":"https://github.com/torvalds/linux/commit/8a565304927fbd28c9f028c492b5c1714002cbab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-39508","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-39508.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-39478","title":"crypto: starfive - Do not free stack buffer","status":"backported","project":false,"upstream":[{"sha":"d7f01649f4eaf1878472d3d3f480ae1e50d98f6c","url":"https://git.kernel.org/stable/c/d7f01649f4eaf1878472d3d3f480ae1e50d98f6c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d7f01649f4eaf1878472d3d3f480ae1e50d98f6c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-39478","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-39478.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-38608","title":"net/mlx5e: Fix netif state handling","status":"backported","project":false,"upstream":[{"sha":"3d5918477f94e4c2f064567875c475468e264644","url":"https://git.kernel.org/stable/c/3d5918477f94e4c2f064567875c475468e264644"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3d5918477f94e4c2f064567875c475468e264644","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-38608","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-38608.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-38595","title":"net/mlx5: Fix peer devlink set for SF representor devlink port","status":"backported","project":false,"upstream":[{"sha":"3c453e8cc672de1f9c662948dba43176bc68d7f0","url":"https://git.kernel.org/stable/c/3c453e8cc672de1f9c662948dba43176bc68d7f0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3c453e8cc672de1f9c662948dba43176bc68d7f0","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/3c453e8cc672de1f9c662948dba43176bc68d7f0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-38595","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-38595.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36951","title":"drm/amdkfd: range check cp bad op exception interrupts","status":"backported","project":false,"upstream":[{"sha":"0cac183b98d8a8c692c98e8dba37df15a9e9210d","url":"https://git.kernel.org/stable/c/0cac183b98d8a8c692c98e8dba37df15a9e9210d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0cac183b98d8a8c692c98e8dba37df15a9e9210d","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/0cac183b98d8a8c692c98e8dba37df15a9e9210d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36951","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36951.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36949","title":"amd/amdkfd: sync all devices to wait all processes being evicted","status":"backported","project":false,"upstream":[{"sha":"d06af584be5a769d124b7302b32a033e9559761d","url":"https://git.kernel.org/stable/c/d06af584be5a769d124b7302b32a033e9559761d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d06af584be5a769d124b7302b32a033e9559761d","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/d06af584be5a769d124b7302b32a033e9559761d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36024","title":"drm/amd/display: Disable idle reallow as part of command/gpint execution","status":"backported","project":false,"upstream":[{"sha":"6226a5aa77370329e01ee8abe50a95e60618ce97","url":"https://git.kernel.org/stable/c/6226a5aa77370329e01ee8abe50a95e60618ce97"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6226a5aa77370329e01ee8abe50a95e60618ce97","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/6226a5aa77370329e01ee8abe50a95e60618ce97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36024","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36024.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35961","title":"net/mlx5: Register devlink first under devlink lock","status":"backported","project":false,"upstream":[{"sha":"c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8","url":"https://git.kernel.org/stable/c/c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8","lines":106,"reason":"","source":"https://github.com/torvalds/linux/commit/c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35942","title":"pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain","status":"backported","project":false,"upstream":[{"sha":"697624ee8ad557ab5417f985d2c804241a7ad30d","url":"https://git.kernel.org/stable/c/697624ee8ad557ab5417f985d2c804241a7ad30d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"697624ee8ad557ab5417f985d2c804241a7ad30d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35942","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35942.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35931","title":"drm/amdgpu: Skip do PCI error slot reset during RAS recovery","status":"backported","project":false,"upstream":[{"sha":"601429cca96b4af3be44172c3b64e4228515dbe1","url":"https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"601429cca96b4af3be44172c3b64e4228515dbe1","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/601429cca96b4af3be44172c3b64e4228515dbe1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35931","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35931.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35887","title":"ax25: fix use-after-free bugs caused by ax25_ds_del_timer","status":"backported","project":false,"upstream":[{"sha":"fd819ad3ecf6f3c232a06b27423ce9ed8c20da89","url":"https://git.kernel.org/stable/c/fd819ad3ecf6f3c232a06b27423ce9ed8c20da89"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"fd819ad3ecf6f3c232a06b27423ce9ed8c20da89","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35887","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35887.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35843","title":"iommu/vt-d: Use device rbtree in iopf reporting path","status":"backported","project":false,"upstream":[{"sha":"def054b01a867822254e1dda13d587f5c7a99e2a","url":"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"def054b01a867822254e1dda13d587f5c7a99e2a","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/def054b01a867822254e1dda13d587f5c7a99e2a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35843","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35843.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35808","title":"md/dm-raid: don't call md_reap_sync_thread() directly","status":"backported","project":false,"upstream":[{"sha":"cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","url":"https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35799","title":"drm/amd/display: Prevent crash when disable stream","status":"backported","project":false,"upstream":[{"sha":"72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c","url":"https://git.kernel.org/stable/c/72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35794","title":"dm-raid: really frozen sync_thread during suspend","status":"backported","project":false,"upstream":[{"sha":"16c4770c75b1223998adbeb7286f9a15c65fba73","url":"https://git.kernel.org/stable/c/16c4770c75b1223998adbeb7286f9a15c65fba73"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"16c4770c75b1223998adbeb7286f9a15c65fba73","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/16c4770c75b1223998adbeb7286f9a15c65fba73.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35794","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35794.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27079","title":"iommu/vt-d: Fix NULL domain on device release","status":"backported","project":false,"upstream":[{"sha":"81e921fd321614c2ad8ac333b041aae1da7a1c6d","url":"https://git.kernel.org/stable/c/81e921fd321614c2ad8ac333b041aae1da7a1c6d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"81e921fd321614c2ad8ac333b041aae1da7a1c6d","lines":121,"reason":"","source":"https://github.com/torvalds/linux/commit/81e921fd321614c2ad8ac333b041aae1da7a1c6d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27012","title":"netfilter: nf_tables: restore set elements when delete set fails","status":"backported","project":false,"upstream":[{"sha":"e79b47a8615d42c68aaeb68971593333667382ed","url":"https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"e79b47a8615d42c68aaeb68971593333667382ed","lines":201,"reason":"","source":"https://github.com/torvalds/linux/commit/e79b47a8615d42c68aaeb68971593333667382ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27012","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27012.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27010","title":"net/sched: Fix mirred deadlock on device recursion","status":"backported","project":false,"upstream":[{"sha":"0f022d32c3eca477fbf79a205243a6123ed0fe11","url":"https://git.kernel.org/stable/c/0f022d32c3eca477fbf79a205243a6123ed0fe11"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0f022d32c3eca477fbf79a205243a6123ed0fe11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26962","title":"dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape","status":"backported","project":false,"upstream":[{"sha":"41425f96d7aa59bc865f60f5dda3d7697b555677","url":"https://git.kernel.org/stable/c/41425f96d7aa59bc865f60f5dda3d7697b555677"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"41425f96d7aa59bc865f60f5dda3d7697b555677","lines":217,"reason":"","source":"https://github.com/torvalds/linux/commit/41425f96d7aa59bc865f60f5dda3d7697b555677.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26962","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26962.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26948","title":"drm/amd/display: Add a dc_state NULL check in dc_state_release","status":"backported","project":false,"upstream":[{"sha":"334b56cea5d9df5989be6cf1a5898114fa70ad98","url":"https://git.kernel.org/stable/c/334b56cea5d9df5989be6cf1a5898114fa70ad98"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"334b56cea5d9df5989be6cf1a5898114fa70ad98","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26948","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26948.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26944","title":"btrfs: zoned: fix use-after-free in do_zone_finish()","status":"backported","project":false,"upstream":[{"sha":"1ec17ef59168a1a6f1105f5dc517f783839a5302","url":"https://git.kernel.org/stable/c/1ec17ef59168a1a6f1105f5dc517f783839a5302"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1ec17ef59168a1a6f1105f5dc517f783839a5302","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/1ec17ef59168a1a6f1105f5dc517f783839a5302.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26914","title":"drm/amd/display: fix incorrect mpc_combine array size","status":"backported","project":false,"upstream":[{"sha":"39079fe8e660851abbafa90cd55cbf029210661f","url":"https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"39079fe8e660851abbafa90cd55cbf029210661f","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/39079fe8e660851abbafa90cd55cbf029210661f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26913","title":"drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue","status":"backported","project":false,"upstream":[{"sha":"faf51b201bc42adf500945732abb6220c707d6f3","url":"https://git.kernel.org/stable/c/faf51b201bc42adf500945732abb6220c707d6f3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"faf51b201bc42adf500945732abb6220c707d6f3","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/faf51b201bc42adf500945732abb6220c707d6f3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26913","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26913.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26836","title":"platform/x86: think-lmi: Fix password opcode ordering for workstations","status":"backported","project":false,"upstream":[{"sha":"6f7d0f5fd8e440c3446560100ac4ff9a55eec340","url":"https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f7d0f5fd8e440c3446560100ac4ff9a55eec340","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/6f7d0f5fd8e440c3446560100ac4ff9a55eec340.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26836","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26836.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26768","title":"LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]","status":"backported","project":false,"upstream":[{"sha":"4551b30525cf3d2f026b92401ffe241eb04dfebe","url":"https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4551b30525cf3d2f026b92401ffe241eb04dfebe","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/4551b30525cf3d2f026b92401ffe241eb04dfebe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26758","title":"md: Don't ignore suspended array in md_check_recovery()","status":"backported","project":false,"upstream":[{"sha":"1baae052cccd08daf9a9d64c3f959d8cdb689757","url":"https://git.kernel.org/stable/c/1baae052cccd08daf9a9d64c3f959d8cdb689757"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1baae052cccd08daf9a9d64c3f959d8cdb689757","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/1baae052cccd08daf9a9d64c3f959d8cdb689757.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26758","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26758.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26757","title":"md: Don't ignore read-only array in md_check_recovery()","status":"backported","project":false,"upstream":[{"sha":"55a48ad2db64737f7ffc0407634218cc6e4c513b","url":"https://git.kernel.org/stable/c/55a48ad2db64737f7ffc0407634218cc6e4c513b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"55a48ad2db64737f7ffc0407634218cc6e4c513b","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/55a48ad2db64737f7ffc0407634218cc6e4c513b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26757","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26757.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26756","title":"md: Don't register sync_thread for reshape directly","status":"backported","project":false,"upstream":[{"sha":"ad39c08186f8a0f221337985036ba86731d6aafe","url":"https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad39c08186f8a0f221337985036ba86731d6aafe","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/ad39c08186f8a0f221337985036ba86731d6aafe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26756","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26756.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26691","title":"KVM: arm64: Fix circular locking dependency","status":"backported","project":false,"upstream":[{"sha":"10c02aad111df02088d1a81792a709f6a7eca6cc","url":"https://git.kernel.org/stable/c/10c02aad111df02088d1a81792a709f6a7eca6cc"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"10c02aad111df02088d1a81792a709f6a7eca6cc","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/10c02aad111df02088d1a81792a709f6a7eca6cc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26691","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26691.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26672","title":"drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'","status":"backported","project":false,"upstream":[{"sha":"4f32504a2f85a7b40fe149436881381f48e9c0c0","url":"https://git.kernel.org/stable/c/4f32504a2f85a7b40fe149436881381f48e9c0c0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4f32504a2f85a7b40fe149436881381f48e9c0c0","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/4f32504a2f85a7b40fe149436881381f48e9c0c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26672","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26672.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26662","title":"drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'","status":"backported","project":false,"upstream":[{"sha":"e96fddb32931d007db12b1fce9b5e8e4c080401b","url":"https://git.kernel.org/stable/c/e96fddb32931d007db12b1fce9b5e8e4c080401b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e96fddb32931d007db12b1fce9b5e8e4c080401b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26662","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26662.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26661","title":"drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'","status":"backported","project":false,"upstream":[{"sha":"66951d98d9bf45ba25acf37fe0747253fafdf298","url":"https://git.kernel.org/stable/c/66951d98d9bf45ba25acf37fe0747253fafdf298"},{"sha":"17ba9cde11c2bfebbd70867b0a2ac4a22e573379","url":"https://git.kernel.org/stable/c/17ba9cde11c2bfebbd70867b0a2ac4a22e573379"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"66951d98d9bf45ba25acf37fe0747253fafdf298","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/66951d98d9bf45ba25acf37fe0747253fafdf298.patch"},{"sha":"17ba9cde11c2bfebbd70867b0a2ac4a22e573379","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/17ba9cde11c2bfebbd70867b0a2ac4a22e573379.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54280","title":"cifs: fix potential race when tree connecting ipc","status":"backported","project":false,"upstream":[{"sha":"ee20d7c6100752eaf2409d783f4f1449c29ea33d","url":"https://git.kernel.org/stable/c/ee20d7c6100752eaf2409d783f4f1449c29ea33d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ee20d7c6100752eaf2409d783f4f1449c29ea33d","lines":81,"reason":"","source":"https://github.com/torvalds/linux/commit/ee20d7c6100752eaf2409d783f4f1449c29ea33d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54280","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54280.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54263","title":"drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP","status":"backported","project":false,"upstream":[{"sha":"ea293f823a8805735d9e00124df81a8f448ed1ae","url":"https://git.kernel.org/stable/c/ea293f823a8805735d9e00124df81a8f448ed1ae"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ea293f823a8805735d9e00124df81a8f448ed1ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54263","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54263.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54233","title":"ASoC: SOF: avoid a NULL dereference with unsupported widgets","status":"backported","project":false,"upstream":[{"sha":"e3720f92e0237921da537e47a0b24e27899203f8","url":"https://git.kernel.org/stable/c/e3720f92e0237921da537e47a0b24e27899203f8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e3720f92e0237921da537e47a0b24e27899203f8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54233","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54233.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54227","title":"blk-mq: fix tags leak when shrink nr_hw_queues","status":"backported","project":false,"upstream":[{"sha":"e1dd7bc93029024af5688253b0c05181d6e01f8e","url":"https://git.kernel.org/stable/c/e1dd7bc93029024af5688253b0c05181d6e01f8e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e1dd7bc93029024af5688253b0c05181d6e01f8e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54227","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54227.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54141","title":"wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018","status":"backported","project":false,"upstream":[{"sha":"ce282d8de71f07f0056ea319541141152c65f552","url":"https://git.kernel.org/stable/c/ce282d8de71f07f0056ea319541141152c65f552"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ce282d8de71f07f0056ea319541141152c65f552","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54141","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54141.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54030","title":"io_uring/net: don't overflow multishot recv","status":"backported","project":false,"upstream":[{"sha":"b2e74db55dd93d6db22a813c9a775b5dbf87c560","url":"https://git.kernel.org/stable/c/b2e74db55dd93d6db22a813c9a775b5dbf87c560"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b2e74db55dd93d6db22a813c9a775b5dbf87c560","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b2e74db55dd93d6db22a813c9a775b5dbf87c560.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54030","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54030.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53999","title":"net/mlx5e: TC, Fix internal port memory leak","status":"backported","project":false,"upstream":[{"sha":"ac5da544a3c2047cbfd715acd9cec8380d7fe5c6","url":"https://git.kernel.org/stable/c/ac5da544a3c2047cbfd715acd9cec8380d7fe5c6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ac5da544a3c2047cbfd715acd9cec8380d7fe5c6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53857","title":"bpf: bpf_sk_storage: Fix invalid wait context lockdep report","status":"backported","project":false,"upstream":[{"sha":"a96a44aba556c42b432929d37d60158aca21ad4c","url":"https://git.kernel.org/stable/c/a96a44aba556c42b432929d37d60158aca21ad4c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a96a44aba556c42b432929d37d60158aca21ad4c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53857","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53857.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53851","title":"drm/msm/dp: Drop aux devices together with DP controller","status":"backported","project":false,"upstream":[{"sha":"a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d","url":"https://git.kernel.org/stable/c/a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53851","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53851.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53762","title":"Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync","status":"backported","project":false,"upstream":[{"sha":"94d9ba9f9888b748d4abd2aa1547af56ae85f772","url":"https://git.kernel.org/stable/c/94d9ba9f9888b748d4abd2aa1547af56ae85f772"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"94d9ba9f9888b748d4abd2aa1547af56ae85f772","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53627","title":"scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list","status":"backported","project":false,"upstream":[{"sha":"71fb36b5ff113a7674710b9d6063241eada84ff7","url":"https://git.kernel.org/stable/c/71fb36b5ff113a7674710b9d6063241eada84ff7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"71fb36b5ff113a7674710b9d6063241eada84ff7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53627","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53627.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53574","title":"wifi: rtw88: delete timer and free skb queue when unloading","status":"backported","project":false,"upstream":[{"sha":"634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216","url":"https://git.kernel.org/stable/c/634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53574","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53574.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53538","title":"btrfs: insert tree mod log move in push_node_left","status":"backported","project":false,"upstream":[{"sha":"5cead5422a0e3d13b0bcee986c0f5c4ebb94100b","url":"https://git.kernel.org/stable/c/5cead5422a0e3d13b0bcee986c0f5c4ebb94100b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5cead5422a0e3d13b0bcee986c0f5c4ebb94100b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53529","title":"wifi: rtw88: Fix memory leak in rtw88_usb","status":"backported","project":false,"upstream":[{"sha":"59a3a312009723e3e5082899655fdcc420e2b47a","url":"https://git.kernel.org/stable/c/59a3a312009723e3e5082899655fdcc420e2b47a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"59a3a312009723e3e5082899655fdcc420e2b47a","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/59a3a312009723e3e5082899655fdcc420e2b47a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53529","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53529.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53460","title":"wifi: rtw88: fix memory leak in rtw_usb_probe()","status":"backported","project":false,"upstream":[{"sha":"48181d285623198c33bb9698992502687b258efa","url":"https://git.kernel.org/stable/c/48181d285623198c33bb9698992502687b258efa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"48181d285623198c33bb9698992502687b258efa","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/48181d285623198c33bb9698992502687b258efa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53460","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53460.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53429","title":"btrfs: don't check PageError in __extent_writepage","status":"backported","project":false,"upstream":[{"sha":"3e92499e3b004baffb479d61e191b41b604ece9a","url":"https://git.kernel.org/stable/c/3e92499e3b004baffb479d61e191b41b604ece9a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3e92499e3b004baffb479d61e191b41b604ece9a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53429","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53429.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53367","title":"accel/habanalabs: fix mem leak in capture user mappings","status":"backported","project":false,"upstream":[{"sha":"314a7ffd7c196b27eedd50cb7553029e17789b55","url":"https://git.kernel.org/stable/c/314a7ffd7c196b27eedd50cb7553029e17789b55"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"314a7ffd7c196b27eedd50cb7553029e17789b55","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/314a7ffd7c196b27eedd50cb7553029e17789b55.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53367","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53367.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53353","title":"accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()","status":"backported","project":false,"upstream":[{"sha":"2e8e9a895c4589f124a37fc84d123b5114406e94","url":"https://git.kernel.org/stable/c/2e8e9a895c4589f124a37fc84d123b5114406e94"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2e8e9a895c4589f124a37fc84d123b5114406e94","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53353","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53353.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53336","title":"media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings","status":"backported","project":false,"upstream":[{"sha":"284be5693163343e1cf17c03917eecd1d6681bcf","url":"https://git.kernel.org/stable/c/284be5693163343e1cf17c03917eecd1d6681bcf"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"284be5693163343e1cf17c03917eecd1d6681bcf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53336","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53336.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53231","title":"erofs: Fix detection of atomic context","status":"backported","project":false,"upstream":[{"sha":"12d0a24afd9ea58e581ea64d64e066f2027b28d9","url":"https://git.kernel.org/stable/c/12d0a24afd9ea58e581ea64d64e066f2027b28d9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"12d0a24afd9ea58e581ea64d64e066f2027b28d9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53231","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53231.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53218","title":"rxrpc: Make it so that a waiting process can be aborted","status":"backported","project":false,"upstream":[{"sha":"0eb362d254814ce04848730bf32e75b8ee1a4d6c","url":"https://git.kernel.org/stable/c/0eb362d254814ce04848730bf32e75b8ee1a4d6c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0eb362d254814ce04848730bf32e75b8ee1a4d6c","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/0eb362d254814ce04848730bf32e75b8ee1a4d6c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53218","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53218.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52920","title":"bpf: support non-r10 register spill/fill to/from stack in precision tracking","status":"backported","project":false,"upstream":[{"sha":"41f6f64e6999a837048b1bd13a2f8742964eca6b","url":"https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"41f6f64e6999a837048b1bd13a2f8742964eca6b","lines":496,"reason":"","source":"https://github.com/torvalds/linux/commit/41f6f64e6999a837048b1bd13a2f8742964eca6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52888","title":"media: mediatek: vcodec: Only free buffer VA that is not NULL","status":"backported","project":false,"upstream":[{"sha":"eb005c801ec70ff4307727bd3bd6e8280169ef32","url":"https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"eb005c801ec70ff4307727bd3bd6e8280169ef32","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52888","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52888.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52797","title":"drivers: perf: Check find_first_bit() return value","status":"backported","project":false,"upstream":[{"sha":"c6e316ac05532febb0c966fa9b55f5258ed037be","url":"https://git.kernel.org/stable/c/c6e316ac05532febb0c966fa9b55f5258ed037be"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6e316ac05532febb0c966fa9b55f5258ed037be","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/c6e316ac05532febb0c966fa9b55f5258ed037be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52676","title":"bpf: Guard stack limits against 32bit overflow","status":"backported","project":false,"upstream":[{"sha":"1d38a9ee81570c4bd61f557832dead4d6f816760","url":"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1d38a9ee81570c4bd61f557832dead4d6f816760","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52676","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52676.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52671","title":"drm/amd/display: Fix hang/underflow when transitioning to ODM4:1","status":"backported","project":false,"upstream":[{"sha":"e7b2b108cdeab76a7e7324459e50b0c1214c0386","url":"https://git.kernel.org/stable/c/e7b2b108cdeab76a7e7324459e50b0c1214c0386"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e7b2b108cdeab76a7e7324459e50b0c1214c0386","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52671","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52671.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52648","title":"drm/vmwgfx: Unmap the surface before resetting it on a plane state","status":"backported","project":false,"upstream":[{"sha":"27571c64f1855881753e6f33c3186573afbab7ba","url":"https://git.kernel.org/stable/c/27571c64f1855881753e6f33c3186573afbab7ba"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"27571c64f1855881753e6f33c3186573afbab7ba","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/27571c64f1855881753e6f33c3186573afbab7ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52648","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52648.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52629","title":"sh: push-switch: Reorder cleanup operations to avoid use-after-free bug","status":"backported","project":false,"upstream":[{"sha":"246f80a0b17f8f582b2c0996db02998239057c65","url":"https://git.kernel.org/stable/c/246f80a0b17f8f582b2c0996db02998239057c65"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"246f80a0b17f8f582b2c0996db02998239057c65","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52629","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52629.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52625","title":"drm/amd/display: Refactor DMCUB enter/exit idle interface","status":"backported","project":false,"upstream":[{"sha":"8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa","url":"https://git.kernel.org/stable/c/8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa","lines":118,"reason":"","source":"https://github.com/torvalds/linux/commit/8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52625","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52625.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52624","title":"drm/amd/display: Wake DMCUB before executing GPINT commands","status":"backported","project":false,"upstream":[{"sha":"e5ffd1263dd5b44929c676171802e7b6af483f21","url":"https://git.kernel.org/stable/c/e5ffd1263dd5b44929c676171802e7b6af483f21"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"e5ffd1263dd5b44929c676171802e7b6af483f21","lines":213,"reason":"","source":"https://github.com/torvalds/linux/commit/e5ffd1263dd5b44929c676171802e7b6af483f21.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52624","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52624.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52590","title":"ocfs2: Avoid touching renamed directory if parent does not change","status":"backported","project":false,"upstream":[{"sha":"9d618d19b29c2943527e3a43da0a35aea91062fc","url":"https://git.kernel.org/stable/c/9d618d19b29c2943527e3a43da0a35aea91062fc"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9d618d19b29c2943527e3a43da0a35aea91062fc","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52590","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52590.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2021-47645","title":"media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com","status":"not-applicable","project":false,"upstream":[{"sha":"e3b86f4e558cea9eed71d894df2f19b10d60a207","url":"https://git.kernel.org/stable/c/e3b86f4e558cea9eed71d894df2f19b10d60a207"},{"sha":"8dce4b265a5357731058f69645840dabc718c687","url":"https://git.kernel.org/stable/c/8dce4b265a5357731058f69645840dabc718c687"}],"evidence":[],"submission_lore":[],"basis":"The relocated Zoran driver already uses the corrected even buffer index and checks for a NULL buffer in zoran_reap_stat_com. Both effective fix changes are present. The separate 2019 driver-removal commit is not required for this restored driver implementation.","review":{"id":"CVE-2021-47645","series":"6.18.y","upstream":["e3b86f4e558cea9eed71d894df2f19b10d60a207","8dce4b265a5357731058f69645840dabc718c687"],"checked_sha":"1b357ecb321392158d507b04672ffee57bfa071d","checked_version":"6.18.54","kind":"already-fixed","applicability":"fixed","reason":"The relocated Zoran driver already uses the corrected even buffer index and checks for a NULL buffer in zoran_reap_stat_com. Both effective fix changes are present. The separate 2019 driver-removal commit is not required for this restored driver implementation.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/media/pci/zoran/zoran_device.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/media/pci/zoran/zoran_device.c?id=1b357ecb321392158d507b04672ffee57bfa071d#n794"},{"label":"Upstream fix 8dce4b265a53","url":"https://git.kernel.org/stable/c/8dce4b265a5357731058f69645840dabc718c687"},{"label":"Upstream fix e3b86f4e558c","url":"https://git.kernel.org/stable/c/e3b86f4e558cea9eed71d894df2f19b10d60a207"}]},"size":{"status":"over-limit","patches":[{"sha":"e3b86f4e558cea9eed71d894df2f19b10d60a207","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/e3b86f4e558cea9eed71d894df2f19b10d60a207.patch"},{"sha":"8dce4b265a5357731058f69645840dabc718c687","lines":11302,"reason":"","source":"https://github.com/torvalds/linux/commit/8dce4b265a5357731058f69645840dabc718c687.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2021-47645","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2021/CVE-2021-47645.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"}],"counts":{"backported":32,"queued":0,"unfixed":127,"unknown":4,"not-applicable":7},"triage_counts":{"over-limit":40,"within-limit":87,"size-unknown":0,"already-fixed":1,"applicable":12,"ineffective-fix":0,"needs-review":0,"no-op":0,"not-applicable":2}},{"series":"7.2.y","ref":"FETCH_HEAD","sha":"3c172eede0d6b889ead876f45cc843070209208f","committed_at":"2026-10-26T16:01:14+01:00","version":"7.2.13","records":[{"id":"CVE-2026-100073","title":"ext4: fix transaction overflow during writeback","status":"backported","project":false,"upstream":[{"sha":"46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","url":"https://git.kernel.org/stable/c/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a22464c5df5827e884a5a7d3d8fb03870e5bb6c8","label":"a22464c5df58","date":"2026-09-14T13:40:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"46e8e31771f4f1c5e1cdec37a889a6730e42e9f1","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-100073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-100073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-100072","title":"ACPI: platform: Use acpi_bus_get_primary_device()","status":"backported","project":false,"upstream":[{"sha":"a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","url":"https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71","label":"c9d202d3b6c2","date":"2026-09-14T13:40:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-100072","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-100072.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99215","title":"power: supply: core: prevent unregistering a power supply while a callback runs","status":"backported","project":false,"upstream":[{"sha":"5b4bd13e0552926648a46c2c9a12a24dfaee3715","url":"https://git.kernel.org/stable/c/5b4bd13e0552926648a46c2c9a12a24dfaee3715"}],"evidence":[{"url":"https://git.kernel.org/stable/c/45388e50d14bc161873b14b9a05d4b8b8822fca6","label":"45388e50d14b","date":"2026-10-26T16:00:59+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5b4bd13e0552926648a46c2c9a12a24dfaee3715","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/5b4bd13e0552926648a46c2c9a12a24dfaee3715.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99215","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99215.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99211","title":"netlink: reset skb headers before unicast and multicast filtering","status":"backported","project":false,"upstream":[{"sha":"8bf659bd54e1f00e34cf5244b1d289c506fa47c0","url":"https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/06935da5de83aa8b98841563894857e7d2f80e47","label":"06935da5de83","date":"2026-10-26T16:01:00+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8bf659bd54e1f00e34cf5244b1d289c506fa47c0","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/8bf659bd54e1f00e34cf5244b1d289c506fa47c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99209","title":"drm/xe: skip eviction of a BO with no resource","status":"backported","project":false,"upstream":[{"sha":"448e76cbdc6652ccd3ba337b7a6e1f028859f2ed","url":"https://git.kernel.org/stable/c/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b6499d19ade1f1e4a1e6b739abc8c815297c98b8","label":"b6499d19ade1","date":"2026-10-26T16:01:01+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"448e76cbdc6652ccd3ba337b7a6e1f028859f2ed","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99209","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99209.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99208","title":"drm/xe/oa: Zero OA buffer at allocation","status":"backported","project":false,"upstream":[{"sha":"fd8662823caa114a63f07222d2aa448f6ac5e864","url":"https://git.kernel.org/stable/c/fd8662823caa114a63f07222d2aa448f6ac5e864"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cd3e2918c247db631d88cdd704596d9d27e5513e","label":"cd3e2918c247","date":"2026-10-26T16:01:01+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd8662823caa114a63f07222d2aa448f6ac5e864","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/fd8662823caa114a63f07222d2aa448f6ac5e864.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99208","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99208.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99191","title":"calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()","status":"backported","project":false,"upstream":[{"sha":"8070ed578b6b9134e045627fb745c887a806d46e","url":"https://git.kernel.org/stable/c/8070ed578b6b9134e045627fb745c887a806d46e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8ee0e03663826a76507048d58466b29321a57656","label":"8ee0e0366382","date":"2026-10-26T16:01:03+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8070ed578b6b9134e045627fb745c887a806d46e","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/8070ed578b6b9134e045627fb745c887a806d46e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99191","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99191.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99189","title":"gpio: mxc: fix race between chained IRQ handler install and probe completion","status":"backported","project":false,"upstream":[{"sha":"38d44f78f041ffe60c8e2443b99434a199e7541d","url":"https://git.kernel.org/stable/c/38d44f78f041ffe60c8e2443b99434a199e7541d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6c1e035d881579a6e4ed1ce5feabb13d23e80a82","label":"6c1e035d8815","date":"2026-10-26T16:01:03+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"38d44f78f041ffe60c8e2443b99434a199e7541d","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/38d44f78f041ffe60c8e2443b99434a199e7541d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99189","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99189.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99183","title":"accel/rocket: search every core slot when looking up a scheduler","status":"backported","project":false,"upstream":[{"sha":"89c2c777df17eb0201c8e22afabbf3691f2a28fe","url":"https://git.kernel.org/stable/c/89c2c777df17eb0201c8e22afabbf3691f2a28fe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c137756469d5bcc79e97beb406ae4d14b9585463","label":"c137756469d5","date":"2026-10-26T16:01:04+01:00","lore":["https://lore.kernel.org/dri-devel/apwUewaRnoTNXHCt@rock-5b-plus/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"89c2c777df17eb0201c8e22afabbf3691f2a28fe","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/89c2c777df17eb0201c8e22afabbf3691f2a28fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99183","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99183.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99178","title":"x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context","status":"backported","project":false,"upstream":[{"sha":"81d99abe2bd81379abfb595e403bbbee6fbfc624","url":"https://git.kernel.org/stable/c/81d99abe2bd81379abfb595e403bbbee6fbfc624"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f45ee1ff6358a22d7e22a4c53cb3148ea97b10d9","label":"f45ee1ff6358","date":"2026-10-26T16:01:05+01:00","lore":["https://lore.kernel.org/all/20211126123145.2772-1-jiangshanlai@gmail.com/","https://lore.kernel.org/all/ed71d0967113a35f670a9625a058b8e6e0b2f104.1583547991.git.luto@kernel.org/"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"81d99abe2bd81379abfb595e403bbbee6fbfc624","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/81d99abe2bd81379abfb595e403bbbee6fbfc624.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99178","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99178.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99172","title":"ipc: drop the mqueue mount with kern_unmount() on setup failure","status":"backported","project":false,"upstream":[{"sha":"f0e48172a59e517e613b73f73cc35f24fd123aeb","url":"https://git.kernel.org/stable/c/f0e48172a59e517e613b73f73cc35f24fd123aeb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c0620b648321fff654173d238d4a85298ea16d05","label":"c0620b648321","date":"2026-10-26T16:01:05+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0e48172a59e517e613b73f73cc35f24fd123aeb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f0e48172a59e517e613b73f73cc35f24fd123aeb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99172","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99172.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99146","title":"drm/i915/dmc: Add sanity check for DMC load address","status":"backported","project":false,"upstream":[{"sha":"7dedc5bb11f95e96fe80757c924d8d9aa7327759","url":"https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2","label":"2fbd099b4e7c","date":"2026-10-26T16:01:09+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7dedc5bb11f95e96fe80757c924d8d9aa7327759","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/7dedc5bb11f95e96fe80757c924d8d9aa7327759.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99146","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99146.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99125","title":"s390/pai: Handle multiple PMU stop callback invocations","status":"backported","project":false,"upstream":[{"sha":"f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40","url":"https://git.kernel.org/stable/c/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cf348ec613f75b9774291e47b804fd7010835a6c","label":"cf348ec613f7","date":"2026-10-26T16:01:12+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99122","title":"vsock/vmci: validate packet source for connected sockets","status":"backported","project":false,"upstream":[{"sha":"ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7","url":"https://git.kernel.org/stable/c/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/90c423b62ec9be08177f74b07a47937ca8d2035b","label":"90c423b62ec9","date":"2026-10-26T16:01:12+01:00","lore":["https://lore.kernel.org/netdev/20260814121255.6B5001F000E9@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99122","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99122.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99109","title":"smb: client: reject SetEA requests that do not fit the request buffer","status":"backported","project":false,"upstream":[{"sha":"4aa2c106aef4bf3dfd97c30842db0767b26e8428","url":"https://git.kernel.org/stable/c/4aa2c106aef4bf3dfd97c30842db0767b26e8428"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9efbd764ab80fa86d2258550877a74d78a25e855","label":"9efbd764ab80","date":"2026-10-26T16:01:13+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4aa2c106aef4bf3dfd97c30842db0767b26e8428","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/4aa2c106aef4bf3dfd97c30842db0767b26e8428.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99109","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99109.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99101","title":"ntfs: move attribute payload before shrinking its record","status":"backported","project":false,"upstream":[{"sha":"0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","url":"https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7dc2c524608039d1b082a0087f7aa0751edd4ffb","label":"7dc2c5246080","date":"2026-10-26T16:01:14+01:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99090","title":"drm/amdgpu: serialize vblank counter reads against GPU reset","status":"backported","project":false,"upstream":[{"sha":"1a6023edfbb5673f55fab6348f135fb3b1428ea5","url":"https://git.kernel.org/stable/c/1a6023edfbb5673f55fab6348f135fb3b1428ea5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f4a0a1ce147d1a6e428d7cb5e3b99fd695139fc7","label":"f4a0a1ce147d","date":"2026-10-15T11:59:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a6023edfbb5673f55fab6348f135fb3b1428ea5","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/1a6023edfbb5673f55fab6348f135fb3b1428ea5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99090","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99090.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99087","title":"dm-integrity: fix NULL pointer dereference when the 'R' flag is used","status":"backported","project":false,"upstream":[{"sha":"7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84","url":"https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"}],"evidence":[{"url":"https://git.kernel.org/stable/c/69ed43ed8a174465fca1ba6bfbde53e4618c8956","label":"69ed43ed8a17","date":"2026-10-21T10:33:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99087","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99087.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99086","title":"dm-integrity: validate the superblock on resume","status":"backported","project":false,"upstream":[{"sha":"fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2","url":"https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e","label":"e9ec5cbbaf4d","date":"2026-10-21T10:33:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2","lines":80,"reason":"","source":"https://github.com/torvalds/linux/commit/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99086","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99086.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99076","title":"ipv6: udp: Create exceptions before socket matching","status":"backported","project":false,"upstream":[{"sha":"ac76cab50e899a7346408b8d3c3a4192c2eefb9f","url":"https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8c9b310c958be33ba8fb9d0e6b77811d013e10c0","label":"8c9b310c958b","date":"2026-10-15T11:59:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac76cab50e899a7346408b8d3c3a4192c2eefb9f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/ac76cab50e899a7346408b8d3c3a4192c2eefb9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99076","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99076.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99026","title":"net: team: free skb when broadcast has no txable port","status":"backported","project":false,"upstream":[{"sha":"489114c9ecae44e523361a4b3e610ee5ebd9189c","url":"https://git.kernel.org/stable/c/489114c9ecae44e523361a4b3e610ee5ebd9189c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f34b1bcac4581a5bd3daf9eff90f175e736b54aa","label":"f34b1bcac458","date":"2026-10-15T11:59:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"489114c9ecae44e523361a4b3e610ee5ebd9189c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/489114c9ecae44e523361a4b3e610ee5ebd9189c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-99021","title":"regulator: of: fill in supply names in of_regulator_bulk_get_all()","status":"backported","project":false,"upstream":[{"sha":"e2151c29cec73f6cc70abf1c7cbc7b9b202489f5","url":"https://git.kernel.org/stable/c/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a3384ec2516a7cc567bd7c09029282494469b247","label":"a3384ec2516a","date":"2026-10-15T11:59:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e2151c29cec73f6cc70abf1c7cbc7b9b202489f5","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-99021","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-99021.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98999","title":"drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin","status":"backported","project":false,"upstream":[{"sha":"cf238c067eaae1cbfb00738e29219b9568d2313e","url":"https://git.kernel.org/stable/c/cf238c067eaae1cbfb00738e29219b9568d2313e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b3eaff982839e5c22912d604cd8e7748cece8d63","label":"b3eaff982839","date":"2026-10-15T11:59:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf238c067eaae1cbfb00738e29219b9568d2313e","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/cf238c067eaae1cbfb00738e29219b9568d2313e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98996","title":"fs: don't silently unmount busy mounts","status":"backported","project":false,"upstream":[{"sha":"6857e209015f95be7a8f19a9cd5dac345b9b9859","url":"https://git.kernel.org/stable/c/6857e209015f95be7a8f19a9cd5dac345b9b9859"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a210ac218c307513d43e98a08f23c2dfbeeebc2f","label":"a210ac218c30","date":"2026-10-15T11:59:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"6857e209015f95be7a8f19a9cd5dac345b9b9859","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/6857e209015f95be7a8f19a9cd5dac345b9b9859.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98996","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98996.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98989","title":"namespace: check a recursive bind mount for mount namespace loops","status":"backported","project":false,"upstream":[{"sha":"c640a01a78e42302879006ed7b7d5a9a943ba815","url":"https://git.kernel.org/stable/c/c640a01a78e42302879006ed7b7d5a9a943ba815"}],"evidence":[{"url":"https://git.kernel.org/stable/c/37a82f400efa4d263542a5fa41755b21057f1e5d","label":"37a82f400efa","date":"2026-10-15T11:59:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c640a01a78e42302879006ed7b7d5a9a943ba815","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c640a01a78e42302879006ed7b7d5a9a943ba815.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98983","title":"unshare: don't drop active namespace references that were never taken","status":"backported","project":false,"upstream":[{"sha":"0b6f31a3c0b16066f812e94b52a704174a6f23cd","url":"https://git.kernel.org/stable/c/0b6f31a3c0b16066f812e94b52a704174a6f23cd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/56fe03a0c05dba4c5f6a23c391f96de1614a098c","label":"56fe03a0c05d","date":"2026-10-15T11:59:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0b6f31a3c0b16066f812e94b52a704174a6f23cd","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/0b6f31a3c0b16066f812e94b52a704174a6f23cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98983","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98983.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98980","title":"namei: don't reveal overmounted entries in refwalk","status":"backported","project":false,"upstream":[{"sha":"8189ab688f5a2c745dc90b63374da02f213d6994","url":"https://git.kernel.org/stable/c/8189ab688f5a2c745dc90b63374da02f213d6994"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b43ff2deef48260bfbdc0dcb520f7929bd3e4007","label":"b43ff2deef48","date":"2026-10-15T11:59:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8189ab688f5a2c745dc90b63374da02f213d6994","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/8189ab688f5a2c745dc90b63374da02f213d6994.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98980","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98980.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98978","title":"namespace: never expire a locked mount","status":"backported","project":false,"upstream":[{"sha":"f78ddcc872248c7aa1d7e904928441a0be4c6d5d","url":"https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d23265a12e4991ce7aedce670c0b6b598cadb644","label":"d23265a12e49","date":"2026-10-15T11:59:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f78ddcc872248c7aa1d7e904928441a0be4c6d5d","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/f78ddcc872248c7aa1d7e904928441a0be4c6d5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98978","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98978.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98975","title":"xfs: stop exchanging reflink flags when exchanging mappings","status":"backported","project":false,"upstream":[{"sha":"d84d6c1a7f1e2de9e601703a326a4c1b7b421943","url":"https://git.kernel.org/stable/c/d84d6c1a7f1e2de9e601703a326a4c1b7b421943"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4756c94260e69ce42612b8220c3614f02f7a11d5","label":"4756c94260e6","date":"2026-10-15T12:00:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d84d6c1a7f1e2de9e601703a326a4c1b7b421943","lines":160,"reason":"","source":"https://github.com/torvalds/linux/commit/d84d6c1a7f1e2de9e601703a326a4c1b7b421943.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98972","title":"cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()","status":"backported","project":false,"upstream":[{"sha":"e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469","url":"https://git.kernel.org/stable/c/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469"}],"evidence":[{"url":"https://git.kernel.org/stable/c/988bf67a13890a37a33201f95947095ca9bec856","label":"988bf67a1389","date":"2026-10-15T12:00:01+02:00","lore":["https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98972","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98972.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98966","title":"bonding: fix the program leak when XDP is replaced","status":"backported","project":false,"upstream":[{"sha":"184b5ddf82d45d6f75cc83719a2e453392512bd2","url":"https://git.kernel.org/stable/c/184b5ddf82d45d6f75cc83719a2e453392512bd2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bba6b1b086f9f4ddbfdaba7ea6279dc3abec70c7","label":"bba6b1b086f9","date":"2026-10-15T12:00:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"184b5ddf82d45d6f75cc83719a2e453392512bd2","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/184b5ddf82d45d6f75cc83719a2e453392512bd2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98966","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98966.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98960","title":"btrfs: don't stash io_uring encoded data across -EAGAIN","status":"backported","project":false,"upstream":[{"sha":"51562a8cb11628d3a5e105b4c347ec5473e5745f","url":"https://git.kernel.org/stable/c/51562a8cb11628d3a5e105b4c347ec5473e5745f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4d9c1e0a7fb2cfb1cc924acafc194d2c15c3e83e","label":"4d9c1e0a7fb2","date":"2026-10-15T12:00:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"51562a8cb11628d3a5e105b4c347ec5473e5745f","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/51562a8cb11628d3a5e105b4c347ec5473e5745f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98960","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98960.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98959","title":"btrfs: fix xattr replace when multiple xattrs are packed in the same item","status":"backported","project":false,"upstream":[{"sha":"858bee1c77857aabcc2327cd32dd8266332de332","url":"https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c1803697a60f22743aa28ad522f805e92d45e3f0","label":"c1803697a60f","date":"2026-10-15T12:00:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"858bee1c77857aabcc2327cd32dd8266332de332","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/858bee1c77857aabcc2327cd32dd8266332de332.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98959","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98959.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98958","title":"wifi: mt76: account non-AQL frames per peer rather than per link","status":"backported","project":false,"upstream":[{"sha":"752770d7a58c821c17909c3ca67f9f14ab146a40","url":"https://git.kernel.org/stable/c/752770d7a58c821c17909c3ca67f9f14ab146a40"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e0f2ae4a7539454ec50c353571779fcda8c0cfcf","label":"e0f2ae4a7539","date":"2026-10-15T12:00:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"752770d7a58c821c17909c3ca67f9f14ab146a40","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/752770d7a58c821c17909c3ca67f9f14ab146a40.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98958","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98958.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98957","title":"wifi: mt76: mt7915: disable rx napi when removing device","status":"backported","project":false,"upstream":[{"sha":"916c484d29d82f45c281da2786fcd6a1284430ce","url":"https://git.kernel.org/stable/c/916c484d29d82f45c281da2786fcd6a1284430ce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7199ee4b47de0b61fa6455a1587c5ab645ebe262","label":"7199ee4b47de","date":"2026-10-15T12:00:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"916c484d29d82f45c281da2786fcd6a1284430ce","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/916c484d29d82f45c281da2786fcd6a1284430ce.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98957","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98957.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98954","title":"net: always dissect GSO packets in __virtio_net_hdr_to_skb()","status":"backported","project":false,"upstream":[{"sha":"44378d02c5aaae24b60a75fbbb539b4aa4db503d","url":"https://git.kernel.org/stable/c/44378d02c5aaae24b60a75fbbb539b4aa4db503d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5f4dfdf0077730e9d3ef5b37ceb17a5a56d6f34c","label":"5f4dfdf00777","date":"2026-10-15T12:00:05+02:00","lore":["https://lore.kernel.org/netdev/20260927163117.746432-2-bestswngs@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"44378d02c5aaae24b60a75fbbb539b4aa4db503d","lines":139,"reason":"","source":"https://github.com/torvalds/linux/commit/44378d02c5aaae24b60a75fbbb539b4aa4db503d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98954","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98954.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98951","title":"riscv: ptrace: Zero-initialize regset buffers before copyin","status":"backported","project":false,"upstream":[{"sha":"59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97","url":"https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97"}],"evidence":[{"url":"https://git.kernel.org/stable/c/89fc70d73f4ac8781f9e15edd1dbc6b6088453b3","label":"89fc70d73f4a","date":"2026-10-15T12:00:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98951","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98951.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98947","title":"vsock: Fix memory leak in vmci_transport_recv_dgram_cb()","status":"backported","project":false,"upstream":[{"sha":"7c24a4e87e219072e5e106f6791146cbf3b056b3","url":"https://git.kernel.org/stable/c/7c24a4e87e219072e5e106f6791146cbf3b056b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9907db2b8e7ba70b442bb9dec86526a6511fac62","label":"9907db2b8e7b","date":"2026-10-15T12:00:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c24a4e87e219072e5e106f6791146cbf3b056b3","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7c24a4e87e219072e5e106f6791146cbf3b056b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98946","title":"drm/vc4: Disable the V3D interrupt across runtime suspend","status":"backported","project":false,"upstream":[{"sha":"6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f","url":"https://git.kernel.org/stable/c/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e81402c3d42041356cb7978510ebab997bc8d411","label":"e81402c3d420","date":"2026-10-15T12:00:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f","lines":67,"reason":"","source":"https://github.com/torvalds/linux/commit/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98946","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98946.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98938","title":"rust: irq: pass RegistrationInner as cookie to request_irq","status":"backported","project":false,"upstream":[{"sha":"9a7931e847f338a687e96cde9f37e0cff83ddd84","url":"https://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84","label":"9a7931e847f3","date":"2026-10-11T15:27:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"9a7931e847f338a687e96cde9f37e0cff83ddd84","lines":185,"reason":"","source":"https://github.com/torvalds/linux/commit/9a7931e847f338a687e96cde9f37e0cff83ddd84.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98937","title":"perf/core: Check kernel access when kernel callchains are requested","status":"backported","project":false,"upstream":[{"sha":"a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f","url":"https://git.kernel.org/stable/c/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6e187281f978a2bff98ead6aa40f8ddc9a2c9afb","label":"6e187281f978","date":"2026-10-11T15:27:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98937","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98937.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98932","title":"EDAC/altera: Fix use-after-free in error paths","status":"backported","project":false,"upstream":[{"sha":"eef3b67f9c6782127163b631c9043011a68016e2","url":"https://git.kernel.org/stable/c/eef3b67f9c6782127163b631c9043011a68016e2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/87364b19b3fe4e6dbf88d6acf6db4ec87e7dfbba","label":"87364b19b3fe","date":"2026-10-11T15:27:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"eef3b67f9c6782127163b631c9043011a68016e2","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/eef3b67f9c6782127163b631c9043011a68016e2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98930","title":"KVM: s390: Fix IRQ injection with SIGP Stop and Store Status","status":"backported","project":false,"upstream":[{"sha":"d343407b728a80b74be3c24b59f15e60289ea527","url":"https://git.kernel.org/stable/c/d343407b728a80b74be3c24b59f15e60289ea527"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d0e3bf633f0585a0c2c2105ea7723777d764fae5","label":"d0e3bf633f05","date":"2026-10-03T12:42:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d343407b728a80b74be3c24b59f15e60289ea527","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/d343407b728a80b74be3c24b59f15e60289ea527.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98930","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98930.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98929","title":"macsec: initialize SecY before registering the netdevice","status":"backported","project":false,"upstream":[{"sha":"c2de369c5c5b8599ca10fd5ca8d11fcd845c1331","url":"https://git.kernel.org/stable/c/c2de369c5c5b8599ca10fd5ca8d11fcd845c1331"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b07bea42bf590edb0fd507ab25622a74af09548b","label":"b07bea42bf59","date":"2026-10-03T12:42:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c2de369c5c5b8599ca10fd5ca8d11fcd845c1331","lines":141,"reason":"","source":"https://github.com/torvalds/linux/commit/c2de369c5c5b8599ca10fd5ca8d11fcd845c1331.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98926","title":"drm/amd/display: Remove sink usage from DPMS","status":"backported","project":false,"upstream":[{"sha":"8fa813b7fd1eccbed13e126166cf764f1f11a7d3","url":"https://git.kernel.org/stable/c/8fa813b7fd1eccbed13e126166cf764f1f11a7d3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0b1eebd359685dd681f6e0df5540a5bb985a27bf","label":"0b1eebd35968","date":"2026-10-03T12:42:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8fa813b7fd1eccbed13e126166cf764f1f11a7d3","lines":384,"reason":"","source":"https://github.com/torvalds/linux/commit/8fa813b7fd1eccbed13e126166cf764f1f11a7d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98926","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98926.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98924","title":"fs: avoid repeated scans in evict_inodes()","status":"backported","project":false,"upstream":[{"sha":"7459c021874246c196f397686e100702f059b9e7","url":"https://git.kernel.org/stable/c/7459c021874246c196f397686e100702f059b9e7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3cdc6e12ff79f0f8a3ba62d7e61474ae4b5e119a","label":"3cdc6e12ff79","date":"2026-10-03T12:42:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7459c021874246c196f397686e100702f059b9e7","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/7459c021874246c196f397686e100702f059b9e7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98924","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98924.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98920","title":"netfs: Fix missing alloc tagging of direct mempool allocations","status":"backported","project":false,"upstream":[{"sha":"b78b728e21c32ec4c330b299f657fb1eb02dffc2","url":"https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/37a2042748bc880df03ff8315db86ed82991fbb8","label":"37a2042748bc","date":"2026-10-03T12:43:00+02:00","lore":["https://lore.kernel.org/all/0b004319-9ef7-437c-a4dd-174d6a9a83db@mailbox.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b78b728e21c32ec4c330b299f657fb1eb02dffc2","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/b78b728e21c32ec4c330b299f657fb1eb02dffc2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98917","title":"parisc: Increase kernel stack size to 32kb","status":"backported","project":false,"upstream":[{"sha":"94b7e3a7e871ae27d4935c76959dfc61829f27f9","url":"https://git.kernel.org/stable/c/94b7e3a7e871ae27d4935c76959dfc61829f27f9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/db45f02b7a5f753efc9003f616dfb5ee4cb6d077","label":"db45f02b7a5f","date":"2026-10-03T12:43:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"94b7e3a7e871ae27d4935c76959dfc61829f27f9","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/94b7e3a7e871ae27d4935c76959dfc61829f27f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98917","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98917.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98916","title":"wifi: nl80211: check link is beaconing for color change","status":"backported","project":false,"upstream":[{"sha":"55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4","url":"https://git.kernel.org/stable/c/55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98916","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98916.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98914","title":"drm/amdgpu: cap ATOM command table nesting depth","status":"backported","project":false,"upstream":[{"sha":"27ef1795bc4e47cae838e0a3ced531c549f9b23d","url":"https://git.kernel.org/stable/c/27ef1795bc4e47cae838e0a3ced531c549f9b23d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"27ef1795bc4e47cae838e0a3ced531c549f9b23d","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/27ef1795bc4e47cae838e0a3ced531c549f9b23d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98906","title":"net: lan966x: restore RX state on reload failure","status":"backported","project":false,"upstream":[{"sha":"aa97f11a76e545ed73cc455bcdd1ece4b480b507","url":"https://git.kernel.org/stable/c/aa97f11a76e545ed73cc455bcdd1ece4b480b507"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa97f11a76e545ed73cc455bcdd1ece4b480b507","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/aa97f11a76e545ed73cc455bcdd1ece4b480b507.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98904","title":"mailbox: imx: Use devm_pm_runtime_enable()","status":"backported","project":false,"upstream":[{"sha":"1f602619e408b6e9655ee76656a2a5ab6e89c5e4","url":"https://git.kernel.org/stable/c/1f602619e408b6e9655ee76656a2a5ab6e89c5e4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1f602619e408b6e9655ee76656a2a5ab6e89c5e4","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/1f602619e408b6e9655ee76656a2a5ab6e89c5e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98904","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98904.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98903","title":"mailbox: imx: Add a channel shutdown field","status":"backported","project":false,"upstream":[{"sha":"5ccea7eacb7786c358833634f45700365f6c1d99","url":"https://git.kernel.org/stable/c/5ccea7eacb7786c358833634f45700365f6c1d99"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5ccea7eacb7786c358833634f45700365f6c1d99","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/5ccea7eacb7786c358833634f45700365f6c1d99.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98903","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98903.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98901","title":"ksmbd: fix lease break and ack state handling","status":"backported","project":false,"upstream":[{"sha":"5015191096db311759fef98769270336cd8b1324","url":"https://git.kernel.org/stable/c/5015191096db311759fef98769270336cd8b1324"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"5015191096db311759fef98769270336cd8b1324","lines":184,"reason":"","source":"https://github.com/torvalds/linux/commit/5015191096db311759fef98769270336cd8b1324.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98897","title":"ksmbd: don't hold ci->m_lock while waiting for a lease break ack","status":"backported","project":false,"upstream":[{"sha":"27a9bc968d4ae809a3f5ca2f2b136856ee613cb4","url":"https://git.kernel.org/stable/c/27a9bc968d4ae809a3f5ca2f2b136856ee613cb4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"27a9bc968d4ae809a3f5ca2f2b136856ee613cb4","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/27a9bc968d4ae809a3f5ca2f2b136856ee613cb4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98897","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98897.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98880","title":"ntfs3: handle set_blocksize failures","status":"backported","project":false,"upstream":[{"sha":"24f7d1824b7581ae3daf9d443c5dfeabd89df6d8","url":"https://git.kernel.org/stable/c/24f7d1824b7581ae3daf9d443c5dfeabd89df6d8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"24f7d1824b7581ae3daf9d443c5dfeabd89df6d8","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/24f7d1824b7581ae3daf9d443c5dfeabd89df6d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98880","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98880.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98875","title":"drm/nouveau/gsp: add SEC2 to GA100 chip table","status":"backported","project":false,"upstream":[{"sha":"604d0efb17cc0dd197e089134736ac2698d5fca7","url":"https://git.kernel.org/stable/c/604d0efb17cc0dd197e089134736ac2698d5fca7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"604d0efb17cc0dd197e089134736ac2698d5fca7","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/604d0efb17cc0dd197e089134736ac2698d5fca7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98875","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98875.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98869","title":"bpf: Infer zext_dst based on static register liveness analysis","status":"unfixed","project":false,"upstream":[{"sha":"7ce090afbf725e25fff29caacce1eaf8459b1117","url":"https://git.kernel.org/stable/c/7ce090afbf725e25fff29caacce1eaf8459b1117"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"over-limit","patches":[{"sha":"7ce090afbf725e25fff29caacce1eaf8459b1117","lines":429,"reason":"","source":"https://github.com/torvalds/linux/commit/7ce090afbf725e25fff29caacce1eaf8459b1117.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98869","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98869.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98863","title":"KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails","status":"backported","project":false,"upstream":[{"sha":"10180a277549339020b08000206092c07e0bff5a","url":"https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/942192dbcd3a06695ef6b31cf10a41a21cf014d8","label":"942192dbcd3a","date":"2026-10-11T15:27:19+02:00","lore":["https://lore.kernel.org/all/20260813043932.3214460-1-rkskek9254@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"10180a277549339020b08000206092c07e0bff5a","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/10180a277549339020b08000206092c07e0bff5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98863","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98863.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98859","title":"HID: multitouch: stop the release timer from being rearmed on remove","status":"backported","project":false,"upstream":[{"sha":"5acb2dace582f061aab5e14c399ac9480315f44b","url":"https://git.kernel.org/stable/c/5acb2dace582f061aab5e14c399ac9480315f44b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a0125ca86e405b8a704e96157a6c10ca51087652","label":"a0125ca86e40","date":"2026-10-11T15:27:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5acb2dace582f061aab5e14c399ac9480315f44b","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/5acb2dace582f061aab5e14c399ac9480315f44b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98859","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98859.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98853","title":"net: gso: limit recursive IP-in-IP segmentation","status":"backported","project":false,"upstream":[{"sha":"006c8b834aed8b02bd8fb9fb05e9e7ead37d1763","url":"https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c949646c900e879afce47df1b607fa320eb63bf2","label":"c949646c900e","date":"2026-10-11T15:27:20+02:00","lore":["https://lore.kernel.org/all/cover.1790157745.git.zihanx@nebusec.ai/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"006c8b834aed8b02bd8fb9fb05e9e7ead37d1763","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98853","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98853.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98852","title":"net: extend IPv6 exthdr detection of tunneled packets","status":"backported","project":false,"upstream":[{"sha":"5f0764cb1c81a9712bce605d38efe6d844a70b29","url":"https://git.kernel.org/stable/c/5f0764cb1c81a9712bce605d38efe6d844a70b29"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cabacdf98e09eb74599c4d97d7bd7fd659598fb7","label":"cabacdf98e09","date":"2026-10-11T15:27:20+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5f0764cb1c81a9712bce605d38efe6d844a70b29","lines":67,"reason":"","source":"https://github.com/torvalds/linux/commit/5f0764cb1c81a9712bce605d38efe6d844a70b29.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98852","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98852.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98843","title":"netfs: zero gaps in read-gaps folio to avoid writing back stale data","status":"backported","project":false,"upstream":[{"sha":"8db55c5cd831a786a1a2a2d391aa80354535a353","url":"https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2a62fe628a877c249c8286b157ee99d82840d9dc","label":"2a62fe628a87","date":"2026-10-11T15:27:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8db55c5cd831a786a1a2a2d391aa80354535a353","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/8db55c5cd831a786a1a2a2d391aa80354535a353.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98843","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98843.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98839","title":"vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()","status":"backported","project":false,"upstream":[{"sha":"39495ef5d6f8019e62d65807f217a7ca8232727a","url":"https://git.kernel.org/stable/c/39495ef5d6f8019e62d65807f217a7ca8232727a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/619c6d7dd76fff15a9714fbf02ce299b737f01a2","label":"619c6d7dd76f","date":"2026-10-11T15:27:22+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"39495ef5d6f8019e62d65807f217a7ca8232727a","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/39495ef5d6f8019e62d65807f217a7ca8232727a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98839","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98839.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98834","title":"mtd: core: avoid double-free of OTP NVMEM device","status":"backported","project":false,"upstream":[{"sha":"26300879cd8e4612dce66bb8f6ff7cd35fcf3e59","url":"https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cecf007418b93a2cbc94269e07fe2fb28f54d8fb","label":"cecf007418b9","date":"2026-10-11T15:27:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"26300879cd8e4612dce66bb8f6ff7cd35fcf3e59","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98829","title":"wifi: mac80211: drop oversized fragments to avoid extra_len overflow","status":"backported","project":false,"upstream":[{"sha":"5e4f3509793b4db2c0835340224743db680e861f","url":"https://git.kernel.org/stable/c/5e4f3509793b4db2c0835340224743db680e861f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/870b8cb9baa9bd859deceb33ae158011e6ba2360","label":"870b8cb9baa9","date":"2026-10-11T15:27:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5e4f3509793b4db2c0835340224743db680e861f","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/5e4f3509793b4db2c0835340224743db680e861f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98829","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98829.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98828","title":"wifi: ath9k: reject short WMI command responses","status":"backported","project":false,"upstream":[{"sha":"93ce8ea70451e800601bc9444aa33043de15d67b","url":"https://git.kernel.org/stable/c/93ce8ea70451e800601bc9444aa33043de15d67b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a3b0137c855a61371d9cf9993b8bcc33c9798202","label":"a3b0137c855a","date":"2026-10-11T15:27:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"93ce8ea70451e800601bc9444aa33043de15d67b","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/93ce8ea70451e800601bc9444aa33043de15d67b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98828","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98828.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98827","title":"wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE","status":"backported","project":false,"upstream":[{"sha":"aeaca27c1db3106967ffbb2b517d98c835f6d500","url":"https://git.kernel.org/stable/c/aeaca27c1db3106967ffbb2b517d98c835f6d500"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e73a619f91b6cfec47bc1a94aea28df6849e5be3","label":"e73a619f91b6","date":"2026-10-11T15:27:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aeaca27c1db3106967ffbb2b517d98c835f6d500","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/aeaca27c1db3106967ffbb2b517d98c835f6d500.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98827","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98827.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98826","title":"rtc: ac100: Fix clock provider use-after-free on probe failure","status":"backported","project":false,"upstream":[{"sha":"fcf0b58e976e83adf246b014518e49c662b96f5e","url":"https://git.kernel.org/stable/c/fcf0b58e976e83adf246b014518e49c662b96f5e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/55ca60ba336632349f7c4585d22ba74ae355b7ce","label":"55ca60ba3366","date":"2026-10-11T15:27:24+02:00","lore":["https://lore.kernel.org/linux-rtc/20260905184936.155E11F00A3A@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fcf0b58e976e83adf246b014518e49c662b96f5e","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/fcf0b58e976e83adf246b014518e49c662b96f5e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98824","title":"wifi: mac80211: validate TX status rate metadata","status":"backported","project":false,"upstream":[{"sha":"6bdcdb31318c10e6369cff8e5b32c37397e98091","url":"https://git.kernel.org/stable/c/6bdcdb31318c10e6369cff8e5b32c37397e98091"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b1961a61ab6fbe11f16f7f9b64c57a9908c6c3a8","label":"b1961a61ab6f","date":"2026-10-11T15:27:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"6bdcdb31318c10e6369cff8e5b32c37397e98091","lines":165,"reason":"","source":"https://github.com/torvalds/linux/commit/6bdcdb31318c10e6369cff8e5b32c37397e98091.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98824","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98824.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98822","title":"wifi: mac80211: prevent AP VLAN tx from other interfaces","status":"backported","project":false,"upstream":[{"sha":"7f93ca31f7fd9b42e7d692f59514436d448ac908","url":"https://git.kernel.org/stable/c/7f93ca31f7fd9b42e7d692f59514436d448ac908"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ad61b9a5febb42e4b96df8d30ad76ddc36dda9d0","label":"ad61b9a5febb","date":"2026-10-11T15:27:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f93ca31f7fd9b42e7d692f59514436d448ac908","lines":80,"reason":"","source":"https://github.com/torvalds/linux/commit/7f93ca31f7fd9b42e7d692f59514436d448ac908.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98822","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98822.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98820","title":"blk-mq: set RQF_USE_SCHED when the operation is known","status":"backported","project":false,"upstream":[{"sha":"ab6c756f28c741d704a7c3e04814bfc3adf6f818","url":"https://git.kernel.org/stable/c/ab6c756f28c741d704a7c3e04814bfc3adf6f818"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2c47ebc27fa72078e26177cd458cdaf3006a9685","label":"2c47ebc27fa7","date":"2026-10-11T15:27:25+02:00","lore":["https://lore.kernel.org/linux-block/20260916151655.2588-1-15815827059@163.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ab6c756f28c741d704a7c3e04814bfc3adf6f818","lines":134,"reason":"","source":"https://github.com/torvalds/linux/commit/ab6c756f28c741d704a7c3e04814bfc3adf6f818.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98820","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98820.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98818","title":"mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()","status":"backported","project":false,"upstream":[{"sha":"af2fb3ee6679b517e2fdbd3ba16ec276a8b74312","url":"https://git.kernel.org/stable/c/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312"}],"evidence":[{"url":"https://git.kernel.org/stable/c/46545c86b54ffb969b6e3662942b4a6191619eaa","label":"46545c86b54f","date":"2026-10-11T15:27:25+02:00","lore":["https://lore.kernel.org/linux-mm/20260831143500.x-saxdAs@linutronix.de"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"af2fb3ee6679b517e2fdbd3ba16ec276a8b74312","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98818","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98818.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98816","title":"bpf: Fix overflow of jump offset in constant blinding","status":"backported","project":false,"upstream":[{"sha":"ad139384ecddb6f3e7e3c3c12765aafae0e39670","url":"https://git.kernel.org/stable/c/ad139384ecddb6f3e7e3c3c12765aafae0e39670"}],"evidence":[{"url":"https://git.kernel.org/stable/c/443328237113ee0ea515e506497334d871dbc2aa","label":"443328237113","date":"2026-10-11T15:27:25+02:00","lore":["https://lore.kernel.org/bpf/20260924182353.277516-1-alexei.starovoitov@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad139384ecddb6f3e7e3c3c12765aafae0e39670","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/ad139384ecddb6f3e7e3c3c12765aafae0e39670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98816","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98816.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98815","title":"nvme: fix cdev lifetime","status":"backported","project":false,"upstream":[{"sha":"9952f3882ecba709092379b71e02b09762b26f96","url":"https://git.kernel.org/stable/c/9952f3882ecba709092379b71e02b09762b26f96"}],"evidence":[{"url":"https://git.kernel.org/stable/c/98b09ad7934482e64db4b4477d91e3bbf43adf4c","label":"98b09ad79344","date":"2026-10-11T15:27:26+02:00","lore":["https://lore.kernel.org/linux-scsi/20260703102918.3723667-1-john.g.garry@oracle.com/T/#m67265e2906d617acd2743c0a00809246d0cfc506"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9952f3882ecba709092379b71e02b09762b26f96","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/9952f3882ecba709092379b71e02b09762b26f96.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98815","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98815.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98814","title":"nvme: fix command effects log lifetime for multipath heads","status":"backported","project":false,"upstream":[{"sha":"72ece656abd4de8645a421fb482d7a11e6533a45","url":"https://git.kernel.org/stable/c/72ece656abd4de8645a421fb482d7a11e6533a45"}],"evidence":[{"url":"https://git.kernel.org/stable/c/351d1c47e45b2b35780d0548b1012d7242ba298d","label":"351d1c47e45b","date":"2026-10-11T15:27:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"72ece656abd4de8645a421fb482d7a11e6533a45","lines":126,"reason":"","source":"https://github.com/torvalds/linux/commit/72ece656abd4de8645a421fb482d7a11e6533a45.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98814","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98814.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98813","title":"bpf: Hold map BTF for the memory allocator destructor record","status":"backported","project":false,"upstream":[{"sha":"ab39974240a0cff765f3bb9cce81d8001ffdb144","url":"https://git.kernel.org/stable/c/ab39974240a0cff765f3bb9cce81d8001ffdb144"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b506f5699e145196ee29d76cf1ca1cbb2202c055","label":"b506f5699e14","date":"2026-10-11T15:27:26+02:00","lore":["https://lore.kernel.org/bpf/20260901062845.1379760-3-chenyuan_fl@163.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ab39974240a0cff765f3bb9cce81d8001ffdb144","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/ab39974240a0cff765f3bb9cce81d8001ffdb144.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98813","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98813.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98810","title":"wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()","status":"backported","project":false,"upstream":[{"sha":"6f63e919fe1e335b8abcb3a28bfd4804a98d875a","url":"https://git.kernel.org/stable/c/6f63e919fe1e335b8abcb3a28bfd4804a98d875a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/63e7064b4c1c4b540bf2f0cba47384f92ab95307","label":"63e7064b4c1c","date":"2026-10-11T15:27:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f63e919fe1e335b8abcb3a28bfd4804a98d875a","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/6f63e919fe1e335b8abcb3a28bfd4804a98d875a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98810","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98810.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98808","title":"net: systemport: Fix buffer overflow in bcm_sysport_get_stats()","status":"backported","project":false,"upstream":[{"sha":"eb7b84af0ec5c71b4920e999611b466b3784496c","url":"https://git.kernel.org/stable/c/eb7b84af0ec5c71b4920e999611b466b3784496c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/faba9fdde480356f4a1d3b1a5713b7b354858a1c","label":"faba9fdde480","date":"2026-10-11T15:27:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb7b84af0ec5c71b4920e999611b466b3784496c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/eb7b84af0ec5c71b4920e999611b466b3784496c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98807","title":"net/mlx5: Fix slab-out-of-bounds when handling team device events","status":"backported","project":false,"upstream":[{"sha":"04c824940d52871c49866a4ac67b504146f7cf35","url":"https://git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8117cbc504cb01980258d8a8c9be8f57cf0aaceb","label":"8117cbc504cb","date":"2026-10-11T15:27:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"04c824940d52871c49866a4ac67b504146f7cf35","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/04c824940d52871c49866a4ac67b504146f7cf35.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98807.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98806","title":"octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled","status":"backported","project":false,"upstream":[{"sha":"056994563935e049093f100efaad7e63ad113814","url":"https://git.kernel.org/stable/c/056994563935e049093f100efaad7e63ad113814"}],"evidence":[{"url":"https://git.kernel.org/stable/c/59fbbded05e559675930fd521b8d62b72828b52d","label":"59fbbded05e5","date":"2026-10-11T15:27:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"056994563935e049093f100efaad7e63ad113814","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/056994563935e049093f100efaad7e63ad113814.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98803","title":"net: stmmac: fix rx Scatter-Gather support","status":"backported","project":false,"upstream":[{"sha":"88095728511e0df9c89528944f5a1762ad298983","url":"https://git.kernel.org/stable/c/88095728511e0df9c89528944f5a1762ad298983"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a7cff44543f66f3a19151060cb549691d191d44c","label":"a7cff44543f6","date":"2026-10-11T15:27:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"88095728511e0df9c89528944f5a1762ad298983","lines":180,"reason":"","source":"https://github.com/torvalds/linux/commit/88095728511e0df9c89528944f5a1762ad298983.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98803","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98803.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98802","title":"seg6: ensure packet data is writable before modifying SRH and IPv6 DA","status":"backported","project":false,"upstream":[{"sha":"8ae3f4067ba4ae3a15581392f6dac422e3d3def0","url":"https://git.kernel.org/stable/c/8ae3f4067ba4ae3a15581392f6dac422e3d3def0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e9141fdb7a2ead48cfcd60c681aba91d3014255b","label":"e9141fdb7a2e","date":"2026-10-11T15:27:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8ae3f4067ba4ae3a15581392f6dac422e3d3def0","lines":292,"reason":"","source":"https://github.com/torvalds/linux/commit/8ae3f4067ba4ae3a15581392f6dac422e3d3def0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98802","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98802.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98801","title":"net: restrict SO_RESERVE_MEM to TCP sockets and cap max value","status":"backported","project":false,"upstream":[{"sha":"37e02c42a00be692c06343e11779aadc45f45971","url":"https://git.kernel.org/stable/c/37e02c42a00be692c06343e11779aadc45f45971"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a467b05b201b5c26be52ed3081992fa9c0387648","label":"a467b05b201b","date":"2026-10-11T15:27:28+02:00","lore":["https://lore.kernel.org/netdev/5a88421d-10ef-4fca-9acb-85a27a3c1173@huawei.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"37e02c42a00be692c06343e11779aadc45f45971","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/37e02c42a00be692c06343e11779aadc45f45971.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98801","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98801.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98800","title":"bpf: Wait for an RCU tasks grace period before freeing trampoline progs","status":"backported","project":false,"upstream":[{"sha":"0fb5751a6e411b1b466c06e50021818d9391df98","url":"https://git.kernel.org/stable/c/0fb5751a6e411b1b466c06e50021818d9391df98"}],"evidence":[{"url":"https://git.kernel.org/stable/c/40955f6512a03f0e046f5256b0706b26ba191018","label":"40955f6512a0","date":"2026-10-11T15:27:28+02:00","lore":["https://lore.kernel.org/bpf/aqdrwVpanH3WGurX@omen-arch/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fb5751a6e411b1b466c06e50021818d9391df98","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/0fb5751a6e411b1b466c06e50021818d9391df98.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98800","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98800.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98799","title":"bpf: Skip detached progs in trampoline images that are still in use","status":"backported","project":false,"upstream":[{"sha":"17637e1a581a22466ac3620a91e099683ff9cc6f","url":"https://git.kernel.org/stable/c/17637e1a581a22466ac3620a91e099683ff9cc6f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/967566ad325b42150483e81acb09ea9d800c00b8","label":"967566ad325b","date":"2026-10-11T15:27:28+02:00","lore":["https://lore.kernel.org/bpf/20260815071927.147049-1-zirajs7@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"17637e1a581a22466ac3620a91e099683ff9cc6f","lines":955,"reason":"","source":"https://github.com/torvalds/linux/commit/17637e1a581a22466ac3620a91e099683ff9cc6f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98797","title":"net: cap skb->queue_mapping when the tx queue is picked","status":"backported","project":false,"upstream":[{"sha":"ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d","url":"https://git.kernel.org/stable/c/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f99de42f5c6f8d088063817dad82c3334e87c570","label":"f99de42f5c6f","date":"2026-10-11T15:27:29+02:00","lore":["https://lore.kernel.org/netdev/179008581937.2160803.7117814290574262942@kernel.org/","https://lore.kernel.org/netdev/179033713973.2160803.4914570693994398206@kernel.org/","https://lore.kernel.org/netdev/20260925180407.63647514@kernel.org/","https://lore.kernel.org/netdev/CANn89i+k-mZKDQVtvws_MEXeuMTAdaCcOXFZE-RfhcGTu90sjA@mail.gmail.com/","https://lore.kernel.org/netdev/CANn89iLwYx8nCVf0pCEk_MmEiyC6kQaMwCQT9WkQVeeNzNQHqQ@mail.gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98796","title":"net: ethernet: mtk_eth_soc: allocate dummy netdev sooner","status":"backported","project":false,"upstream":[{"sha":"6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b","url":"https://git.kernel.org/stable/c/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/17eafd74de5a31e30361420a2e3ebf64186b77e5","label":"17eafd74de5a","date":"2026-10-11T15:27:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98796","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98796.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98795","title":"net: sparx5: skip ptp deinit if init was skipped","status":"backported","project":false,"upstream":[{"sha":"0d2c49915bc3aea4521cda5e4d42f24f63b94585","url":"https://git.kernel.org/stable/c/0d2c49915bc3aea4521cda5e4d42f24f63b94585"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2879b65bfa548e10d59c5fba91d17f8a00cd7029","label":"2879b65bfa54","date":"2026-10-11T15:27:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0d2c49915bc3aea4521cda5e4d42f24f63b94585","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/0d2c49915bc3aea4521cda5e4d42f24f63b94585.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98795","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98795.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98792","title":"netfilter: flowtable: generalize pending status bit","status":"backported","project":false,"upstream":[{"sha":"7c549fb7eecd01fdba7c0d12c01da876ef8a3214","url":"https://git.kernel.org/stable/c/7c549fb7eecd01fdba7c0d12c01da876ef8a3214"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a2cac45848d1cf31ed190db30f90ba8211e9a8ca","label":"a2cac45848d1","date":"2026-10-11T15:27:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c549fb7eecd01fdba7c0d12c01da876ef8a3214","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/7c549fb7eecd01fdba7c0d12c01da876ef8a3214.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98792","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98792.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98789","title":"bpf: Fix objects stuck in free_by_rcu_ttrace","status":"backported","project":false,"upstream":[{"sha":"fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043","url":"https://git.kernel.org/stable/c/fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043"}],"evidence":[{"url":"https://git.kernel.org/stable/c/33d0a5d2fee06a51f2f056dd901296515912e954","label":"33d0a5d2fee0","date":"2026-10-11T15:27:30+02:00","lore":["https://lore.kernel.org/bpf/20260930095920.601738-3-alexei.starovoitov@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98789","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98789.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98788","title":"futex: Fix private hash use-after-free on resize","status":"backported","project":false,"upstream":[{"sha":"f35e3b5784221654f9cdbd6222275a7fa203f6c3","url":"https://git.kernel.org/stable/c/f35e3b5784221654f9cdbd6222275a7fa203f6c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5d5dc18b3a9ac011619b7d3af4514bf9e9b6a6af","label":"5d5dc18b3a9a","date":"2026-10-11T15:27:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f35e3b5784221654f9cdbd6222275a7fa203f6c3","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/f35e3b5784221654f9cdbd6222275a7fa203f6c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98788","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98788.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98786","title":"drm/amd/display: guard dc_sink dereferences in MST mode validation","status":"backported","project":false,"upstream":[{"sha":"217f64f348c90cba62164e7ff38e0ccf78a5ca09","url":"https://git.kernel.org/stable/c/217f64f348c90cba62164e7ff38e0ccf78a5ca09"}],"evidence":[{"url":"https://git.kernel.org/stable/c/daa0437fe5e451856aaf8fda602a9fc2105bbd54","label":"daa0437fe5e4","date":"2026-10-11T15:27:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"217f64f348c90cba62164e7ff38e0ccf78a5ca09","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/217f64f348c90cba62164e7ff38e0ccf78a5ca09.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98786","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98786.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98758","title":"usb: typec: ucsi: glink: fix use-after-free of ucsi on remove","status":"backported","project":false,"upstream":[{"sha":"63b269ec537dc0fd26d0bd64872c26860d108c9d","url":"https://git.kernel.org/stable/c/63b269ec537dc0fd26d0bd64872c26860d108c9d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ee8577de01c6b6c7dd1d76b52242c54d37a989f4","label":"ee8577de01c6","date":"2026-10-11T15:27:35+02:00","lore":["https://lore.kernel.org/r/20260227190430.889-1-nathan.c.rebello@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"63b269ec537dc0fd26d0bd64872c26860d108c9d","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/63b269ec537dc0fd26d0bd64872c26860d108c9d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98758","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98758.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98747","title":"serial: core: fix NULL pointer dereference in serial_core_unregister_port()","status":"backported","project":false,"upstream":[{"sha":"499485a67fbacf4d9afbdb43522388c64f853428","url":"https://git.kernel.org/stable/c/499485a67fbacf4d9afbdb43522388c64f853428"}],"evidence":[{"url":"https://git.kernel.org/stable/c/54abbb862366dcaf1f22f1e968358147b7d0547d","label":"54abbb862366","date":"2026-10-11T15:27:37+02:00","lore":["https://lore.kernel.org/all/20260826073237.1377668-1-linuxoid@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"499485a67fbacf4d9afbdb43522388c64f853428","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/499485a67fbacf4d9afbdb43522388c64f853428.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98747","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98747.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98740","title":"EDAC/altera: Drop __init from ECC setup paths for re-probe safety","status":"backported","project":false,"upstream":[{"sha":"b62a264163ca51bee04785c581344751812395df","url":"https://git.kernel.org/stable/c/b62a264163ca51bee04785c581344751812395df"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4ec26cb7984740941892ad21fa974963c198bfaa","label":"4ec26cb79847","date":"2026-10-11T15:27:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b62a264163ca51bee04785c581344751812395df","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/b62a264163ca51bee04785c581344751812395df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98740","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98740.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98738","title":"Bluetooth: Serialize SMP remote OOB data access","status":"backported","project":false,"upstream":[{"sha":"81a2345f1984f0b36d3226571bc196316a01b648","url":"https://git.kernel.org/stable/c/81a2345f1984f0b36d3226571bc196316a01b648"}],"evidence":[{"url":"https://git.kernel.org/stable/c/df5162eeb10e69fe0c2349503882c4a09077f001","label":"df5162eeb10e","date":"2026-10-11T15:27:39+02:00","lore":["https://lore.kernel.org/r/00660cd3-7d71-13a4-f617-229e6defb701@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"81a2345f1984f0b36d3226571bc196316a01b648","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/81a2345f1984f0b36d3226571bc196316a01b648.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98738","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98738.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98737","title":"Bluetooth: hci_sync: Fix inquiry cache use-after-free","status":"backported","project":false,"upstream":[{"sha":"8ed67535fdff40ca652bcd4ac7da68d11d01bd34","url":"https://git.kernel.org/stable/c/8ed67535fdff40ca652bcd4ac7da68d11d01bd34"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a642f498f0b08f2aa9f4a69468db92f57a72349d","label":"a642f498f0b0","date":"2026-10-11T15:27:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ed67535fdff40ca652bcd4ac7da68d11d01bd34","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/8ed67535fdff40ca652bcd4ac7da68d11d01bd34.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98737","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98737.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98734","title":"Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown","status":"backported","project":false,"upstream":[{"sha":"848a7a91c7f03675d3bd8db6f7721cbf9cb50e21","url":"https://git.kernel.org/stable/c/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ecdb1c66d8e14e63731c52d6fbcfa604064913c4","label":"ecdb1c66d8e1","date":"2026-10-11T15:27:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"848a7a91c7f03675d3bd8db6f7721cbf9cb50e21","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98734","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98734.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98720","title":"KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified","status":"backported","project":false,"upstream":[{"sha":"2abb25273c82061dd4670690c81c319c03740bf6","url":"https://git.kernel.org/stable/c/2abb25273c82061dd4670690c81c319c03740bf6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1e497e3bdab6983deb68a1d26b488027deb4527f","label":"1e497e3bdab6","date":"2026-10-11T15:27:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2abb25273c82061dd4670690c81c319c03740bf6","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/2abb25273c82061dd4670690c81c319c03740bf6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98720","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98720.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98715","title":"KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN","status":"backported","project":false,"upstream":[{"sha":"60d93c27859fb3ec5b5a689e24de303f166477d0","url":"https://git.kernel.org/stable/c/60d93c27859fb3ec5b5a689e24de303f166477d0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fd873c3d1b5240e80365f09e758e8c96b88a7cdb","label":"fd873c3d1b52","date":"2026-10-11T15:27:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"60d93c27859fb3ec5b5a689e24de303f166477d0","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/60d93c27859fb3ec5b5a689e24de303f166477d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98715","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98715.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98714","title":"KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded","status":"backported","project":false,"upstream":[{"sha":"e27fc915c8f575ab5630e27d97465c2077d4b9d1","url":"https://git.kernel.org/stable/c/e27fc915c8f575ab5630e27d97465c2077d4b9d1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8676b29d186fcb5c1251d8152fc91d19421e5600","label":"8676b29d186f","date":"2026-10-11T15:27:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e27fc915c8f575ab5630e27d97465c2077d4b9d1","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/e27fc915c8f575ab5630e27d97465c2077d4b9d1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98714","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98714.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98692","title":"thunderbolt: Make the DP tunnel activation callback mandatory","status":"backported","project":false,"upstream":[{"sha":"12f5d8b85a66a0ac08d082517d92ce136f8c0d42","url":"https://git.kernel.org/stable/c/12f5d8b85a66a0ac08d082517d92ce136f8c0d42"}],"evidence":[{"url":"https://git.kernel.org/stable/c/47d60ea801fc333a10c576691eca2e7840b02d3d","label":"47d60ea801fc","date":"2026-10-11T15:27:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"12f5d8b85a66a0ac08d082517d92ce136f8c0d42","lines":243,"reason":"","source":"https://github.com/torvalds/linux/commit/12f5d8b85a66a0ac08d082517d92ce136f8c0d42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98692","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98692.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98685","title":"smb: client: discard post-EOF pagecache when extending a file via clone range","status":"backported","project":false,"upstream":[{"sha":"4721587f96cb8de8164f3fd203093a0875560999","url":"https://git.kernel.org/stable/c/4721587f96cb8de8164f3fd203093a0875560999"}],"evidence":[{"url":"https://git.kernel.org/stable/c/15bb9f1d3e967e328649e92a1451e60a0dc66118","label":"15bb9f1d3e96","date":"2026-10-11T15:27:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4721587f96cb8de8164f3fd203093a0875560999","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/4721587f96cb8de8164f3fd203093a0875560999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98685","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98685.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98684","title":"smb: client: flush and commit data before querying allocated ranges","status":"backported","project":false,"upstream":[{"sha":"aa994489bd835547c191827acc460192e147032d","url":"https://git.kernel.org/stable/c/aa994489bd835547c191827acc460192e147032d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bf84e44ff0ed802778eafd7ecb623635379cb506","label":"bf84e44ff0ed","date":"2026-10-11T15:27:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa994489bd835547c191827acc460192e147032d","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/aa994489bd835547c191827acc460192e147032d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98684","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98684.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98683","title":"smb: client: flush dirty data before zeroing a range","status":"backported","project":false,"upstream":[{"sha":"8f8d32c1044f70e46e87550e039a15ff20a4b21c","url":"https://git.kernel.org/stable/c/8f8d32c1044f70e46e87550e039a15ff20a4b21c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e8ba21c7e6ef3d4cb617858760673877b2e4a2bb","label":"e8ba21c7e6ef","date":"2026-10-11T15:27:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f8d32c1044f70e46e87550e039a15ff20a4b21c","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/8f8d32c1044f70e46e87550e039a15ff20a4b21c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98683","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98683.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98682","title":"smb: client: drain and invalidate before server-side copy/clone","status":"backported","project":false,"upstream":[{"sha":"c9b1194e8ec99d95db25db45edd2fbf690f043ab","url":"https://git.kernel.org/stable/c/c9b1194e8ec99d95db25db45edd2fbf690f043ab"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dc71660f11ef2fecc0695a41e49cd496a9d255ab","label":"dc71660f11ef","date":"2026-10-11T15:27:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c9b1194e8ec99d95db25db45edd2fbf690f043ab","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/c9b1194e8ec99d95db25db45edd2fbf690f043ab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98682","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98682.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98674","title":"iio: adc: adi-axi-adc: Initialize state mutex","status":"backported","project":false,"upstream":[{"sha":"549b71ce050637dd32678371ad76c445a2f8c9aa","url":"https://git.kernel.org/stable/c/549b71ce050637dd32678371ad76c445a2f8c9aa"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dec6193cef07e5915da0d6dd17725292d469e4aa","label":"dec6193cef07","date":"2026-10-11T15:27:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"549b71ce050637dd32678371ad76c445a2f8c9aa","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/549b71ce050637dd32678371ad76c445a2f8c9aa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98674","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98674.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98665","title":"iio: health: max30102: fix NULL dereference in interrupt handler","status":"backported","project":false,"upstream":[{"sha":"f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d","url":"https://git.kernel.org/stable/c/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8d6f98972fe2bd6f73f39d982af0c85d766a1503","label":"8d6f98972fe2","date":"2026-10-11T15:27:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98665","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98665.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98661","title":"iio: light: rohm-bu27034: Fix infinite delay on error","status":"backported","project":false,"upstream":[{"sha":"8065a6c02f629187131f3136bedb26f9080e3cca","url":"https://git.kernel.org/stable/c/8065a6c02f629187131f3136bedb26f9080e3cca"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6a27402a8ff1f63464557c5274a4115b60ea1f2f","label":"6a27402a8ff1","date":"2026-10-11T15:27:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8065a6c02f629187131f3136bedb26f9080e3cca","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/8065a6c02f629187131f3136bedb26f9080e3cca.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98652","title":"KVM: s390: Add missing srcu in kvm_s390_set_irq_state()","status":"backported","project":false,"upstream":[{"sha":"f3a557067d57ce6ae98d485c8009b223e16f5f36","url":"https://git.kernel.org/stable/c/f3a557067d57ce6ae98d485c8009b223e16f5f36"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7a33007b95c8908ae3980eb2b4c508f8936766df","label":"7a33007b95c8","date":"2026-10-03T12:42:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f3a557067d57ce6ae98d485c8009b223e16f5f36","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/f3a557067d57ce6ae98d485c8009b223e16f5f36.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98652","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98652.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98642","title":"bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk","status":"backported","project":false,"upstream":[{"sha":"1c21452d02eec2f008e2c5535820f85adbd7587a","url":"https://git.kernel.org/stable/c/1c21452d02eec2f008e2c5535820f85adbd7587a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f101602415fb39a58941bec444df65634d5a6844","label":"f101602415fb","date":"2026-10-03T12:42:42+02:00","lore":["https://lore.kernel.org/r/20260905021139.4116529-1-pulehui@huaweicloud.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c21452d02eec2f008e2c5535820f85adbd7587a","lines":94,"reason":"","source":"https://github.com/torvalds/linux/commit/1c21452d02eec2f008e2c5535820f85adbd7587a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98642","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98642.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98634","title":"scsi: sd_zbc: Reject disks with too many zones","status":"backported","project":false,"upstream":[{"sha":"b6ec0f79745967c751c85df373062c8d15e45fc4","url":"https://git.kernel.org/stable/c/b6ec0f79745967c751c85df373062c8d15e45fc4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3ddf8383b54456f19fd73d3cebed81bd250c7388","label":"3ddf8383b544","date":"2026-10-03T12:42:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b6ec0f79745967c751c85df373062c8d15e45fc4","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/b6ec0f79745967c751c85df373062c8d15e45fc4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98628","title":"bpf: Make post-verification instruction rewrites killable","status":"backported","project":false,"upstream":[{"sha":"261b61d3735b042ae25634f795c4540be0fc140c","url":"https://git.kernel.org/stable/c/261b61d3735b042ae25634f795c4540be0fc140c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/56dc616d7a1f7d134d3e101c455e62b0a24d0cfd","label":"56dc616d7a1f","date":"2026-10-03T12:42:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"261b61d3735b042ae25634f795c4540be0fc140c","lines":113,"reason":"","source":"https://github.com/torvalds/linux/commit/261b61d3735b042ae25634f795c4540be0fc140c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98628","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98628.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98620","title":"net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure","status":"backported","project":false,"upstream":[{"sha":"310d1ac61a4d5a2ca8356a3a48d263acf54503ce","url":"https://git.kernel.org/stable/c/310d1ac61a4d5a2ca8356a3a48d263acf54503ce"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0fdb944d4df02223c67d5e65c4c134ecb57a5668","label":"0fdb944d4df0","date":"2026-10-03T12:42:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"310d1ac61a4d5a2ca8356a3a48d263acf54503ce","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/310d1ac61a4d5a2ca8356a3a48d263acf54503ce.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98620","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98620.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98617","title":"eth: fbnic: use the Rx queue napi pointer to find the napi vector","status":"backported","project":false,"upstream":[{"sha":"b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e","url":"https://git.kernel.org/stable/c/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1fb569cf3bf97e552f465b2c719e36b48ae7c18b","label":"1fb569cf3bf9","date":"2026-10-03T12:42:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98617","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98617.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98616","title":"eth: fbnic: reset num_napi when the napi vectors are freed","status":"backported","project":false,"upstream":[{"sha":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","url":"https://git.kernel.org/stable/c/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4f4b767ffea7653a00904383908536e754f8ef5b","label":"4f4b767ffea7","date":"2026-10-03T12:42:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98616","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98616.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98599","title":"bpf: Reject non-negative offsets in stack_slot_obj_get_spi()","status":"backported","project":false,"upstream":[{"sha":"79a9172f3ab4ad8392c5e5c8944b9b7710ade620","url":"https://git.kernel.org/stable/c/79a9172f3ab4ad8392c5e5c8944b9b7710ade620"}],"evidence":[{"url":"https://git.kernel.org/stable/c/89a7241fc7ecc1b5e47c3f071081e314523b8d9d","label":"89a7241fc7ec","date":"2026-10-03T12:42:50+02:00","lore":["https://lore.kernel.org/bpf/20260920210423.345636-2-xyx2021@mail.ustc.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"79a9172f3ab4ad8392c5e5c8944b9b7710ade620","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/79a9172f3ab4ad8392c5e5c8944b9b7710ade620.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98599","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98599.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98598","title":"ipv6: Prevent rt6_insert_exception() for dying fib6_info.","status":"backported","project":false,"upstream":[{"sha":"0346ec2f080b40d95ed05b853bb9226289e75212","url":"https://git.kernel.org/stable/c/0346ec2f080b40d95ed05b853bb9226289e75212"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e03e77071e75ce726d877f0a4349a28b6e1f487a","label":"e03e77071e75","date":"2026-10-03T12:42:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0346ec2f080b40d95ed05b853bb9226289e75212","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/0346ec2f080b40d95ed05b853bb9226289e75212.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98598","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98598.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98589","title":"bpf: Reject pkt arguments in mutating subprogs","status":"backported","project":false,"upstream":[{"sha":"a6c1edfbe240e4377038a0e1d233ad81fde9a21b","url":"https://git.kernel.org/stable/c/a6c1edfbe240e4377038a0e1d233ad81fde9a21b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0b6b2bb9b90ad1e2d94d18f626258a1dbbdee0ea","label":"0b6b2bb9b90a","date":"2026-10-03T12:42:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6c1edfbe240e4377038a0e1d233ad81fde9a21b","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/a6c1edfbe240e4377038a0e1d233ad81fde9a21b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98589","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98589.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98570","title":"net: ipv6: keep room for the mac header in dst_dev_overhead()","status":"backported","project":false,"upstream":[{"sha":"87cd6b717e4069dca34e0866e57eaeb44d3b173e","url":"https://git.kernel.org/stable/c/87cd6b717e4069dca34e0866e57eaeb44d3b173e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/36c07127924f11fc5741a780abcaaf808fe9ef13","label":"36c07127924f","date":"2026-10-03T12:42:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"87cd6b717e4069dca34e0866e57eaeb44d3b173e","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/87cd6b717e4069dca34e0866e57eaeb44d3b173e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98570","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98570.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98565","title":"net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621","status":"backported","project":false,"upstream":[{"sha":"c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4","url":"https://git.kernel.org/stable/c/c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aae2a1f1e3a0ac5eeb439262a2328a2a392413ac","label":"aae2a1f1e3a0","date":"2026-10-03T12:42:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98565","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98565.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98562","title":"net: libwx: fix races in Tx timestamp handling","status":"backported","project":false,"upstream":[{"sha":"3173cba1170131816972ed2b6185cb970ba8b747","url":"https://git.kernel.org/stable/c/3173cba1170131816972ed2b6185cb970ba8b747"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e78b95cfd5df25d0c562aaef95d3c7fe6c7e0e66","label":"e78b95cfd5df","date":"2026-10-03T12:42:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"3173cba1170131816972ed2b6185cb970ba8b747","lines":295,"reason":"","source":"https://github.com/torvalds/linux/commit/3173cba1170131816972ed2b6185cb970ba8b747.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98562","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98562.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98558","title":"net: flush skb_defer_nodes in dev_cpu_dead()","status":"backported","project":false,"upstream":[{"sha":"06e3f54e8b22040ada01a28343badf1990b4dd7d","url":"https://git.kernel.org/stable/c/06e3f54e8b22040ada01a28343badf1990b4dd7d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c68f4157463448a76893223e117170be8374d773","label":"c68f41574634","date":"2026-10-03T12:42:57+02:00","lore":["https://lore.kernel.org/netdev/20260916003430.3612956-1-kris.pan@intel.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"06e3f54e8b22040ada01a28343badf1990b4dd7d","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/06e3f54e8b22040ada01a28343badf1990b4dd7d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98558","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98558.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98556","title":"gve: DQO: reject TSO packets with an out of range MSS","status":"backported","project":false,"upstream":[{"sha":"296c83b5ccc808c080865eb20fd7a477b0355bb7","url":"https://git.kernel.org/stable/c/296c83b5ccc808c080865eb20fd7a477b0355bb7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c517e8755960c8c6335ebf7dae6c95c43e5fb085","label":"c517e8755960","date":"2026-10-03T12:42:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"296c83b5ccc808c080865eb20fd7a477b0355bb7","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/296c83b5ccc808c080865eb20fd7a477b0355bb7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98556","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98556.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98551","title":"perf/core: Fill branch entries with a single assignment","status":"backported","project":false,"upstream":[{"sha":"24b620729e53d978b3e425f55bc66efd3bab1f59","url":"https://git.kernel.org/stable/c/24b620729e53d978b3e425f55bc66efd3bab1f59"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c7de8521947a521b766979ff5c09f66fe905a5bd","label":"c7de8521947a","date":"2026-10-03T12:42:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"24b620729e53d978b3e425f55bc66efd3bab1f59","lines":163,"reason":"","source":"https://github.com/torvalds/linux/commit/24b620729e53d978b3e425f55bc66efd3bab1f59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98551","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98551.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98539","title":"fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga","status":"backported","project":false,"upstream":[{"sha":"1abd643f3783ea8f8e273c18697ff0413aa92dc7","url":"https://git.kernel.org/stable/c/1abd643f3783ea8f8e273c18697ff0413aa92dc7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1ae2a242c15b03470b1b16289298e597bbe3bb29","label":"1ae2a242c15b","date":"2026-10-03T12:43:00+02:00","lore":["https://lore.kernel.org/6a9beced.a5e650b3.26d8a.000b.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1abd643f3783ea8f8e273c18697ff0413aa92dc7","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/1abd643f3783ea8f8e273c18697ff0413aa92dc7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98539","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98539.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98525","title":"mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()","status":"backported","project":false,"upstream":[{"sha":"26cc0e69cce062cd3aa6fae33074684669c35a71","url":"https://git.kernel.org/stable/c/26cc0e69cce062cd3aa6fae33074684669c35a71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f178300e2f56ca9ec2a3a0090608730bbee0af7b","label":"f178300e2f56","date":"2026-10-03T12:43:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"26cc0e69cce062cd3aa6fae33074684669c35a71","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/26cc0e69cce062cd3aa6fae33074684669c35a71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98525","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98525.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98509","title":"drm/virtio: fix memory leak of fence event on execbuffer failure","status":"backported","project":false,"upstream":[{"sha":"b74aad23d99b279bb34d135795f39a6d8ecdc075","url":"https://git.kernel.org/stable/c/b74aad23d99b279bb34d135795f39a6d8ecdc075"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ae583668f16d41fcc1b54f45848c1b6ac1d6669a","label":"ae583668f16d","date":"2026-10-03T12:43:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b74aad23d99b279bb34d135795f39a6d8ecdc075","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/b74aad23d99b279bb34d135795f39a6d8ecdc075.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98509","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98509.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98508","title":"drm/virtio: fix NULL pointer dereference on fence allocation failure","status":"backported","project":false,"upstream":[{"sha":"846b3c64fe3e77d9db20a7e3e62dbbb637c773e1","url":"https://git.kernel.org/stable/c/846b3c64fe3e77d9db20a7e3e62dbbb637c773e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ecced0076b700b5896e52af10d0776be8be36b0d","label":"ecced0076b70","date":"2026-10-03T12:43:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"846b3c64fe3e77d9db20a7e3e62dbbb637c773e1","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/846b3c64fe3e77d9db20a7e3e62dbbb637c773e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98508","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98508.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98506","title":"mm/hugetlb: do not dissolve gigantic pages without runtime support","status":"backported","project":false,"upstream":[{"sha":"a363c62a653cc8b3e21da9545fa4e028ef50f9c3","url":"https://git.kernel.org/stable/c/a363c62a653cc8b3e21da9545fa4e028ef50f9c3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/443628f755b35bf45044f68b970b65cd531c42fd","label":"443628f755b3","date":"2026-10-03T12:43:04+02:00","lore":["https://lore.kernel.org/20260823044118.1097121-2-xialonglong2025@163.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a363c62a653cc8b3e21da9545fa4e028ef50f9c3","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/a363c62a653cc8b3e21da9545fa4e028ef50f9c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98506","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98506.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98505","title":"mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()","status":"backported","project":false,"upstream":[{"sha":"39c0ceedd54557bdc1542de08d22b2ed33e534e4","url":"https://git.kernel.org/stable/c/39c0ceedd54557bdc1542de08d22b2ed33e534e4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6e74ffc9ecf6ec24eee117150da78a1102be74c5","label":"6e74ffc9ecf6","date":"2026-10-03T12:43:05+02:00","lore":["https://lore.kernel.org/20260830160545.98969-1-sj@kernel.org","https://lore.kernel.org/20260907170358.100168-1-sj@kernel.org"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"39c0ceedd54557bdc1542de08d22b2ed33e534e4","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/39c0ceedd54557bdc1542de08d22b2ed33e534e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98505","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98505.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98503","title":"packet: use ubuf_info completion for TX_RING packets","status":"backported","project":false,"upstream":[{"sha":"9518405613863d0bf0700927a21367f5942cf058","url":"https://git.kernel.org/stable/c/9518405613863d0bf0700927a21367f5942cf058"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2a0c9afefc0ecea2cc30ccfbbbc98182a0986191","label":"2a0c9afefc0e","date":"2026-10-03T12:43:05+02:00","lore":["https://lore.kernel.org/netdev/20260909085542.3370986-1-doebel@amazon.de/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"9518405613863d0bf0700927a21367f5942cf058","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/9518405613863d0bf0700927a21367f5942cf058.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98503","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98503.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98473","title":"s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config","status":"backported","project":false,"upstream":[{"sha":"65e05ec252a9b79e75930d3c4dd42d8877db04c5","url":"https://git.kernel.org/stable/c/65e05ec252a9b79e75930d3c4dd42d8877db04c5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3c3433657c82f200dae36c29e2b80681c81b85be","label":"3c3433657c82","date":"2026-10-03T12:43:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"65e05ec252a9b79e75930d3c4dd42d8877db04c5","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/65e05ec252a9b79e75930d3c4dd42d8877db04c5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98473","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98473.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98471","title":"KVM: SEV: Do cache maintenance on the source VM during intra-host migration","status":"backported","project":false,"upstream":[{"sha":"93de2a6a4b91b72607136dd656edf03fb399d27f","url":"https://git.kernel.org/stable/c/93de2a6a4b91b72607136dd656edf03fb399d27f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d4cc2dff12116a700add601c0262132cc26e1b2c","label":"d4cc2dff1211","date":"2026-10-03T12:43:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"93de2a6a4b91b72607136dd656edf03fb399d27f","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/93de2a6a4b91b72607136dd656edf03fb399d27f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98471","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98471.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98466","title":"KVM: arm64: Transfer the hyp stack pages out of the host stage-2","status":"backported","project":false,"upstream":[{"sha":"3a8c562892b96f35bba1e00d5e455a15963bbb92","url":"https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92"}],"evidence":[{"url":"https://git.kernel.org/stable/c/22df195bff84300a3f04813d6148765c77ac565a","label":"22df195bff84","date":"2026-10-03T12:43:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a8c562892b96f35bba1e00d5e455a15963bbb92","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/3a8c562892b96f35bba1e00d5e455a15963bbb92.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98466","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98466.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98458","title":"Bluetooth: ISO: release unused CIS holds after channel attach","status":"backported","project":false,"upstream":[{"sha":"0fcd4dad555c96e0bd3a1b8c569f989be85c7341","url":"https://git.kernel.org/stable/c/0fcd4dad555c96e0bd3a1b8c569f989be85c7341"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e5fcca51177f224604e3a8c926ffd5edbeb58b09","label":"e5fcca51177f","date":"2026-10-03T12:43:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fcd4dad555c96e0bd3a1b8c569f989be85c7341","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/0fcd4dad555c96e0bd3a1b8c569f989be85c7341.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98458","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98458.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98452","title":"smb: client: clean up failed cached directory opens","status":"backported","project":false,"upstream":[{"sha":"d2ff5fb93ea83034025850266b5eed391f96b825","url":"https://git.kernel.org/stable/c/d2ff5fb93ea83034025850266b5eed391f96b825"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7c1509598a4fdfb54cb09ce33e4405bd6dbd8295","label":"7c1509598a4f","date":"2026-10-03T12:43:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2ff5fb93ea83034025850266b5eed391f96b825","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/d2ff5fb93ea83034025850266b5eed391f96b825.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98452","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98452.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98449","title":"smb: client: delete compound mids on send failure before unlock","status":"backported","project":false,"upstream":[{"sha":"8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9","url":"https://git.kernel.org/stable/c/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/70783946f3b5d0c06ec7df0f5e7bec2bfad24efb","label":"70783946f3b5","date":"2026-10-03T12:43:12+02:00","lore":["https://lore.kernel.org/r/6a727d22.40259c87.584f4.04ce.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98444","title":"xfs: drop dquot flush lock when we can't find a buffer to flush","status":"backported","project":false,"upstream":[{"sha":"ffb48dccce1960a9ea24463a2f3c21d124d6b672","url":"https://git.kernel.org/stable/c/ffb48dccce1960a9ea24463a2f3c21d124d6b672"}],"evidence":[{"url":"https://git.kernel.org/stable/c/41bc624377f08125eae164c62ce043791ade93b7","label":"41bc624377f0","date":"2026-10-03T12:43:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ffb48dccce1960a9ea24463a2f3c21d124d6b672","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/ffb48dccce1960a9ea24463a2f3c21d124d6b672.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98444","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98444.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98439","title":"smb/server: cancel async requests when closing connection","status":"backported","project":false,"upstream":[{"sha":"4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851","url":"https://git.kernel.org/stable/c/4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0947087678f465b64eba2acebe808d5c6cfea036","label":"0947087678f4","date":"2026-09-21T15:08:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98439","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98439.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98436","title":"accel/amdxdna: Disable device buffer exporting","status":"backported","project":false,"upstream":[{"sha":"9480dd7ec3fcadd4217503e4bb32c16e19e4b21f","url":"https://git.kernel.org/stable/c/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/33b00fa8023e8ade3409aa9c833b8ce65b8c29eb","label":"33b00fa8023e","date":"2026-09-21T15:08:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9480dd7ec3fcadd4217503e4bb32c16e19e4b21f","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/9480dd7ec3fcadd4217503e4bb32c16e19e4b21f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98436","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98436.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98435","title":"EDAC/altera: Use parent device for devres in altr_portb_setup()","status":"backported","project":false,"upstream":[{"sha":"9868f5c077dfe0b606331f2e782484f91a5789a5","url":"https://git.kernel.org/stable/c/9868f5c077dfe0b606331f2e782484f91a5789a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/dc4797c909b6cacb1bb24449e6c57d50a14d73bf","label":"dc4797c909b6","date":"2026-09-21T15:08:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9868f5c077dfe0b606331f2e782484f91a5789a5","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/9868f5c077dfe0b606331f2e782484f91a5789a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98435","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98435.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98431","title":"RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency","status":"backported","project":false,"upstream":[{"sha":"a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","url":"https://git.kernel.org/stable/c/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236"}],"evidence":[{"url":"https://git.kernel.org/stable/c/426f54f20b79c5b164a0472ad3f6ba36afcd08c6","label":"426f54f20b79","date":"2026-09-25T16:36:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98431","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98431.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98427","title":"net/sched: codel: bound the dropping loop per dequeue call","status":"backported","project":false,"upstream":[{"sha":"7f4a5ec6258fd7c92633ec4b0493fc51166d9398","url":"https://git.kernel.org/stable/c/7f4a5ec6258fd7c92633ec4b0493fc51166d9398"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bacd72289d34d8c05b7de5a12448b87b6dd93878","label":"bacd72289d34","date":"2026-09-25T16:36:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f4a5ec6258fd7c92633ec4b0493fc51166d9398","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7f4a5ec6258fd7c92633ec4b0493fc51166d9398.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98427","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98427.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98425","title":"wifi: mac80211: don't warn when an IBSS has no channel to scan","status":"backported","project":false,"upstream":[{"sha":"a7491b7efbd9136b120a12ed72af9c12121dd134","url":"https://git.kernel.org/stable/c/a7491b7efbd9136b120a12ed72af9c12121dd134"}],"evidence":[{"url":"https://git.kernel.org/stable/c/23d51c0bc18f21d957756ba4650520bb3bc726b2","label":"23d51c0bc18f","date":"2026-09-25T16:36:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a7491b7efbd9136b120a12ed72af9c12121dd134","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/a7491b7efbd9136b120a12ed72af9c12121dd134.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98425","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98425.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98424","title":"wifi: cfg80211: undo netns switch if renaming the wiphy fails","status":"backported","project":false,"upstream":[{"sha":"a41bd1938a9bfe226d444172a7e20e4bd5097960","url":"https://git.kernel.org/stable/c/a41bd1938a9bfe226d444172a7e20e4bd5097960"}],"evidence":[{"url":"https://git.kernel.org/stable/c/739b7bf3942da4cde8eedb143d01a16ed865d1d7","label":"739b7bf3942d","date":"2026-09-25T16:36:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"a41bd1938a9bfe226d444172a7e20e4bd5097960","lines":117,"reason":"","source":"https://github.com/torvalds/linux/commit/a41bd1938a9bfe226d444172a7e20e4bd5097960.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98420","title":"ksmbd: follow SMB2 session expiration semantics","status":"backported","project":false,"upstream":[{"sha":"d7fd1f98607f2cd358e583f9548bdf0173090a86","url":"https://git.kernel.org/stable/c/d7fd1f98607f2cd358e583f9548bdf0173090a86"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c99ea7855124ca1428a1e59c2b4590aaef34eacf","label":"c99ea7855124","date":"2026-09-25T16:36:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d7fd1f98607f2cd358e583f9548bdf0173090a86","lines":441,"reason":"","source":"https://github.com/torvalds/linux/commit/d7fd1f98607f2cd358e583f9548bdf0173090a86.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98420","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98420.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98408","title":"watchdog: rzv2h: Avoid division by zero","status":"backported","project":false,"upstream":[{"sha":"6274281c41efa8dd1aa5234c59ad904ff89d7af4","url":"https://git.kernel.org/stable/c/6274281c41efa8dd1aa5234c59ad904ff89d7af4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0dd78d9d9b546de08e2ae391541f48cea0a9b842","label":"0dd78d9d9b54","date":"2026-09-25T16:37:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6274281c41efa8dd1aa5234c59ad904ff89d7af4","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/6274281c41efa8dd1aa5234c59ad904ff89d7af4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98408","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98408.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98403","title":"s390/boot: Avoid IPL parameter append past command line","status":"backported","project":false,"upstream":[{"sha":"d76181dfabdaa720703167393704efacba343442","url":"https://git.kernel.org/stable/c/d76181dfabdaa720703167393704efacba343442"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8d11bfec8666f8409fac9072e9c25b691d3e30ac","label":"8d11bfec8666","date":"2026-09-21T15:08:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d76181dfabdaa720703167393704efacba343442","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/d76181dfabdaa720703167393704efacba343442.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98403","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98403.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98401","title":"net: iptunnel: fix stale transport header during tunnel decapsulation","status":"backported","project":false,"upstream":[{"sha":"28a57fb2c5df4deb42a06e52fd36c14b37aa0034","url":"https://git.kernel.org/stable/c/28a57fb2c5df4deb42a06e52fd36c14b37aa0034"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3340b8565b85631cfeb0df049e8b46e3ef8bd7bd","label":"3340b8565b85","date":"2026-09-21T15:08:01+02:00","lore":["https://lore.kernel.org/all/69de2bee.a00a0220.475f0.0041.GAE@google.com/T/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"28a57fb2c5df4deb42a06e52fd36c14b37aa0034","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/28a57fb2c5df4deb42a06e52fd36c14b37aa0034.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98401","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98401.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98400","title":"s390/ipl: Fix NULL deref in kdump without re-IPL parm block","status":"backported","project":false,"upstream":[{"sha":"7f918871112e8e7c581e99eb8e545af4e59c8367","url":"https://git.kernel.org/stable/c/7f918871112e8e7c581e99eb8e545af4e59c8367"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd","label":"b6bf82bc5e00","date":"2026-09-21T15:08:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7f918871112e8e7c581e99eb8e545af4e59c8367","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7f918871112e8e7c581e99eb8e545af4e59c8367.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98400.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98399","title":"s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block","status":"backported","project":false,"upstream":[{"sha":"37f61b71cbc0caefc01022a19ee56fc2510e2e6e","url":"https://git.kernel.org/stable/c/37f61b71cbc0caefc01022a19ee56fc2510e2e6e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/280ff19853440d59e031cd8fe161e81305721262","label":"280ff1985344","date":"2026-09-21T15:08:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"37f61b71cbc0caefc01022a19ee56fc2510e2e6e","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/37f61b71cbc0caefc01022a19ee56fc2510e2e6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98399","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98399.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98394","title":"af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.","status":"backported","project":false,"upstream":[{"sha":"6e5ee08eb5858d175da6768d75d163817b6a9d4a","url":"https://git.kernel.org/stable/c/6e5ee08eb5858d175da6768d75d163817b6a9d4a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c81c5be3826c8467945b964d0cf7f7b3d65461db","label":"c81c5be3826c","date":"2026-09-21T15:08:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6e5ee08eb5858d175da6768d75d163817b6a9d4a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/6e5ee08eb5858d175da6768d75d163817b6a9d4a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98394","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98394.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98393","title":"net: ipv4: Fix UDP length overflow with PMTU discover and big MTU","status":"backported","project":false,"upstream":[{"sha":"b83641e0ab8b20eefcc4cdc5a059f897375291a2","url":"https://git.kernel.org/stable/c/b83641e0ab8b20eefcc4cdc5a059f897375291a2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/81f540827d243b8dad76c1f44e70ea31719f393c","label":"81f540827d24","date":"2026-09-21T15:08:27+02:00","lore":["https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b83641e0ab8b20eefcc4cdc5a059f897375291a2","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b83641e0ab8b20eefcc4cdc5a059f897375291a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98393","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98393.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98387","title":"s390/crypto: Fix skcipher_walk return code handling in aes_s390","status":"backported","project":false,"upstream":[{"sha":"15fa028589c3a2545f0bff355eff06d5844196bf","url":"https://git.kernel.org/stable/c/15fa028589c3a2545f0bff355eff06d5844196bf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aea3e1588f08e381a7a57b2bf1a60cc2347904cd","label":"aea3e1588f08","date":"2026-09-21T15:08:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"15fa028589c3a2545f0bff355eff06d5844196bf","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/15fa028589c3a2545f0bff355eff06d5844196bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98387","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98387.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98376","title":"bpf: Use array_map_meta_equal for percpu array inner map replacement","status":"backported","project":false,"upstream":[{"sha":"593980175389a05793f6060aa20e626330960395","url":"https://git.kernel.org/stable/c/593980175389a05793f6060aa20e626330960395"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"593980175389a05793f6060aa20e626330960395","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/593980175389a05793f6060aa20e626330960395.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98376","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98376.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98365","title":"RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access","status":"backported","project":false,"upstream":[{"sha":"d10e2a08799e858d3e71ea4169bcd018f216d444","url":"https://git.kernel.org/stable/c/d10e2a08799e858d3e71ea4169bcd018f216d444"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3431f525718f6b07da308cda6d44f8cb548bbd37","label":"3431f525718f","date":"2026-09-25T16:36:44+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d10e2a08799e858d3e71ea4169bcd018f216d444","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d10e2a08799e858d3e71ea4169bcd018f216d444.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98365","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98365.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98364","title":"xfrm: hold net_device reference under RCU in bundle creation","status":"backported","project":false,"upstream":[{"sha":"9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","url":"https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807","label":"8d85d6bc9c46","date":"2026-09-25T16:36:44+02:00","lore":["https://lore.kernel.org/all/20260820200245.44312-1-blbllhy@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98364","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98364.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98355","title":"RDMA/rtrs: guard against null kobj name","status":"backported","project":false,"upstream":[{"sha":"99c24a8968ebef0573825b5cb89d5985d51635b9","url":"https://git.kernel.org/stable/c/99c24a8968ebef0573825b5cb89d5985d51635b9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f79cf42ff23f9120246cd6740eaa26f59c632a4a","label":"f79cf42ff23f","date":"2026-09-25T16:36:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"99c24a8968ebef0573825b5cb89d5985d51635b9","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/99c24a8968ebef0573825b5cb89d5985d51635b9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98353","title":"RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables","status":"backported","project":false,"upstream":[{"sha":"00baeade709fb66da647e8327e8398bb532e30f7","url":"https://git.kernel.org/stable/c/00baeade709fb66da647e8327e8398bb532e30f7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/74d4085221a7ec5440996af199ccadfa75b9eb0e","label":"74d4085221a7","date":"2026-09-25T16:36:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"00baeade709fb66da647e8327e8398bb532e30f7","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/00baeade709fb66da647e8327e8398bb532e30f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98353","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98353.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98341","title":"wifi: cfg80211: don't free driver-owned scan requests","status":"backported","project":false,"upstream":[{"sha":"dab68a74e90b8e07f08ed9deaa5884857a3cfe89","url":"https://git.kernel.org/stable/c/dab68a74e90b8e07f08ed9deaa5884857a3cfe89"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cf6da29d17994865f73ca70976495ea856909c63","label":"cf6da29d1799","date":"2026-09-25T16:36:47+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"dab68a74e90b8e07f08ed9deaa5884857a3cfe89","lines":100,"reason":"","source":"https://github.com/torvalds/linux/commit/dab68a74e90b8e07f08ed9deaa5884857a3cfe89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98341","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98341.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98338","title":"wifi: cfg80211: ibss: ref BSS entry for joined event","status":"backported","project":false,"upstream":[{"sha":"708f9d43d6a2eb9c6b83fe62af628de9dffd9314","url":"https://git.kernel.org/stable/c/708f9d43d6a2eb9c6b83fe62af628de9dffd9314"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b0e3f019e461ac42e45aa3ec1216cefaca2f4a8b","label":"b0e3f019e461","date":"2026-09-25T16:36:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"708f9d43d6a2eb9c6b83fe62af628de9dffd9314","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/708f9d43d6a2eb9c6b83fe62af628de9dffd9314.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98338","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98338.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98337","title":"wifi: mac80211: don't start a ROC while scanning","status":"backported","project":false,"upstream":[{"sha":"733f0fde95392ed5f61a4e36aee661ea8d0e8581","url":"https://git.kernel.org/stable/c/733f0fde95392ed5f61a4e36aee661ea8d0e8581"}],"evidence":[{"url":"https://git.kernel.org/stable/c/58b806f699052c572dec6cab2c376f884f27e98f","label":"58b806f69905","date":"2026-09-25T16:36:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"733f0fde95392ed5f61a4e36aee661ea8d0e8581","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/733f0fde95392ed5f61a4e36aee661ea8d0e8581.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98335","title":"wifi: mac80211: abort chanswitch when leaving a mesh","status":"backported","project":false,"upstream":[{"sha":"ac7472a24bd433b81c06582835dd1d5547c10da9","url":"https://git.kernel.org/stable/c/ac7472a24bd433b81c06582835dd1d5547c10da9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d222fdc973bb8dbf0357772bd9042ffdc8291939","label":"d222fdc973bb","date":"2026-09-25T16:36:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac7472a24bd433b81c06582835dd1d5547c10da9","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/ac7472a24bd433b81c06582835dd1d5547c10da9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98335","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98335.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98334","title":"wifi: mac80211: reset state when starting AP fails","status":"backported","project":false,"upstream":[{"sha":"3f28551d0241254a75626d868041c6340285088b","url":"https://git.kernel.org/stable/c/3f28551d0241254a75626d868041c6340285088b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6eac225f59c1c2277ac74f8a716d6df0ba3b8d28","label":"6eac225f59c1","date":"2026-09-25T16:36:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f28551d0241254a75626d868041c6340285088b","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/3f28551d0241254a75626d868041c6340285088b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98333","title":"wifi: mac80211: reset the LED state when ifup fails","status":"backported","project":false,"upstream":[{"sha":"78183e8331958fda11cd2b6850bb424a9747c4b2","url":"https://git.kernel.org/stable/c/78183e8331958fda11cd2b6850bb424a9747c4b2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/de6f9561db572df86d65c05545eb2397313bb8a5","label":"de6f9561db57","date":"2026-09-25T16:36:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"78183e8331958fda11cd2b6850bb424a9747c4b2","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/78183e8331958fda11cd2b6850bb424a9747c4b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98332","title":"wifi: mac80211: only operate on TDLS peers in the TDLS code","status":"backported","project":false,"upstream":[{"sha":"6f0a100df8539ce90f37c14e1945f396ca2410bc","url":"https://git.kernel.org/stable/c/6f0a100df8539ce90f37c14e1945f396ca2410bc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0cd452ccaa5c5971440256ce72c64611eca176c1","label":"0cd452ccaa5c","date":"2026-09-25T16:36:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f0a100df8539ce90f37c14e1945f396ca2410bc","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/6f0a100df8539ce90f37c14e1945f396ca2410bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98332","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98332.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98330","title":"wifi: cfg80211: get the wiphy out of a dying network namespace","status":"backported","project":false,"upstream":[{"sha":"4635b1a1c1d693178a537446a6e09963f0fdae52","url":"https://git.kernel.org/stable/c/4635b1a1c1d693178a537446a6e09963f0fdae52"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b949b2720688691f1e41bdbfbe3df2b6dc77c34d","label":"b949b2720688","date":"2026-09-25T16:36:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4635b1a1c1d693178a537446a6e09963f0fdae52","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/4635b1a1c1d693178a537446a6e09963f0fdae52.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98330","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98330.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98329","title":"wifi: mac80211: don't allow injecting frames wider than the chanctx","status":"backported","project":false,"upstream":[{"sha":"e14bf37bb2b3853012ff160131d1c6233f7a9cc9","url":"https://git.kernel.org/stable/c/e14bf37bb2b3853012ff160131d1c6233f7a9cc9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c69718519a81e87284494d0c6e6eb7bdd834707a","label":"c69718519a81","date":"2026-09-25T16:36:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e14bf37bb2b3853012ff160131d1c6233f7a9cc9","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/e14bf37bb2b3853012ff160131d1c6233f7a9cc9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98329","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98329.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98327","title":"wifi: mac80211: mesh: reset the CSA state when leaving","status":"backported","project":false,"upstream":[{"sha":"860134b3af77970e006feab7e5decb8c84771c7f","url":"https://git.kernel.org/stable/c/860134b3af77970e006feab7e5decb8c84771c7f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ba5bf83a81e8832cb84bb3a2da67512f81f57a02","label":"ba5bf83a81e8","date":"2026-09-25T16:36:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"860134b3af77970e006feab7e5decb8c84771c7f","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/860134b3af77970e006feab7e5decb8c84771c7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98327","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98327.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98321","title":"netfilter: nf_nat: unregister and release hooks on error","status":"backported","project":false,"upstream":[{"sha":"cbdd39ce42530a193c56beb206a3356cb6d01016","url":"https://git.kernel.org/stable/c/cbdd39ce42530a193c56beb206a3356cb6d01016"}],"evidence":[{"url":"https://git.kernel.org/stable/c/df80342f4bfc023ad7d6703df5e27f583ff0cb8d","label":"df80342f4bfc","date":"2026-09-25T16:36:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cbdd39ce42530a193c56beb206a3356cb6d01016","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/cbdd39ce42530a193c56beb206a3356cb6d01016.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98321","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98321.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98318","title":"smb: client: validate absolute native symlink targets before NT fixups","status":"backported","project":false,"upstream":[{"sha":"23c240d9509e15f72e4112fc95f0160ab32ec430","url":"https://git.kernel.org/stable/c/23c240d9509e15f72e4112fc95f0160ab32ec430"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6913ff607c2bc8694193e1fcc40bf16d75f35f16","label":"6913ff607c2b","date":"2026-09-25T16:36:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"23c240d9509e15f72e4112fc95f0160ab32ec430","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/23c240d9509e15f72e4112fc95f0160ab32ec430.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98318","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98318.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98317","title":"neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.","status":"backported","project":false,"upstream":[{"sha":"6d79b223ec44ada58ad37db42f539b60985a7722","url":"https://git.kernel.org/stable/c/6d79b223ec44ada58ad37db42f539b60985a7722"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8550b50e49b01b572e653e572f24ddd73949aa74","label":"8550b50e49b0","date":"2026-09-25T16:36:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6d79b223ec44ada58ad37db42f539b60985a7722","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/6d79b223ec44ada58ad37db42f539b60985a7722.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98313","title":"drm/msm/dp: skip PUSH_IDLE when the link was never enabled","status":"backported","project":false,"upstream":[{"sha":"e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","url":"https://git.kernel.org/stable/c/e249a6e2a130c08bb4d8b0a55cbe29754307e5c9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5e97d117b79c3ce89542369ef697be64850de8ad","label":"5e97d117b79c","date":"2026-09-25T16:36:52+02:00","lore":["https://lore.kernel.org/r/20260808171325.133041-1-jesse.casco@gmail.com"]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/e249a6e2a130c08bb4d8b0a55cbe29754307e5c9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98309","title":"drm/vc4: Use managed KMS polling to fix UAF on unbind","status":"backported","project":false,"upstream":[{"sha":"073a30d75f309812ed61af134f24ffef4107b13a","url":"https://git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7f9780df677370a19b4ec9764f13b1b82073e0d9","label":"7f9780df6773","date":"2026-09-25T16:36:53+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"073a30d75f309812ed61af134f24ffef4107b13a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/073a30d75f309812ed61af134f24ffef4107b13a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98309","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98309.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98307","title":"wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()","status":"backported","project":false,"upstream":[{"sha":"820b8cff81c796ba20573e04722ab62500713f97","url":"https://git.kernel.org/stable/c/820b8cff81c796ba20573e04722ab62500713f97"}],"evidence":[{"url":"https://git.kernel.org/stable/c/be1d5e95ec499ed5ee9704aa27dd1407ccf0d0ac","label":"be1d5e95ec49","date":"2026-09-25T16:36:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"820b8cff81c796ba20573e04722ab62500713f97","lines":49,"reason":"","source":"https://github.com/torvalds/linux/commit/820b8cff81c796ba20573e04722ab62500713f97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98307","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98307.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98304","title":"net: bcmgenet: restore the hardware filters on open","status":"backported","project":false,"upstream":[{"sha":"23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","url":"https://git.kernel.org/stable/c/23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/906140955c8debde65afe12e594e04c49a61b0d9","label":"906140955c8d","date":"2026-09-25T16:36:54+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98304","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98304.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98297","title":"Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained","status":"backported","project":false,"upstream":[{"sha":"6610c6fe4b8936c232048e6049bf77c70a6f759c","url":"https://git.kernel.org/stable/c/6610c6fe4b8936c232048e6049bf77c70a6f759c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cbb325bc150e8c0dbce004ac0e5516bcffc0de31","label":"cbb325bc150e","date":"2026-09-25T16:36:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6610c6fe4b8936c232048e6049bf77c70a6f759c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98297","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98297.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98296","title":"Bluetooth: btintel_pcie: validate TX skb length in send_sync","status":"backported","project":false,"upstream":[{"sha":"4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","url":"https://git.kernel.org/stable/c/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c298a61e18029401486c40298a50fbeea7e7b663","label":"c298a61e1802","date":"2026-09-25T16:36:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98296","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98296.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98295","title":"Bluetooth: coredump: Quiesce dump work on unregister","status":"backported","project":false,"upstream":[{"sha":"d236517c264e41dc09833c708ef23bccb7a91219","url":"https://git.kernel.org/stable/c/d236517c264e41dc09833c708ef23bccb7a91219"}],"evidence":[{"url":"https://git.kernel.org/stable/c/82699d1b727ba5980b94f1eb8dc3d346f41b7c67","label":"82699d1b727b","date":"2026-09-25T16:36:55+02:00","lore":["https://lore.kernel.org/r/20260322210849.68743-1-abysamross@gmail.com","https://lore.kernel.org/r/20260814231248.3096377-1-tristmd@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d236517c264e41dc09833c708ef23bccb7a91219","lines":128,"reason":"","source":"https://github.com/torvalds/linux/commit/d236517c264e41dc09833c708ef23bccb7a91219.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98295","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98295.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98294","title":"Bluetooth: hci_qca: Do not write to the serial port after it is closed","status":"backported","project":false,"upstream":[{"sha":"4e93c65f87825e1e012bce56615320aeb123815d","url":"https://git.kernel.org/stable/c/4e93c65f87825e1e012bce56615320aeb123815d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/15754e4ec47ac5d117c9609c34a49ed6980ac4a1","label":"15754e4ec47a","date":"2026-09-25T16:36:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4e93c65f87825e1e012bce56615320aeb123815d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/4e93c65f87825e1e012bce56615320aeb123815d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98294","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98294.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98292","title":"Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access","status":"backported","project":false,"upstream":[{"sha":"8879e3e0a84a86954c855caceead4867e74a9a27","url":"https://git.kernel.org/stable/c/8879e3e0a84a86954c855caceead4867e74a9a27"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5a5cfd8488c97e1b8939515429fe4c81e9f2df4f","label":"5a5cfd8488c9","date":"2026-09-25T16:36:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8879e3e0a84a86954c855caceead4867e74a9a27","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/8879e3e0a84a86954c855caceead4867e74a9a27.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98292","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98292.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98289","title":"af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().","status":"backported","project":false,"upstream":[{"sha":"4a4263dfeabad72f95e8ab6e15146861fa4144dd","url":"https://git.kernel.org/stable/c/4a4263dfeabad72f95e8ab6e15146861fa4144dd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/be550ee108ad80828aa61280400bedfc7e7c39d3","label":"be550ee108ad","date":"2026-09-25T16:36:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4a4263dfeabad72f95e8ab6e15146861fa4144dd","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/4a4263dfeabad72f95e8ab6e15146861fa4144dd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98288","title":"net: stmmac: fix TSO header length truncation","status":"backported","project":false,"upstream":[{"sha":"15989abd74f16f44bf953d056b95f1d2fda9b0cd","url":"https://git.kernel.org/stable/c/15989abd74f16f44bf953d056b95f1d2fda9b0cd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bcf6013c2b4d732c6e4bf4d0f6ae4a18d63d414b","label":"bcf6013c2b4d","date":"2026-09-25T16:36:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"15989abd74f16f44bf953d056b95f1d2fda9b0cd","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/15989abd74f16f44bf953d056b95f1d2fda9b0cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98286","title":"drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown","status":"backported","project":false,"upstream":[{"sha":"c391a40f71886b28c082b47270f0e856fa3e1150","url":"https://git.kernel.org/stable/c/c391a40f71886b28c082b47270f0e856fa3e1150"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bda4d9525fb91a2388ee09669421b8d505290864","label":"bda4d9525fb9","date":"2026-09-25T16:36:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c391a40f71886b28c082b47270f0e856fa3e1150","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/c391a40f71886b28c082b47270f0e856fa3e1150.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98286","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98286.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98285","title":"net: bridge: vlan: fix bugs caused by switchdev deletion errors","status":"backported","project":false,"upstream":[{"sha":"2842ce397dd09882530b42f7fdb0c855767eb24e","url":"https://git.kernel.org/stable/c/2842ce397dd09882530b42f7fdb0c855767eb24e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ed3ea86db736a30bebf49b947c42730e8451bcd2","label":"ed3ea86db736","date":"2026-09-25T16:36:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2842ce397dd09882530b42f7fdb0c855767eb24e","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/2842ce397dd09882530b42f7fdb0c855767eb24e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98285","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98285.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98284","title":"netlink: do not free nlk->groups while lockless readers can use it","status":"backported","project":false,"upstream":[{"sha":"ceac0de741bfb47ca255eee075257b3bb31f0651","url":"https://git.kernel.org/stable/c/ceac0de741bfb47ca255eee075257b3bb31f0651"}],"evidence":[{"url":"https://git.kernel.org/stable/c/22f313e211d58a66786c81487c3905fa5d4b2a8f","label":"22f313e211d5","date":"2026-09-25T16:36:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ceac0de741bfb47ca255eee075257b3bb31f0651","lines":101,"reason":"","source":"https://github.com/torvalds/linux/commit/ceac0de741bfb47ca255eee075257b3bb31f0651.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98284","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98284.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98279","title":"btrfs: handle lack of space when cleaning up verity items","status":"backported","project":false,"upstream":[{"sha":"76bf149cd0298544631e756670b89c399c7acbca","url":"https://git.kernel.org/stable/c/76bf149cd0298544631e756670b89c399c7acbca"}],"evidence":[{"url":"https://git.kernel.org/stable/c/efa5780b84f066f419a667f6b9542368b2f62074","label":"efa5780b84f0","date":"2026-09-25T16:36:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"76bf149cd0298544631e756670b89c399c7acbca","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/76bf149cd0298544631e756670b89c399c7acbca.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98279","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98279.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98277","title":"eth: fbnic: ring the doorbell if a burst ends in a drop","status":"backported","project":false,"upstream":[{"sha":"490599ab23134962a6d18a024e84541d77bdb999","url":"https://git.kernel.org/stable/c/490599ab23134962a6d18a024e84541d77bdb999"}],"evidence":[{"url":"https://git.kernel.org/stable/c/28fb764d670aa22dcbd2a02fd8fd87ae8d3563a9","label":"28fb764d670a","date":"2026-09-25T16:36:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"490599ab23134962a6d18a024e84541d77bdb999","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/490599ab23134962a6d18a024e84541d77bdb999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98277","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98277.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98273","title":"x86/kprobes: Fix crash when probing CS CALL instructions","status":"backported","project":false,"upstream":[{"sha":"a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","url":"https://git.kernel.org/stable/c/a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d8c6a18c0552135cbf0c696c9019b2979d0862c9","label":"d8c6a18c0552","date":"2026-09-25T16:36:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","lines":47,"reason":"","source":"https://github.com/torvalds/linux/commit/a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98273","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98273.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98271","title":"net: skbuff: do not leave stale header offsets after pskb_carve()","status":"backported","project":false,"upstream":[{"sha":"a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","url":"https://git.kernel.org/stable/c/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309"}],"evidence":[{"url":"https://git.kernel.org/stable/c/12929ed66a5166177ef5f06d3da81e4f99993e90","label":"12929ed66a51","date":"2026-09-25T16:36:59+02:00","lore":["https://lore.kernel.org/netdev/6aa3e9d3.f2639fcc.29487d.0028.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98271","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98271.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98269","title":"btrfs: abort transaction on failure to update inode for hole punching and reflinking","status":"backported","project":false,"upstream":[{"sha":"97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","url":"https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/36c68dc909845c049e0286d229bc502947239452","label":"36c68dc90984","date":"2026-09-25T16:36:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98269","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98269.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98266","title":"ALSA: core: Fix potential UAF after asynchronous card release","status":"backported","project":false,"upstream":[{"sha":"fd95e68df6fe66344161a1329cbe5e5805e7b704","url":"https://git.kernel.org/stable/c/fd95e68df6fe66344161a1329cbe5e5805e7b704"}],"evidence":[{"url":"https://git.kernel.org/stable/c/398b21608955c9712a012355b69a39407367edc9","label":"398b21608955","date":"2026-09-25T16:37:00+02:00","lore":["https://lore.kernel.org/CA+0ovCgQUQNN=Z1tJTouiCsDaXR5M-3-SQEGk-cpPXQkM5Xh+w@mail.gmail.com","https://lore.kernel.org/CA+0ovChexj4TrZL_2iG_P0WBEbZc5+73GfB3DkciQi=R8pZOnA@mail.gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd95e68df6fe66344161a1329cbe5e5805e7b704","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/fd95e68df6fe66344161a1329cbe5e5805e7b704.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98266","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98266.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98254","title":"swiotlb: use the adjusted address for the highmem page lookup","status":"backported","project":false,"upstream":[{"sha":"b7d7914a9ae3097e63d113007e4fb44d33d515b1","url":"https://git.kernel.org/stable/c/b7d7914a9ae3097e63d113007e4fb44d33d515b1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0219b72f5c209732b2f03a8cc0d7240b5e428a99","label":"0219b72f5c20","date":"2026-09-25T16:37:01+02:00","lore":["https://lore.kernel.org/r/20260905084210.148255-1-donggeunyoo.kernel@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b7d7914a9ae3097e63d113007e4fb44d33d515b1","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/b7d7914a9ae3097e63d113007e4fb44d33d515b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98254","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98254.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98248","title":"arm64: percpu: Fix LSE operations on {8,16}-bit types","status":"backported","project":false,"upstream":[{"sha":"8cf2093f5372952a9ebc805c418d45df7112cd14","url":"https://git.kernel.org/stable/c/8cf2093f5372952a9ebc805c418d45df7112cd14"}],"evidence":[{"url":"https://git.kernel.org/stable/c/843ace1d0a39e9b1cfcbfb3856a7b0fbdd9cd003","label":"843ace1d0a39","date":"2026-09-25T16:37:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8cf2093f5372952a9ebc805c418d45df7112cd14","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/8cf2093f5372952a9ebc805c418d45df7112cd14.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98248","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98248.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98229","title":"xfrm: save input state data before secpath resets","status":"backported","project":false,"upstream":[{"sha":"3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","url":"https://git.kernel.org/stable/c/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa"}],"evidence":[{"url":"https://git.kernel.org/stable/c/537a5ae18b2be70f8eb0aca843682e81a69aab91","label":"537a5ae18b2b","date":"2026-09-25T16:37:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98229","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98229.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98228","title":"mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ","status":"backported","project":false,"upstream":[{"sha":"bbc448c541ed90d52f9ec22f17394304e3bf170e","url":"https://git.kernel.org/stable/c/bbc448c541ed90d52f9ec22f17394304e3bf170e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3f017c2ca8c31a1e135dd87be647096866d6b196","label":"3f017c2ca8c3","date":"2026-09-25T16:37:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bbc448c541ed90d52f9ec22f17394304e3bf170e","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/bbc448c541ed90d52f9ec22f17394304e3bf170e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98228","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98228.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98222","title":"KEYS: encrypted: fix integer overflow of datablob_len","status":"backported","project":false,"upstream":[{"sha":"8697c431e297eb0d0ab13dda6bc172b48a34f05c","url":"https://git.kernel.org/stable/c/8697c431e297eb0d0ab13dda6bc172b48a34f05c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cca38f2102a4cd35eda8d48950df4817b4b24757","label":"cca38f2102a4","date":"2026-09-25T16:37:06+02:00","lore":["https://lore.kernel.org/r/20260909153433.83117-1-cenzhang@linux.microsoft.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8697c431e297eb0d0ab13dda6bc172b48a34f05c","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/8697c431e297eb0d0ab13dda6bc172b48a34f05c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98222","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98222.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98212","title":"mmc: hsq: Fix use-after-free in retry work","status":"backported","project":false,"upstream":[{"sha":"5d132990475f02cfa1debe03d50b479432864ebd","url":"https://git.kernel.org/stable/c/5d132990475f02cfa1debe03d50b479432864ebd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/45341b341642c377192c95e4d48e0a859cf85f42","label":"45341b341642","date":"2026-09-25T16:37:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5d132990475f02cfa1debe03d50b479432864ebd","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/5d132990475f02cfa1debe03d50b479432864ebd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98212","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98212.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98211","title":"mmc: mmci: Fix use-after-free in busy-timeout work","status":"backported","project":false,"upstream":[{"sha":"2b19cf3e50cddaff07b657dae1a8f30f06032852","url":"https://git.kernel.org/stable/c/2b19cf3e50cddaff07b657dae1a8f30f06032852"}],"evidence":[{"url":"https://git.kernel.org/stable/c/432b98c1f5daecf04a33c8e1688d26e7ac221e23","label":"432b98c1f5da","date":"2026-09-25T16:37:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b19cf3e50cddaff07b657dae1a8f30f06032852","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/2b19cf3e50cddaff07b657dae1a8f30f06032852.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98182","title":"wifi: mac80211: refuse to make a monitor active when it has no queue","status":"backported","project":false,"upstream":[{"sha":"2b04d6556964ae9f89819b86a0a7801e39c3aae5","url":"https://git.kernel.org/stable/c/2b04d6556964ae9f89819b86a0a7801e39c3aae5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/46c223468537a05a404699771cd3e68532dab5e6","label":"46c223468537","date":"2026-09-25T16:37:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b04d6556964ae9f89819b86a0a7801e39c3aae5","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/2b04d6556964ae9f89819b86a0a7801e39c3aae5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98182","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98182.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98180","title":"drm/msm: RCU-free the scheduler-containing ring and VM objects","status":"backported","project":false,"upstream":[{"sha":"01c8d1f385f788f1bbbbb7687c4386d614281218","url":"https://git.kernel.org/stable/c/01c8d1f385f788f1bbbbb7687c4386d614281218"}],"evidence":[{"url":"https://git.kernel.org/stable/c/713abac5c04ccbae67f9ac68c3921845535388e7","label":"713abac5c04c","date":"2026-09-25T16:37:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"01c8d1f385f788f1bbbbb7687c4386d614281218","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/01c8d1f385f788f1bbbbb7687c4386d614281218.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98180","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98180.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98179","title":"drm/amdgpu: fix rmmio iounmap skipped on device removal","status":"backported","project":false,"upstream":[{"sha":"5155002b03b24ba3ef91c5c313b8cf0171b24904","url":"https://git.kernel.org/stable/c/5155002b03b24ba3ef91c5c313b8cf0171b24904"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a645584c3ccc493ee835f77155829442bd7578c3","label":"a645584c3ccc","date":"2026-09-25T16:37:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5155002b03b24ba3ef91c5c313b8cf0171b24904","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/5155002b03b24ba3ef91c5c313b8cf0171b24904.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98179","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98179.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98177","title":"drm/amdkfd: Avoid integer underflow in EOP ring size calculation.","status":"backported","project":false,"upstream":[{"sha":"8ee521b8b189799e361d4233c5180ba56656d4d4","url":"https://git.kernel.org/stable/c/8ee521b8b189799e361d4233c5180ba56656d4d4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/287a34c4d712e0bdb67751e21316d9c8d75a528a","label":"287a34c4d712","date":"2026-09-25T16:37:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ee521b8b189799e361d4233c5180ba56656d4d4","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/8ee521b8b189799e361d4233c5180ba56656d4d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98177","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98177.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98176","title":"drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc","status":"backported","project":false,"upstream":[{"sha":"c883d0a132d430ef7ebb23fd94323be94d0fbdb8","url":"https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/82e1b8299c6da02ce02185c208d2fdf7572b5ea1","label":"82e1b8299c6d","date":"2026-09-25T16:37:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c883d0a132d430ef7ebb23fd94323be94d0fbdb8","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/c883d0a132d430ef7ebb23fd94323be94d0fbdb8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98176","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98176.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98175","title":"smb: client: cancel reconnect work in clean_demultiplex_info()","status":"backported","project":false,"upstream":[{"sha":"c65eae6f61d1778ff7a82e4aae4080e26f486af1","url":"https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2e5103e11a17c274715dd56cf185eeedccf686b8","label":"2e5103e11a17","date":"2026-09-25T16:37:12+02:00","lore":["https://lore.kernel.org/r/6aa4a12d.f81106d8.2ab401.0023.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c65eae6f61d1778ff7a82e4aae4080e26f486af1","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/c65eae6f61d1778ff7a82e4aae4080e26f486af1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98175","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98175.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98174","title":"smb: client: fix rlist race and missing initialization","status":"backported","project":false,"upstream":[{"sha":"5f270f091256da1338c3631083e15d7f83cc05e1","url":"https://git.kernel.org/stable/c/5f270f091256da1338c3631083e15d7f83cc05e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f","label":"c037d6bde3dd","date":"2026-09-25T16:37:12+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"5f270f091256da1338c3631083e15d7f83cc05e1","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/5f270f091256da1338c3631083e15d7f83cc05e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98164","title":"KVM: x86/mmu: Check write tracking in all address spaces","status":"backported","project":false,"upstream":[{"sha":"0f38453cdb2e17566ccb7c0f3dabd5bd21caca26","url":"https://git.kernel.org/stable/c/0f38453cdb2e17566ccb7c0f3dabd5bd21caca26"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0f38453cdb2e17566ccb7c0f3dabd5bd21caca26","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98164","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98164.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98162","title":"smb/server: fix tree connection leak in smb2_tree_connect()","status":"backported","project":false,"upstream":[{"sha":"39f2032096715daae5f6fd0f587ca7a474b019df","url":"https://git.kernel.org/stable/c/39f2032096715daae5f6fd0f587ca7a474b019df"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc","label":"a6c88e5e3a75","date":"2026-09-14T13:39:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"39f2032096715daae5f6fd0f587ca7a474b019df","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/39f2032096715daae5f6fd0f587ca7a474b019df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98162","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98162.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98161","title":"nvdimm: pmem: keep PREFLUSH before data writes","status":"backported","project":false,"upstream":[{"sha":"c644a2f8fef5618fcf453c591177700fd07dd024","url":"https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024"}],"evidence":[{"url":"https://git.kernel.org/stable/c/72561ca1ab96f0f0f32737a6171641e05a318538","label":"72561ca1ab96","date":"2026-09-14T13:39:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c644a2f8fef5618fcf453c591177700fd07dd024","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/c644a2f8fef5618fcf453c591177700fd07dd024.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98156","title":"drm/virtio: use the DMA API for resource backing on Xen","status":"backported","project":false,"upstream":[{"sha":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","url":"https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78"}],"evidence":[{"url":"https://git.kernel.org/stable/c/455184dbe9652d01470d3c5cf5edd09a7a673a99","label":"455184dbe965","date":"2026-09-21T15:07:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98156.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98153","title":"nvme: fix racy access to FDP placement id array","status":"backported","project":false,"upstream":[{"sha":"56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","url":"https://git.kernel.org/stable/c/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e0a23e3c8c4c3ce11529fa70d2292b4e56d143ba","label":"e0a23e3c8c4c","date":"2026-09-21T15:07:57+02:00","lore":["https://lore.kernel.org/linux-nvme/20260725135111.14041-2-harimishal1@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"56e1c6bbe4bb084d7ecf61698afdf70be23dd35f","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98153","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98153.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98148","title":"drm/gud: validate GUD_ROTATION_0 is present in supported rotations","status":"backported","project":false,"upstream":[{"sha":"cb732d027aa18e1fcf9d2797f47d20b179ebc59c","url":"https://git.kernel.org/stable/c/cb732d027aa18e1fcf9d2797f47d20b179ebc59c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/876b33d8a9a00e9d4bbcbb7f55ad2c05974850de","label":"876b33d8a9a0","date":"2026-09-21T15:07:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cb732d027aa18e1fcf9d2797f47d20b179ebc59c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/cb732d027aa18e1fcf9d2797f47d20b179ebc59c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98148","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98148.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98144","title":"accel/amdxdna: put the chained BO when its mapping fails","status":"backported","project":false,"upstream":[{"sha":"7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","url":"https://git.kernel.org/stable/c/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/eb90cb257e0792ac11f0347254bad3fc72417db6","label":"eb90cb257e07","date":"2026-09-21T15:07:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e33ba3a1d48c2d20ed270dec9d2d08332585c8e","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/7e33ba3a1d48c2d20ed270dec9d2d08332585c8e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98144","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98144.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98142","title":"drm/cirrus-qemu: Validate BAR0 size during probe","status":"backported","project":false,"upstream":[{"sha":"92312d333bf700798f92f30406c721bce87506f3","url":"https://git.kernel.org/stable/c/92312d333bf700798f92f30406c721bce87506f3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/144f51cd0ccc3ad47a6099917b7bb535611fb18f","label":"144f51cd0ccc","date":"2026-09-21T15:07:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"92312d333bf700798f92f30406c721bce87506f3","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/92312d333bf700798f92f30406c721bce87506f3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98142","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98142.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98131","title":"net: stmmac: fix dma mapping leak in stmmac_tso_xmit()","status":"backported","project":false,"upstream":[{"sha":"a5d946466a95621fa2769720d59ea336003aa1a5","url":"https://git.kernel.org/stable/c/a5d946466a95621fa2769720d59ea336003aa1a5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e85adaac3dc6317cae902372c6849189ec62cf7d","label":"e85adaac3dc6","date":"2026-09-21T15:08:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"a5d946466a95621fa2769720d59ea336003aa1a5","lines":120,"reason":"","source":"https://github.com/torvalds/linux/commit/a5d946466a95621fa2769720d59ea336003aa1a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98131","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98131.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98127","title":"smb/client: validate new EOF for insert range","status":"backported","project":false,"upstream":[{"sha":"1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","url":"https://git.kernel.org/stable/c/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f8cbfe3a3fcee7d991fd223f660f3e5df13221cf","label":"f8cbfe3a3fce","date":"2026-09-21T15:08:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98127","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98127.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98126","title":"smb/client: validate new EOF for zero range","status":"backported","project":false,"upstream":[{"sha":"88972e35750792e717af287dc71f42a03b5cbce4","url":"https://git.kernel.org/stable/c/88972e35750792e717af287dc71f42a03b5cbce4"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f320ca20c273a26cd779bdb2b2e4b076a95c76f6","label":"f320ca20c273","date":"2026-09-21T15:08:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"88972e35750792e717af287dc71f42a03b5cbce4","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/88972e35750792e717af287dc71f42a03b5cbce4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98126","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98126.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98125","title":"smb/client: fix stale page cache in insert/collapse range","status":"backported","project":false,"upstream":[{"sha":"01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","url":"https://git.kernel.org/stable/c/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032"}],"evidence":[{"url":"https://git.kernel.org/stable/c/76222e76d08fbae4092ee9da84ded2b4c24ee598","label":"76222e76d08f","date":"2026-09-21T15:08:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"01261a6fa48b62f5ead8e88aaca1e27cb9ab9032","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/01261a6fa48b62f5ead8e88aaca1e27cb9ab9032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98124","title":"smb/client: invalidate fscache for fallocate range operations","status":"backported","project":false,"upstream":[{"sha":"448ba0ae65ca61064183564d2983c9aa59bd6ba7","url":"https://git.kernel.org/stable/c/448ba0ae65ca61064183564d2983c9aa59bd6ba7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/93c6e5a8d7c5071d586c1411596d5db5faad22b2","label":"93c6e5a8d7c5","date":"2026-09-21T15:08:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"448ba0ae65ca61064183564d2983c9aa59bd6ba7","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/448ba0ae65ca61064183564d2983c9aa59bd6ba7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98124","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98124.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98119","title":"netfs: break unbuffered write when netfs_alloc_subrequest() fails","status":"backported","project":false,"upstream":[{"sha":"8fb45a934661419c04a44d4cfea1e0df7dcf2805","url":"https://git.kernel.org/stable/c/8fb45a934661419c04a44d4cfea1e0df7dcf2805"}],"evidence":[{"url":"https://git.kernel.org/stable/c/19f246c795e940dc5f11cd5bc0cb1e81bc7b7090","label":"19f246c795e9","date":"2026-09-21T15:08:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8fb45a934661419c04a44d4cfea1e0df7dcf2805","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/8fb45a934661419c04a44d4cfea1e0df7dcf2805.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98119","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98119.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98118","title":"netfs: Fix readahead synchronisation issues by loading all folios upfront","status":"backported","project":false,"upstream":[{"sha":"fed0b33e6c584986ba70018ec9f9787a98216e64","url":"https://git.kernel.org/stable/c/fed0b33e6c584986ba70018ec9f9787a98216e64"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8c9b33945712074a85d3bdacbca036ba6b3d92c6","label":"8c9b33945712","date":"2026-09-21T15:08:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"fed0b33e6c584986ba70018ec9f9787a98216e64","lines":362,"reason":"","source":"https://github.com/torvalds/linux/commit/fed0b33e6c584986ba70018ec9f9787a98216e64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98115","title":"ksmbd: safely drain sessions during logoff","status":"backported","project":false,"upstream":[{"sha":"d12168084c8c1b6d883c8eca5853929ac5136a9e","url":"https://git.kernel.org/stable/c/d12168084c8c1b6d883c8eca5853929ac5136a9e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a7e6df0bb92642bee4431b2b85c69ada1e463b21","label":"a7e6df0bb926","date":"2026-09-21T15:08:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d12168084c8c1b6d883c8eca5853929ac5136a9e","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/d12168084c8c1b6d883c8eca5853929ac5136a9e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98114","title":"ksmbd: propagate DACL parsing errors","status":"backported","project":false,"upstream":[{"sha":"c61dc7b1b4a3234b4aa3965502908a292238805c","url":"https://git.kernel.org/stable/c/c61dc7b1b4a3234b4aa3965502908a292238805c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a04dac1f2cffe9533f4260f0659297d805e69194","label":"a04dac1f2cff","date":"2026-09-21T15:08:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c61dc7b1b4a3234b4aa3965502908a292238805c","lines":147,"reason":"","source":"https://github.com/torvalds/linux/commit/c61dc7b1b4a3234b4aa3965502908a292238805c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98114","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98114.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98111","title":"Bluetooth: btintel: validate version TLV value lengths","status":"backported","project":false,"upstream":[{"sha":"a086c0892969bf8a0151b0f12bd14a68827c88b2","url":"https://git.kernel.org/stable/c/a086c0892969bf8a0151b0f12bd14a68827c88b2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5ec43df2830b73e004147303bf7914ca884d6770","label":"5ec43df2830b","date":"2026-09-21T15:08:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a086c0892969bf8a0151b0f12bd14a68827c88b2","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/a086c0892969bf8a0151b0f12bd14a68827c88b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98111","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98111.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98107","title":"Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect","status":"backported","project":false,"upstream":[{"sha":"56c2b5831d39dc84aad2573dc3e197af1a872a05","url":"https://git.kernel.org/stable/c/56c2b5831d39dc84aad2573dc3e197af1a872a05"}],"evidence":[{"url":"https://git.kernel.org/stable/c/df8c3af6132640da4788e96a02d653e642059803","label":"df8c3af61326","date":"2026-09-21T15:08:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"56c2b5831d39dc84aad2573dc3e197af1a872a05","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/56c2b5831d39dc84aad2573dc3e197af1a872a05.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98107","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98107.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98106","title":"drm/pagemap: Prevent double migration of device pages","status":"backported","project":false,"upstream":[{"sha":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","url":"https://git.kernel.org/stable/c/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/62451f540c46bf5c51143a1c8681b472608bd54d","label":"62451f540c46","date":"2026-09-21T15:08:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","lines":204,"reason":"","source":"https://github.com/torvalds/linux/commit/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98106","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98106.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98103","title":"igmp: convert struct ip_sf_list to RCU","status":"backported","project":false,"upstream":[{"sha":"2987ee196c88dbde0463dc87d5fb209c684e34a2","url":"https://git.kernel.org/stable/c/2987ee196c88dbde0463dc87d5fb209c684e34a2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e3206419bdb04e2087d8cc6be324df8639b3fac5","label":"e3206419bdb0","date":"2026-09-21T15:08:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2987ee196c88dbde0463dc87d5fb209c684e34a2","lines":490,"reason":"","source":"https://github.com/torvalds/linux/commit/2987ee196c88dbde0463dc87d5fb209c684e34a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98102","title":"ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()","status":"backported","project":false,"upstream":[{"sha":"93b49239840b91313adbd77b8b52993eff2d08c1","url":"https://git.kernel.org/stable/c/93b49239840b91313adbd77b8b52993eff2d08c1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5149c60c406595b56fda0c6e9aae7fd287f636aa","label":"5149c60c4065","date":"2026-09-21T15:08:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"93b49239840b91313adbd77b8b52993eff2d08c1","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/93b49239840b91313adbd77b8b52993eff2d08c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98101","title":"ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()","status":"backported","project":false,"upstream":[{"sha":"c073d1b070f171d206b19c98d71739a97f15b3f1","url":"https://git.kernel.org/stable/c/c073d1b070f171d206b19c98d71739a97f15b3f1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/20db91a052332ef5552bd2f651ffb9db911cf67b","label":"20db91a05233","date":"2026-09-21T15:08:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c073d1b070f171d206b19c98d71739a97f15b3f1","lines":147,"reason":"","source":"https://github.com/torvalds/linux/commit/c073d1b070f171d206b19c98d71739a97f15b3f1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98099","title":"ipv6: mcast: use rcu_assign_pointer() for __rcu list updates","status":"backported","project":false,"upstream":[{"sha":"0c8f56c583c3250408367880c98e4d6fbc929315","url":"https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6","label":"2e46b0c9fcf7","date":"2026-09-21T15:08:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0c8f56c583c3250408367880c98e4d6fbc929315","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/0c8f56c583c3250408367880c98e4d6fbc929315.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98099","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98099.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98097","title":"tipc: Dont send random pad bytes in RESET/ACTIVATE messages","status":"backported","project":false,"upstream":[{"sha":"81c600c26302a27852ed8b19c5f2f647ea3555c9","url":"https://git.kernel.org/stable/c/81c600c26302a27852ed8b19c5f2f647ea3555c9"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bee1459e57f2e0bd240c62f35c0a284291e27971","label":"bee1459e57f2","date":"2026-09-21T15:08:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"81c600c26302a27852ed8b19c5f2f647ea3555c9","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/81c600c26302a27852ed8b19c5f2f647ea3555c9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98087","title":"sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate","status":"backported","project":false,"upstream":[{"sha":"dae5c0292080dd7b9c7d784268dcf443f1f3d15e","url":"https://git.kernel.org/stable/c/dae5c0292080dd7b9c7d784268dcf443f1f3d15e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b0c6f947057751ab4d30ccf8095cd19804fb97fa","label":"b0c6f9470577","date":"2026-09-21T15:08:11+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"dae5c0292080dd7b9c7d784268dcf443f1f3d15e","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/dae5c0292080dd7b9c7d784268dcf443f1f3d15e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98087","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98087.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98085","title":"bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge","status":"backported","project":false,"upstream":[{"sha":"387b1baefbb776e3f48dc2261e77a49213f470f7","url":"https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/671b7b9a660ef15b25faa3df161205b9dc8d1eb2","label":"671b7b9a660e","date":"2026-09-21T15:08:13+02:00","lore":["https://lore.kernel.org/bpf/20260901-bug-016-backtrack-ld-abs-v1-1-59368f1be435@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"387b1baefbb776e3f48dc2261e77a49213f470f7","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/387b1baefbb776e3f48dc2261e77a49213f470f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98084","title":"bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks","status":"backported","project":false,"upstream":[{"sha":"e3e4f66cc4b72333d0886ae2673c360248987889","url":"https://git.kernel.org/stable/c/e3e4f66cc4b72333d0886ae2673c360248987889"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f83890dfed9efc5e19df1dbc1ad707a142936923","label":"f83890dfed9e","date":"2026-09-21T15:08:13+02:00","lore":["https://lore.kernel.org/r/20260831-bug-015-backtrack-cb-args-precise-v1-1-68a8e2a821e0@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e3e4f66cc4b72333d0886ae2673c360248987889","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/e3e4f66cc4b72333d0886ae2673c360248987889.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98084","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98084.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98081","title":"btrfs: zoned: finish active block group cleanup if call_zone_finish() fails","status":"backported","project":false,"upstream":[{"sha":"a18a6b93a2843b9d103d3456bbd4b3f90282a379","url":"https://git.kernel.org/stable/c/a18a6b93a2843b9d103d3456bbd4b3f90282a379"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e1b168a53174b385e3548bfbd079513b22ac240c","label":"e1b168a53174","date":"2026-09-21T15:08:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a18a6b93a2843b9d103d3456bbd4b3f90282a379","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/a18a6b93a2843b9d103d3456bbd4b3f90282a379.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98081","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98081.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98079","title":"btrfs: zstd: fix lost wakeup when waiting for a workspace","status":"backported","project":false,"upstream":[{"sha":"2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","url":"https://git.kernel.org/stable/c/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0de9f31d447ae71ab08c7850a321682f8d2907c3","label":"0de9f31d447a","date":"2026-09-21T15:08:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98073","title":"net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().","status":"backported","project":false,"upstream":[{"sha":"debac3a20dec524a59625cf10fa2f18571127824","url":"https://git.kernel.org/stable/c/debac3a20dec524a59625cf10fa2f18571127824"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ac6631843269e6a9b2164e393b7f729328711d78","label":"ac6631843269","date":"2026-09-21T15:08:15+02:00","lore":["https://lore.kernel.org/all/6a96219e.04428c52.29b18.0001.GAE@google.com/T/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"debac3a20dec524a59625cf10fa2f18571127824","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/debac3a20dec524a59625cf10fa2f18571127824.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98067","title":"erofs: disable LZ4 rolling decompression for now","status":"backported","project":false,"upstream":[{"sha":"82e664cf1219c459c33aae931b222cf951af9cb7","url":"https://git.kernel.org/stable/c/82e664cf1219c459c33aae931b222cf951af9cb7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c9a2db4b9950b59c571258e4bae74c271f62dd66","label":"c9a2db4b9950","date":"2026-09-21T15:08:16+02:00","lore":["https://lore.kernel.org/r/BEZP281MB2102E57CD31862B8D958B33DD2AC2@BEZP281MB2102.DEUP281.PROD.OUTLOOK.COM"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"82e664cf1219c459c33aae931b222cf951af9cb7","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/82e664cf1219c459c33aae931b222cf951af9cb7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98067","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98067.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98058","title":"bpf: Mark syscall helpers as sleepable","status":"backported","project":false,"upstream":[{"sha":"d05524794240b52fdc3b6c1220dd05505715824d","url":"https://git.kernel.org/stable/c/d05524794240b52fdc3b6c1220dd05505715824d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3408e98f06ce06ea6a58ca6c39da9c23f0029c06","label":"3408e98f06ce","date":"2026-09-21T15:08:17+02:00","lore":["https://lore.kernel.org/r/20260903144433.1716731-10-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d05524794240b52fdc3b6c1220dd05505715824d","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/d05524794240b52fdc3b6c1220dd05505715824d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98058","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98058.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98056","title":"nvme: remove stale namespaces by NSID range during scan","status":"backported","project":false,"upstream":[{"sha":"4ed7f3d7d435bf5b63da2814dc9270f5ba896011","url":"https://git.kernel.org/stable/c/4ed7f3d7d435bf5b63da2814dc9270f5ba896011"}],"evidence":[{"url":"https://git.kernel.org/stable/c/52200fc41a79da430ccf7c126ed837535b087ea2","label":"52200fc41a79","date":"2026-09-21T15:08:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4ed7f3d7d435bf5b63da2814dc9270f5ba896011","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/4ed7f3d7d435bf5b63da2814dc9270f5ba896011.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98056","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98056.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98049","title":"bpf: zero extend the result of an arena 32-bit cmpxchg","status":"backported","project":false,"upstream":[{"sha":"4814ed6406f3493bd554ad046da5f7fc04833571","url":"https://git.kernel.org/stable/c/4814ed6406f3493bd554ad046da5f7fc04833571"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1c1b476d43a8b6c9bc04600369dd8cc39950d98e","label":"1c1b476d43a8","date":"2026-09-21T15:08:18+02:00","lore":["https://lore.kernel.org/r/20260903171542.1438050-1-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4814ed6406f3493bd554ad046da5f7fc04833571","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/4814ed6406f3493bd554ad046da5f7fc04833571.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98049","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98049.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98044","title":"bpf: Reject legacy packet loads from callbacks","status":"backported","project":false,"upstream":[{"sha":"e7d28823c662128caae63f14e16bd394916c139b","url":"https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bc489c0c9b8c86bd7fac42cfd1bb152f042fca56","label":"bc489c0c9b8c","date":"2026-09-21T15:08:18+02:00","lore":["https://lore.kernel.org/bpf/20260903152147.C0E241F00A3A@smtp.kernel.org","https://lore.kernel.org/r/20260903214758.2727663-8-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e7d28823c662128caae63f14e16bd394916c139b","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/e7d28823c662128caae63f14e16bd394916c139b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98043","title":"bpf: Don't infer non-NULL from a pointer with an unbounded offset","status":"backported","project":false,"upstream":[{"sha":"67b529f521a6676cdfc78b91b0217d7eaa84216b","url":"https://git.kernel.org/stable/c/67b529f521a6676cdfc78b91b0217d7eaa84216b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cb6642048739bf4ee5aa09fe465511f1e87caa63","label":"cb6642048739","date":"2026-09-21T15:08:19+02:00","lore":["https://lore.kernel.org/bpf/20260904083325.2083493-1-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"67b529f521a6676cdfc78b91b0217d7eaa84216b","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/67b529f521a6676cdfc78b91b0217d7eaa84216b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98041","title":"bpf: Don't predict JMP32 pointer vs zero comparisons","status":"backported","project":false,"upstream":[{"sha":"e51179a4e09846f8fd0f26a05068520de2b301bf","url":"https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a4d7f94c1ca914469ced665ec2f98be669aef462","label":"a4d7f94c1ca9","date":"2026-09-21T15:08:19+02:00","lore":["https://lore.kernel.org/bpf/20260904083325.2083493-5-eddyz87@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e51179a4e09846f8fd0f26a05068520de2b301bf","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/e51179a4e09846f8fd0f26a05068520de2b301bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98041","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98041.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98034","title":"bpf: Mark NULL kptr stores precise","status":"backported","project":false,"upstream":[{"sha":"ecdc5043794c9184aa8e6c814603899479c46b35","url":"https://git.kernel.org/stable/c/ecdc5043794c9184aa8e6c814603899479c46b35"}],"evidence":[{"url":"https://git.kernel.org/stable/c/86168208737bdd267d92d855d453d1d2f840df19","label":"86168208737b","date":"2026-09-21T15:08:20+02:00","lore":["https://lore.kernel.org/r/20260904104203.345917-6-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ecdc5043794c9184aa8e6c814603899479c46b35","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/ecdc5043794c9184aa8e6c814603899479c46b35.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98034","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98034.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98033","title":"bpf: Preserve inner map identity in callback frames","status":"backported","project":false,"upstream":[{"sha":"b90c5d770dad910fb89e6c1b15052a8a1e8db752","url":"https://git.kernel.org/stable/c/b90c5d770dad910fb89e6c1b15052a8a1e8db752"}],"evidence":[{"url":"https://git.kernel.org/stable/c/66ff2eff093d2a0838f39c713eeb590bc0946c2a","label":"66ff2eff093d","date":"2026-09-21T15:08:20+02:00","lore":["https://lore.kernel.org/r/20260904104203.345917-8-memxor@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b90c5d770dad910fb89e6c1b15052a8a1e8db752","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/b90c5d770dad910fb89e6c1b15052a8a1e8db752.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98033","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98033.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98026","title":"net: bridge: mcast: properly convert mglist to rcu","status":"backported","project":false,"upstream":[{"sha":"4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","url":"https://git.kernel.org/stable/c/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f7bf57e94a5d6214b87be08486cb33836fbfa573","label":"f7bf57e94a5d","date":"2026-09-21T15:08:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/4b772869a1e5f9da5cef5b9c722ec0aa424ee0a0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98021","title":"net: reject oversized tx_queue_len at netlink parse time","status":"backported","project":false,"upstream":[{"sha":"1aa9e143bf51405665a793d4cc925e1c4f0c5922","url":"https://git.kernel.org/stable/c/1aa9e143bf51405665a793d4cc925e1c4f0c5922"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a638a2625aa83160a394abe8e8b2e524a80c771b","label":"a638a2625aa8","date":"2026-09-21T15:08:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1aa9e143bf51405665a793d4cc925e1c4f0c5922","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/1aa9e143bf51405665a793d4cc925e1c4f0c5922.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98021","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98021.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98019","title":"bpf: mark a NULL call argument precise","status":"backported","project":false,"upstream":[{"sha":"1a3a10b030c96ea88868ccc060a16827c01eaa5a","url":"https://git.kernel.org/stable/c/1a3a10b030c96ea88868ccc060a16827c01eaa5a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/69a9ad004ccf5d45e534c7d503f47f643abe64b7","label":"69a9ad004ccf","date":"2026-09-21T15:08:22+02:00","lore":["https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-1-0f5a360ff15d@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a3a10b030c96ea88868ccc060a16827c01eaa5a","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/1a3a10b030c96ea88868ccc060a16827c01eaa5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98019","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98019.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-98003","title":"iommu/amd: Do not reallocate GA log buffers on resume","status":"backported","project":false,"upstream":[{"sha":"00a7dd64888d6dd72110b40e2824a088cf7b7386","url":"https://git.kernel.org/stable/c/00a7dd64888d6dd72110b40e2824a088cf7b7386"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b6be275d19cee01f8f1f08a2ff18337103d05d40","label":"b6be275d19ce","date":"2026-09-21T15:08:24+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"00a7dd64888d6dd72110b40e2824a088cf7b7386","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/00a7dd64888d6dd72110b40e2824a088cf7b7386.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-98003","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98003.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97997","title":"virtio_ring: fix stale descriptor flags after a failed packed add","status":"backported","project":false,"upstream":[{"sha":"75d276e5bb68778b2916f98a2bc30f142ebadc64","url":"https://git.kernel.org/stable/c/75d276e5bb68778b2916f98a2bc30f142ebadc64"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d595358276b60e5df4d3930bc94033249b1d5adc","label":"d595358276b6","date":"2026-09-21T15:08:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75d276e5bb68778b2916f98a2bc30f142ebadc64","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/75d276e5bb68778b2916f98a2bc30f142ebadc64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97997","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97997.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97994","title":"vhost/vdpa: reject VRING_NUM larger than device max","status":"backported","project":false,"upstream":[{"sha":"ccb1dc7c527f8c925925cf92afc76ae590dac311","url":"https://git.kernel.org/stable/c/ccb1dc7c527f8c925925cf92afc76ae590dac311"}],"evidence":[{"url":"https://git.kernel.org/stable/c/59522639a7d71cff4e20d594d0b9ea30dd0c77e0","label":"59522639a7d7","date":"2026-09-21T15:08:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ccb1dc7c527f8c925925cf92afc76ae590dac311","lines":81,"reason":"","source":"https://github.com/torvalds/linux/commit/ccb1dc7c527f8c925925cf92afc76ae590dac311.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97994","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97994.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97992","title":"vhost-vdpa: protect config_ctx from being freed under the config callback","status":"backported","project":false,"upstream":[{"sha":"62be4e3e5f5f947fbf765b914cebdc478f715d12","url":"https://git.kernel.org/stable/c/62be4e3e5f5f947fbf765b914cebdc478f715d12"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f4a93f15ed1c8406ba5c8e5b28cafacb2b3bcd11","label":"f4a93f15ed1c","date":"2026-09-21T15:08:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"62be4e3e5f5f947fbf765b914cebdc478f715d12","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/62be4e3e5f5f947fbf765b914cebdc478f715d12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97992","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97992.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97990","title":"vdpa_sim_net: check TX pull result before RX copy","status":"backported","project":false,"upstream":[{"sha":"0d195797a80b77f2ec56718cd26d3ee65d0093e8","url":"https://git.kernel.org/stable/c/0d195797a80b77f2ec56718cd26d3ee65d0093e8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2bbf1c1f69991e28787e02b0a2f826289d5fc730","label":"2bbf1c1f6999","date":"2026-09-21T15:08:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0d195797a80b77f2ec56718cd26d3ee65d0093e8","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/0d195797a80b77f2ec56718cd26d3ee65d0093e8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97989","title":"vduse: validate virtqueue alignment","status":"backported","project":false,"upstream":[{"sha":"fa2c25b4add57888acfa89e398389e267bff3dcf","url":"https://git.kernel.org/stable/c/fa2c25b4add57888acfa89e398389e267bff3dcf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c3c3b0839a1197530cc18f535062fc84dbdfc885","label":"c3c3b0839a11","date":"2026-09-21T15:08:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fa2c25b4add57888acfa89e398389e267bff3dcf","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/fa2c25b4add57888acfa89e398389e267bff3dcf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97988","title":"vhost: invalidate vring access on IOTLB transitions","status":"backported","project":false,"upstream":[{"sha":"e4f4761879a230aa59e569102a6ab9851847d833","url":"https://git.kernel.org/stable/c/e4f4761879a230aa59e569102a6ab9851847d833"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4a454af8e56c1596ada1421ae5eba90c8896c7c7","label":"4a454af8e56c","date":"2026-09-21T15:08:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"e4f4761879a230aa59e569102a6ab9851847d833","lines":104,"reason":"","source":"https://github.com/torvalds/linux/commit/e4f4761879a230aa59e569102a6ab9851847d833.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97985","title":"af_unix: Update last skb marker in manage_oob().","status":"backported","project":false,"upstream":[{"sha":"94fd4debd2e3a69cf93e766c8b328a810c228119","url":"https://git.kernel.org/stable/c/94fd4debd2e3a69cf93e766c8b328a810c228119"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fc62a26493a98a0424d9dae2eb92a1daa1321f65","label":"fc62a26493a9","date":"2026-09-21T15:08:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"94fd4debd2e3a69cf93e766c8b328a810c228119","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/94fd4debd2e3a69cf93e766c8b328a810c228119.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97985","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97985.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97984","title":"net: ipv6: Fix UDP length overflow with PMTU discover and big MTU","status":"backported","project":false,"upstream":[{"sha":"0ae10b6be49b425827659b23bcce498f80eb7182","url":"https://git.kernel.org/stable/c/0ae10b6be49b425827659b23bcce498f80eb7182"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e01b7c176d9af2b7c22bb3fe12cf9a7904f99fdc","label":"e01b7c176d9a","date":"2026-09-21T15:08:27+02:00","lore":["https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0ae10b6be49b425827659b23bcce498f80eb7182","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0ae10b6be49b425827659b23bcce498f80eb7182.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97984","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97984.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97978","title":"eth: ice: don't dereference pointers from TP_printk()","status":"backported","project":false,"upstream":[{"sha":"b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","url":"https://git.kernel.org/stable/c/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c42db35518bb0eae42ec955520eee0aa94a4a6fe","label":"c42db35518bb","date":"2026-09-21T15:08:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b","lines":88,"reason":"","source":"https://github.com/torvalds/linux/commit/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97978","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97978.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97975","title":"Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()","status":"backported","project":false,"upstream":[{"sha":"9b851b09b392da68bd715601f10a5adb2d8d19b8","url":"https://git.kernel.org/stable/c/9b851b09b392da68bd715601f10a5adb2d8d19b8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9e9ece97b8e716890793de261574b8efef7d8702","label":"9e9ece97b8e7","date":"2026-09-21T15:08:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9b851b09b392da68bd715601f10a5adb2d8d19b8","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/9b851b09b392da68bd715601f10a5adb2d8d19b8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97965","title":"vxlan: initialize _md in vxlan_xmit_one()","status":"backported","project":false,"upstream":[{"sha":"be83178bfc44588f6e3adb827ed874c683193466","url":"https://git.kernel.org/stable/c/be83178bfc44588f6e3adb827ed874c683193466"}],"evidence":[{"url":"https://git.kernel.org/stable/c/081f22177d9d12b1e381b787f203cd5f47508187","label":"081f22177d9d","date":"2026-09-21T15:08:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"be83178bfc44588f6e3adb827ed874c683193466","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/be83178bfc44588f6e3adb827ed874c683193466.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97965","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97965.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97953","title":"net: stmmac: fix TX descriptor availability check for TSO traffic","status":"backported","project":false,"upstream":[{"sha":"5e38d732ec67a5b1f9a56e6c73add480c4b6030a","url":"https://git.kernel.org/stable/c/5e38d732ec67a5b1f9a56e6c73add480c4b6030a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/65820fc743eae322f7f94f6a64d07861211d4b21","label":"65820fc743ea","date":"2026-09-21T15:08:34+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5e38d732ec67a5b1f9a56e6c73add480c4b6030a","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/5e38d732ec67a5b1f9a56e6c73add480c4b6030a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97953","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97953.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97950","title":"configfs: pin the symlink target's dirent instead of chasing ->ci_dentry","status":"backported","project":false,"upstream":[{"sha":"a7c1290eef60711c10289c056ad32ed1f2b47b12","url":"https://git.kernel.org/stable/c/a7c1290eef60711c10289c056ad32ed1f2b47b12"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d47c5de1cd6bfbe1067fc310bf90e4e00205e839","label":"d47c5de1cd6b","date":"2026-09-21T15:08:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a7c1290eef60711c10289c056ad32ed1f2b47b12","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/a7c1290eef60711c10289c056ad32ed1f2b47b12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97950","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97950.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97949","title":"configfs: unhash the dentry before dropping the item in rmdir","status":"backported","project":false,"upstream":[{"sha":"f06c2d26d1999d37e93299db0ecead04ca7d0b9f","url":"https://git.kernel.org/stable/c/f06c2d26d1999d37e93299db0ecead04ca7d0b9f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/925d8564f1b2d9b46c5ab63b9bc942cea006da9b","label":"925d8564f1b2","date":"2026-09-21T15:08:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f06c2d26d1999d37e93299db0ecead04ca7d0b9f","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/f06c2d26d1999d37e93299db0ecead04ca7d0b9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97938","title":"reboot: fix cad_pid use-after-free race","status":"backported","project":false,"upstream":[{"sha":"5a88f78df753993469dab4d1831f8fb4256a9468","url":"https://git.kernel.org/stable/c/5a88f78df753993469dab4d1831f8fb4256a9468"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9a17b0e053197a6a42cdc75e75a35b17aa662088","label":"9a17b0e05319","date":"2026-09-21T15:08:37+02:00","lore":["https://lore.kernel.org/all/20260717210143.4734-1-blbllhy@gmail.com/","https://lore.kernel.org/all/al4ICz9biJKtdZc4@redhat.com/","https://lore.kernel.org/all/alz5ZYLE4kaq_v2P@redhat.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5a88f78df753993469dab4d1831f8fb4256a9468","lines":92,"reason":"","source":"https://github.com/torvalds/linux/commit/5a88f78df753993469dab4d1831f8fb4256a9468.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97933","title":"tracing: Take trace_array reference when opening a tracer options file","status":"backported","project":false,"upstream":[{"sha":"ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","url":"https://git.kernel.org/stable/c/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b2fb87d29ffb3a7a9ccc5acf12898ecb80587427","label":"b2fb87d29ffb","date":"2026-09-21T15:08:37+02:00","lore":["https://lore.kernel.org/linux-trace-kernel/20260902121918.5a9e9d1b@gandalf.local.home/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97933","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97933.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97929","title":"ALSA: usbusx2y: validate URB actual_length in interrupt callback","status":"backported","project":false,"upstream":[{"sha":"8f5ef203abda9dd36b2af473c7b737d544f807bd","url":"https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2770321b358658e0a39fe39ccf6a91ee97a81931","label":"2770321b3586","date":"2026-09-21T15:08:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f5ef203abda9dd36b2af473c7b737d544f807bd","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/8f5ef203abda9dd36b2af473c7b737d544f807bd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97918","title":"tracing: Undo the registration when enabling the histogram trigger fails","status":"backported","project":false,"upstream":[{"sha":"92383cef66791a0c63a2f27755cadbdb2fbf270b","url":"https://git.kernel.org/stable/c/92383cef66791a0c63a2f27755cadbdb2fbf270b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bfa6bc11aef93a3d9db0ac9564b734849a9d959b","label":"bfa6bc11aef9","date":"2026-09-21T15:08:40+02:00","lore":["https://lore.kernel.org/linux-trace-kernel/20260907092944.3950E1F00A3D@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"92383cef66791a0c63a2f27755cadbdb2fbf270b","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/92383cef66791a0c63a2f27755cadbdb2fbf270b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97906","title":"bootconfig: Fix integer overflow in initrd size check","status":"backported","project":false,"upstream":[{"sha":"7812d6dab0698001e50e8c2f901e17da3eb6f429","url":"https://git.kernel.org/stable/c/7812d6dab0698001e50e8c2f901e17da3eb6f429"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bff9a1579e2c9b2a59fdf3793becc9d7bf5ff1a6","label":"bff9a1579e2c","date":"2026-09-21T15:08:41+02:00","lore":["https://lore.kernel.org/all/178905333479.213925.1358412668943562406.stgit@devnote2/","https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7812d6dab0698001e50e8c2f901e17da3eb6f429","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7812d6dab0698001e50e8c2f901e17da3eb6f429.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97619","title":"io_uring/rw: end write accounting from ->ki_complete","status":"backported","project":false,"upstream":[{"sha":"796aa0547557e63338657ed1c487906f9fac4c73","url":"https://git.kernel.org/stable/c/796aa0547557e63338657ed1c487906f9fac4c73"}],"evidence":[{"url":"https://git.kernel.org/stable/c/055d43a1233edbd80e558889258105ce63051bcd","label":"055d43a1233e","date":"2026-09-21T15:08:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"796aa0547557e63338657ed1c487906f9fac4c73","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/796aa0547557e63338657ed1c487906f9fac4c73.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97619","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97619.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97600","title":"ieee802154: cc2520: fix FIFOP work use-after-free","status":"backported","project":false,"upstream":[{"sha":"ff5891b266a7fc6a062710836be84f1cc19338b5","url":"https://git.kernel.org/stable/c/ff5891b266a7fc6a062710836be84f1cc19338b5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/890a80d516a1447db5c21bf92841a82914ea897d","label":"890a80d516a1","date":"2026-09-21T15:08:44+02:00","lore":["https://lore.kernel.org/20260812061714.175966-1-fanwu01@zju.edu.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ff5891b266a7fc6a062710836be84f1cc19338b5","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/ff5891b266a7fc6a062710836be84f1cc19338b5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97600","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97600.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97566","title":"mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0","status":"backported","project":false,"upstream":[{"sha":"2ac7d6e620764f1fc79eb4edd3610a7a661981ca","url":"https://git.kernel.org/stable/c/2ac7d6e620764f1fc79eb4edd3610a7a661981ca"}],"evidence":[{"url":"https://git.kernel.org/stable/c/545616b4e7325be3c61fc082538cb06d14f7b1db","label":"545616b4e732","date":"2026-09-21T15:08:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2ac7d6e620764f1fc79eb4edd3610a7a661981ca","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97566","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97566.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97565","title":"smb: client: reject short READ responses in CIFSSMBRead()","status":"backported","project":false,"upstream":[{"sha":"e6142a8bfc230c7263eb8b0475249c958ce49367","url":"https://git.kernel.org/stable/c/e6142a8bfc230c7263eb8b0475249c958ce49367"}],"evidence":[{"url":"https://git.kernel.org/stable/c/aaa221c1b1d288845b55e9c366e5ef608dfff49d","label":"aaa221c1b1d2","date":"2026-09-21T15:08:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"e6142a8bfc230c7263eb8b0475249c958ce49367","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/e6142a8bfc230c7263eb8b0475249c958ce49367.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97565","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97565.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97563","title":"smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()","status":"backported","project":false,"upstream":[{"sha":"5be5bdda5863eacc964b609ba927764f253431b3","url":"https://git.kernel.org/stable/c/5be5bdda5863eacc964b609ba927764f253431b3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/667feba13e78d16393aacb15869f70970f422227","label":"667feba13e78","date":"2026-09-21T15:08:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5be5bdda5863eacc964b609ba927764f253431b3","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/5be5bdda5863eacc964b609ba927764f253431b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97563","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97563.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97562","title":"smb: client: pin DFS superblock in iterator callback","status":"backported","project":false,"upstream":[{"sha":"d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","url":"https://git.kernel.org/stable/c/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5b01a8c0209690db75341528ec53fd87e0ac1460","label":"5b01a8c02096","date":"2026-09-21T15:08:50+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97562","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97562.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97538","title":"hwmon: (asus_rog_ryujin) Validate HID report lengths","status":"backported","project":false,"upstream":[{"sha":"8042312e73c50de82634ce63eae7cf219464b481","url":"https://git.kernel.org/stable/c/8042312e73c50de82634ce63eae7cf219464b481"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1caa5f9399ff107a8fa221b1eaca0a9e729d3758","label":"1caa5f9399ff","date":"2026-09-21T15:08:56+02:00","lore":["https://lore.kernel.org/linux-hwmon/20260812104617.858D01F000E9@smtp.kernel.org/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8042312e73c50de82634ce63eae7cf219464b481","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/8042312e73c50de82634ce63eae7cf219464b481.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97526","title":"s390/pai: Support CPU hotplug for PMU PAI","status":"backported","project":false,"upstream":[{"sha":"9ecc4d033879f7761f2df07e20cd2fbec00fd90b","url":"https://git.kernel.org/stable/c/9ecc4d033879f7761f2df07e20cd2fbec00fd90b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/706e2bf330144995d123dccf32aaf1981ce5abc2","label":"706e2bf33014","date":"2026-09-21T15:09:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"9ecc4d033879f7761f2df07e20cd2fbec00fd90b","lines":292,"reason":"","source":"https://github.com/torvalds/linux/commit/9ecc4d033879f7761f2df07e20cd2fbec00fd90b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97526","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97526.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97515","title":"i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845","status":"backported","project":false,"upstream":[{"sha":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","url":"https://git.kernel.org/stable/c/1effa3adfe53cb2bb28bf5640a676b791d5ab405"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/1effa3adfe53cb2bb28bf5640a676b791d5ab405.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97515","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97515.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97499","title":"coresight: perf: Retrieve path and source from event data","status":"backported","project":false,"upstream":[{"sha":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","url":"https://git.kernel.org/stable/c/f37bc31447c0ddafedb25e3c4a4f4e2284034247"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","lines":229,"reason":"","source":"https://github.com/torvalds/linux/commit/f37bc31447c0ddafedb25e3c4a4f4e2284034247.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97496","title":"drm/amdkfd: Fix OOB memory exposure in get_wave_state()","status":"backported","project":false,"upstream":[{"sha":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","url":"https://git.kernel.org/stable/c/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97496","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97496.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-97424","title":"drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq","status":"backported","project":false,"upstream":[{"sha":"e3829992dd9fa0a82511af4f01733fc854cd15a5","url":"https://git.kernel.org/stable/c/e3829992dd9fa0a82511af4f01733fc854cd15a5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"e3829992dd9fa0a82511af4f01733fc854cd15a5","lines":131,"reason":"","source":"https://github.com/torvalds/linux/commit/e3829992dd9fa0a82511af4f01733fc854cd15a5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-97424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-97424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93799","title":"wifi: iwlwifi: mvm: validate sta_id in BA window status notif","status":"backported","project":false,"upstream":[{"sha":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","url":"https://git.kernel.org/stable/c/6aa77efaea9efea92e3090c35ad348fd759a3cf3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/6aa77efaea9efea92e3090c35ad348fd759a3cf3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93796","title":"wifi: iwlwifi: pcie: null RX pointers after free","status":"backported","project":false,"upstream":[{"sha":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","url":"https://git.kernel.org/stable/c/2c79d7a7b583050c9f58041465cb46fe3483ab5d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93796","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93796.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93276","title":"phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator","status":"backported","project":false,"upstream":[{"sha":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","url":"https://git.kernel.org/stable/c/49c9b71b45081e5e5eeb507a2d6edb80d332dc59"}],"evidence":[{"url":"https://git.kernel.org/stable/c/935f6e837a83b86b073a7601f699dc2c00e01322","label":"935f6e837a83","date":"2026-09-14T13:40:25+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/49c9b71b45081e5e5eeb507a2d6edb80d332dc59.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93276","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93276.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93270","title":"bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn","status":"backported","project":false,"upstream":[{"sha":"7a0855e73757ee9cf25ba635a1c735018ecba742","url":"https://git.kernel.org/stable/c/7a0855e73757ee9cf25ba635a1c735018ecba742"}],"evidence":[{"url":"https://git.kernel.org/stable/c/57cf929a33cb76be3f24886073ae820b4c496914","label":"57cf929a33cb","date":"2026-09-14T13:39:38+02:00","lore":["https://lore.kernel.org/bpf/20260715141122.15783-4-leon.hwang@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7a0855e73757ee9cf25ba635a1c735018ecba742","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/7a0855e73757ee9cf25ba635a1c735018ecba742.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93270","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93270.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93244","title":"drm/sysfb: simpledrm: Improve stride validation","status":"backported","project":false,"upstream":[{"sha":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","url":"https://git.kernel.org/stable/c/df6533f11688aa30be3bb883c7637f4ffdbb7cbd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bbdc6761c55662fb9ddf5ab580acb616131998fe","label":"bbdc6761c556","date":"2026-09-11T11:51:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93244","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93244.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93238","title":"s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap","status":"backported","project":false,"upstream":[{"sha":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","url":"https://git.kernel.org/stable/c/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/09548edc6114f1eb1035b30795e893204ef45b85","label":"09548edc6114","date":"2026-09-11T11:50:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93238","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93238.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93237","title":"LoongArch: Add DIRECT_MAP_PHYSMEM_END definition","status":"backported","project":false,"upstream":[{"sha":"2677f97a67fdbc62a82ce1faa67791f54451d36f","url":"https://git.kernel.org/stable/c/2677f97a67fdbc62a82ce1faa67791f54451d36f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/55e18311c705cceef6c34d522ea387b1f0069bab","label":"55e18311c705","date":"2026-09-11T11:51:09+02:00","lore":["https://lore.kernel.org/amd-gfx/20250814032153.227285-1-jeffbai@aosc.io/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2677f97a67fdbc62a82ce1faa67791f54451d36f","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/2677f97a67fdbc62a82ce1faa67791f54451d36f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93235","title":"f2fs: fix to zero post-EOF data when extending file size","status":"backported","project":false,"upstream":[{"sha":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","url":"https://git.kernel.org/stable/c/5eced87b7d19dbc76ebdddaf322046f9ac582fcb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c42608c09b6b5d5967bf211c255914c068c2cde1","label":"c42608c09b6b","date":"2026-09-11T11:51:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","lines":189,"reason":"","source":"https://github.com/torvalds/linux/commit/5eced87b7d19dbc76ebdddaf322046f9ac582fcb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93235","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93235.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93221","title":"nfsd: convert nfsd_net boolean flags to unsigned long flags word","status":"backported","project":false,"upstream":[{"sha":"11a5fe42e1811f793e04ef885b639ea7668f439d","url":"https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/df5922fe09a8131c793ffa86adf204999b0470f8","label":"df5922fe09a8","date":"2026-09-07T17:36:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"11a5fe42e1811f793e04ef885b639ea7668f439d","lines":276,"reason":"","source":"https://github.com/torvalds/linux/commit/11a5fe42e1811f793e04ef885b639ea7668f439d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93221","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93221.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93216","title":"mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()","status":"backported","project":false,"upstream":[{"sha":"90f095b816e25c6a9e4446d299bac5007fdcb3df","url":"https://git.kernel.org/stable/c/90f095b816e25c6a9e4446d299bac5007fdcb3df"}],"evidence":[{"url":"https://git.kernel.org/stable/c/46761406e14381dc35f498c247a87565b87ea2ef","label":"46761406e143","date":"2026-09-07T17:36:34+02:00","lore":["https://lore.kernel.org/20260714015117.78351-10-ye.liu@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"90f095b816e25c6a9e4446d299bac5007fdcb3df","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/90f095b816e25c6a9e4446d299bac5007fdcb3df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93216","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93216.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93184","title":"ASoC: fsl_audmix: rework runtime PM handling in probe","status":"backported","project":false,"upstream":[{"sha":"3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71","url":"https://git.kernel.org/stable/c/3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71"}],"evidence":[{"url":"https://git.kernel.org/stable/c/22c944e440bc9b16c4ee409943d69bb8ef575c9e","label":"22c944e440bc","date":"2026-09-14T13:39:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71","lines":59,"reason":"","source":"https://github.com/torvalds/linux/commit/3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93184","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93184.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93181","title":"perf/x86/intel/uncore: Fix uncore_box ref/unref ordering","status":"backported","project":false,"upstream":[{"sha":"174f0582e38abe03b88e15f04bfe58490f88cb19","url":"https://git.kernel.org/stable/c/174f0582e38abe03b88e15f04bfe58490f88cb19"}],"evidence":[{"url":"https://git.kernel.org/stable/c/64aa1bb4017d598828c6d8cd718f43daf2a83375","label":"64aa1bb4017d","date":"2026-09-14T13:39:07+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"174f0582e38abe03b88e15f04bfe58490f88cb19","lines":108,"reason":"","source":"https://github.com/torvalds/linux/commit/174f0582e38abe03b88e15f04bfe58490f88cb19.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93181","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93181.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93155","title":"crypto: keembay - Fix AEAD unregister count in error path","status":"backported","project":false,"upstream":[{"sha":"e264401ce4776a288524e5b87593d4d864147115","url":"https://git.kernel.org/stable/c/e264401ce4776a288524e5b87593d4d864147115"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a3217fe7998622728a53dff405615e0971949eaf","label":"a3217fe79986","date":"2026-09-14T13:39:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"e264401ce4776a288524e5b87593d4d864147115","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93155","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93155.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93154","title":"RDMA/irdma: Add refcounting to user ring MRs","status":"backported","project":false,"upstream":[{"sha":"f67d8a08f60c9217df6d40da56422d2049f5e334","url":"https://git.kernel.org/stable/c/f67d8a08f60c9217df6d40da56422d2049f5e334"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a6c0e693a7c881bfa43ac74cbcad1f8e10f1382b","label":"a6c0e693a7c8","date":"2026-09-14T13:39:14+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"f67d8a08f60c9217df6d40da56422d2049f5e334","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/f67d8a08f60c9217df6d40da56422d2049f5e334.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93154","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93154.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93135","title":"bpf: Reject programs with inlined helpers if JIT is not available","status":"backported","project":false,"upstream":[{"sha":"f1c27922576edccb99d0257827d09bd05c0304a6","url":"https://git.kernel.org/stable/c/f1c27922576edccb99d0257827d09bd05c0304a6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/21c6445366795fa3a89954e1d318e7c8afdef843","label":"21c644536679","date":"2026-09-14T13:39:21+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f1c27922576edccb99d0257827d09bd05c0304a6","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/f1c27922576edccb99d0257827d09bd05c0304a6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93135","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93135.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93123","title":"serial: qcom-geni: do not advance stale DMA completions","status":"backported","project":false,"upstream":[{"sha":"7ea38c49e7178960926657863299face6dc0e1b0","url":"https://git.kernel.org/stable/c/7ea38c49e7178960926657863299face6dc0e1b0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/59faa59c25a0a098fbc86275408d7c8405015702","label":"59faa59c25a0","date":"2026-09-14T13:39:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7ea38c49e7178960926657863299face6dc0e1b0","lines":45,"reason":"","source":"https://github.com/torvalds/linux/commit/7ea38c49e7178960926657863299face6dc0e1b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93100","title":"fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()","status":"backported","project":false,"upstream":[{"sha":"f5bcf539484d2d604c2f2330e09487ea090b21c7","url":"https://git.kernel.org/stable/c/f5bcf539484d2d604c2f2330e09487ea090b21c7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4c593c62c1499665baebbb41b70e2c9b7e947b86","label":"4c593c62c149","date":"2026-09-14T13:39:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"f5bcf539484d2d604c2f2330e09487ea090b21c7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93100","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93100.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93099","title":"fs/resctrl: Fix UAF from worker threads when domains are removed","status":"backported","project":false,"upstream":[{"sha":"2566b5cd6a275c124e8f154fef6e815f92ec8d5c","url":"https://git.kernel.org/stable/c/2566b5cd6a275c124e8f154fef6e815f92ec8d5c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b86dbfe4583bf134932a6cc45bf25b12c10a0b2f","label":"b86dbfe4583b","date":"2026-09-14T13:39:27+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2566b5cd6a275c124e8f154fef6e815f92ec8d5c","lines":199,"reason":"","source":"https://github.com/torvalds/linux/commit/2566b5cd6a275c124e8f154fef6e815f92ec8d5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93099","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93099.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93093","title":"firmware: arm_scmi: Publish channel state before callbacks","status":"backported","project":false,"upstream":[{"sha":"0314900dcdde044af0208fed212035dbfaa55843","url":"https://git.kernel.org/stable/c/0314900dcdde044af0208fed212035dbfaa55843"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a1bc587568a4e373db76261dc9561dfc3653917f","label":"a1bc587568a4","date":"2026-09-14T13:39:28+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0314900dcdde044af0208fed212035dbfaa55843","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93093","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93093.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93091","title":"firmware: arm_scmi: Quiesce notifications before teardown","status":"backported","project":false,"upstream":[{"sha":"8e49055d0d495c9c07575ad8e111d9eaf0efb13f","url":"https://git.kernel.org/stable/c/8e49055d0d495c9c07575ad8e111d9eaf0efb13f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5e30d3d16d1a9e599be4dcea872874e65e2c277b","label":"5e30d3d16d1a","date":"2026-09-14T13:39:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8e49055d0d495c9c07575ad8e111d9eaf0efb13f","lines":86,"reason":"","source":"https://github.com/torvalds/linux/commit/8e49055d0d495c9c07575ad8e111d9eaf0efb13f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93091","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93091.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93083","title":"firmware: arm_scmi: Unwind TX receiver mailbox setup failure","status":"backported","project":false,"upstream":[{"sha":"6f7c06744d53dc8e047725d411d7f915d9ec35ae","url":"https://git.kernel.org/stable/c/6f7c06744d53dc8e047725d411d7f915d9ec35ae"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9958f55eace8b43713c9fc54dcf90e7cdefee413","label":"9958f55eace8","date":"2026-09-14T13:39:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f7c06744d53dc8e047725d411d7f915d9ec35ae","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/6f7c06744d53dc8e047725d411d7f915d9ec35ae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93083","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93083.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93072","title":"irqchip/renesas-irqc: Fix generic interrupt chip leak on remove","status":"backported","project":false,"upstream":[{"sha":"616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba","url":"https://git.kernel.org/stable/c/616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7c614f83301d464e2fb498d63552490d137ea10d","label":"7c614f83301d","date":"2026-09-14T13:39:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93072","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93072.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93047","title":"drm/v3d: Associate BOs with every job that accesses them","status":"backported","project":false,"upstream":[{"sha":"fa98563ab00dbe62fcedfef6bdd34ded7a860d9f","url":"https://git.kernel.org/stable/c/fa98563ab00dbe62fcedfef6bdd34ded7a860d9f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7244dd0f12629484a1936dc5c5837670d8d9f80c","label":"7244dd0f1262","date":"2026-09-14T13:39:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"fa98563ab00dbe62fcedfef6bdd34ded7a860d9f","lines":175,"reason":"","source":"https://github.com/torvalds/linux/commit/fa98563ab00dbe62fcedfef6bdd34ded7a860d9f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93047","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93047.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-93044","title":"bpf: Disallow interpreter fallback for arena-related insns","status":"backported","project":false,"upstream":[{"sha":"34746b5a84ec37c0ea2bf6808c65c5ed8790eb51","url":"https://git.kernel.org/stable/c/34746b5a84ec37c0ea2bf6808c65c5ed8790eb51"}],"evidence":[{"url":"https://git.kernel.org/stable/c/408b6d3bc19c4aa852ab7ee2f447756e52e69967","label":"408b6d3bc19c","date":"2026-09-14T13:39:38+02:00","lore":["https://lore.kernel.org/bpf/20260715141122.15783-2-leon.hwang@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"34746b5a84ec37c0ea2bf6808c65c5ed8790eb51","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/34746b5a84ec37c0ea2bf6808c65c5ed8790eb51.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-93044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-93044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92518","title":"riscv, bpf: Fix kernel stack corruption in tailcall with CFI","status":"backported","project":false,"upstream":[{"sha":"52fb1756ea1d2759dfef2d86245be00b05dac3a2","url":"https://git.kernel.org/stable/c/52fb1756ea1d2759dfef2d86245be00b05dac3a2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a6e11a81da3420fd37f1518d4f238c4d5784086e","label":"a6e11a81da34","date":"2026-09-14T13:39:41+02:00","lore":["https://lore.kernel.org/bpf/20260708064436.2971933-5-pulehui@huaweicloud.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"52fb1756ea1d2759dfef2d86245be00b05dac3a2","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/52fb1756ea1d2759dfef2d86245be00b05dac3a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92518","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92518.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92500","title":"ext4: use fsdata to track inline data write state and fix race","status":"backported","project":false,"upstream":[{"sha":"7edbb323bab2b2a609016014caafdb651c898249","url":"https://git.kernel.org/stable/c/7edbb323bab2b2a609016014caafdb651c898249"}],"evidence":[{"url":"https://git.kernel.org/stable/c/439aedfd7ae868d1d7b4930afe66091cb979cd5c","label":"439aedfd7ae8","date":"2026-09-14T13:39:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7edbb323bab2b2a609016014caafdb651c898249","lines":95,"reason":"","source":"https://github.com/torvalds/linux/commit/7edbb323bab2b2a609016014caafdb651c898249.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92500","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92500.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92499","title":"ext4: validate readdir offset before accessing dirent","status":"backported","project":false,"upstream":[{"sha":"bc4b7b0414c33b2c8898eb04386df0d21a13dad8","url":"https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b4c728577933753180e3e97f08424d5bcaff705e","label":"b4c728577933","date":"2026-09-14T13:39:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"bc4b7b0414c33b2c8898eb04386df0d21a13dad8","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/bc4b7b0414c33b2c8898eb04386df0d21a13dad8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-92493","title":"cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active","status":"backported","project":false,"upstream":[{"sha":"8d31bb1451643f328db0cea0e21e63ef54b4faf2","url":"https://git.kernel.org/stable/c/8d31bb1451643f328db0cea0e21e63ef54b4faf2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ba6ce23d17db3d114adf13909a9002f1eedcf183","label":"ba6ce23d17db","date":"2026-09-14T13:39:45+02:00","lore":["https://lore.kernel.org/r/1784191899-28957-1-git-send-email-pengqh1@chinatelecom.cn"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8d31bb1451643f328db0cea0e21e63ef54b4faf2","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/8d31bb1451643f328db0cea0e21e63ef54b4faf2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-92493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-92493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90401","title":"md: remove REQ_NOWAIT support from raid1/10/456","status":"backported","project":false,"upstream":[{"sha":"3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","url":"https://git.kernel.org/stable/c/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9bb9504e2d8f3d22ef12d51c333dd499f402dc8f","label":"9bb9504e2d8f","date":"2026-09-14T13:39:56+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","lines":588,"reason":"","source":"https://github.com/torvalds/linux/commit/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90401","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90401.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90397","title":"firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published","status":"backported","project":false,"upstream":[{"sha":"966d23c7e68ea32679275a7e3d2383181002c868","url":"https://git.kernel.org/stable/c/966d23c7e68ea32679275a7e3d2383181002c868"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f312ef5026678f14caf1378c5f7fffdf667f9c81","label":"f312ef502667","date":"2026-09-14T13:39:58+02:00","lore":["https://lore.kernel.org/r/20260724094939.613844-2-mukesh.ojha@oss.qualcomm.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"966d23c7e68ea32679275a7e3d2383181002c868","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/966d23c7e68ea32679275a7e3d2383181002c868.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90397","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90397.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90389","title":"md: scope memalloc_noio to allocation critical sections","status":"backported","project":false,"upstream":[{"sha":"bace2010dd7ac07bc980575afb135c406730a7fe","url":"https://git.kernel.org/stable/c/bace2010dd7ac07bc980575afb135c406730a7fe"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a58923756b0f8e71032070c23ae0b167e46731da","label":"a58923756b0f","date":"2026-09-14T13:40:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"bace2010dd7ac07bc980575afb135c406730a7fe","lines":306,"reason":"","source":"https://github.com/torvalds/linux/commit/bace2010dd7ac07bc980575afb135c406730a7fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90389","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90389.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90379","title":"wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash","status":"backported","project":false,"upstream":[{"sha":"915672c5ae32deeb72f4572856d123f314791136","url":"https://git.kernel.org/stable/c/915672c5ae32deeb72f4572856d123f314791136"}],"evidence":[{"url":"https://git.kernel.org/stable/c/f544bcba4721e1074e9bc6666f0ef4f8b96ddba8","label":"f544bcba4721","date":"2026-09-14T13:40:03+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"915672c5ae32deeb72f4572856d123f314791136","lines":227,"reason":"","source":"https://github.com/torvalds/linux/commit/915672c5ae32deeb72f4572856d123f314791136.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90379","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90379.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90375","title":"wifi: mt76: fix non-AQL packet accounting for MLO stations","status":"backported","project":false,"upstream":[{"sha":"8ae659743ba936b22ecb4620815887728e2820d6","url":"https://git.kernel.org/stable/c/8ae659743ba936b22ecb4620815887728e2820d6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/186c957ac3325aefb982567ffdd3654b283688a7","label":"186c957ac332","date":"2026-09-14T13:40:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"8ae659743ba936b22ecb4620815887728e2820d6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90375","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90375.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90373","title":"wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear","status":"backported","project":false,"upstream":[{"sha":"6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba","url":"https://git.kernel.org/stable/c/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a97b2b942d2f8f12fbd6a7caafc735d1ad115e6b","label":"a97b2b942d2f","date":"2026-09-14T13:40:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90373","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90373.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90359","title":"bpf: Reject >8 byte return values on return-reading trampoline paths","status":"backported","project":false,"upstream":[{"sha":"c48796aa6c392cde93946e5d5a9a1f1b1cf72feb","url":"https://git.kernel.org/stable/c/c48796aa6c392cde93946e5d5a9a1f1b1cf72feb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d36ac53fc83baf843c51b7afd6d2471f36b713d8","label":"d36ac53fc83b","date":"2026-09-14T13:40:08+02:00","lore":["https://lore.kernel.org/bpf/20260729050159.2585809-1-yonghong.song@linux.dev"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c48796aa6c392cde93946e5d5a9a1f1b1cf72feb","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/c48796aa6c392cde93946e5d5a9a1f1b1cf72feb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90359","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90359.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90333","title":"dm-integrity: replace forgeable discard filler with a keyed sector marker","status":"backported","project":false,"upstream":[{"sha":"68c5c42567bc462139128968ebbfadd0aefff519","url":"https://git.kernel.org/stable/c/68c5c42567bc462139128968ebbfadd0aefff519"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6228722c27304e4682cddc1fede03898f87e4414","label":"6228722c2730","date":"2026-09-14T13:40:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"68c5c42567bc462139128968ebbfadd0aefff519","lines":357,"reason":"","source":"https://github.com/torvalds/linux/commit/68c5c42567bc462139128968ebbfadd0aefff519.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90321","title":"ocfs2: validate inline xattrs during inode block validation","status":"backported","project":false,"upstream":[{"sha":"8914a3330b72378136c2c02d6328a826f6abdad7","url":"https://git.kernel.org/stable/c/8914a3330b72378136c2c02d6328a826f6abdad7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3fd45b24879fa4885b66a582a6e47eda67f11310","label":"3fd45b24879f","date":"2026-09-14T13:40:16+02:00","lore":["https://lore.kernel.org/20260705025311.3429854-1-zzzccc427@gmail.com","https://lore.kernel.org/20260705025311.3429854-2-zzzccc427@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"8914a3330b72378136c2c02d6328a826f6abdad7","lines":164,"reason":"","source":"https://github.com/torvalds/linux/commit/8914a3330b72378136c2c02d6328a826f6abdad7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90321","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90321.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90320","title":"ocfs2: validate external xattr entries when reading metadata","status":"backported","project":false,"upstream":[{"sha":"2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6","url":"https://git.kernel.org/stable/c/2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9f4129b6905b7d638bbc9eb8013c3989cbe30b7e","label":"9f4129b6905b","date":"2026-09-14T13:40:16+02:00","lore":["https://lore.kernel.org/20260705025311.3429854-3-zzzccc427@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6","lines":121,"reason":"","source":"https://github.com/torvalds/linux/commit/2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90320","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90320.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90317","title":"bpf: Invalidate RCU pointers after final spin unlock","status":"backported","project":false,"upstream":[{"sha":"180c7000712db77063b3a26f4c97e7dd9038f449","url":"https://git.kernel.org/stable/c/180c7000712db77063b3a26f4c97e7dd9038f449"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7ae71629357d0a6d0bdadb929c7b296d5b7e61c2","label":"7ae71629357d","date":"2026-09-14T13:40:17+02:00","lore":["https://lore.kernel.org/bpf/20260803112615.3362122-2-dingning04@gmail.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"180c7000712db77063b3a26f4c97e7dd9038f449","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/180c7000712db77063b3a26f4c97e7dd9038f449.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90315","title":"PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers","status":"backported","project":false,"upstream":[{"sha":"747b9bbbbdfdee51aee2456388f9b94b5086de4d","url":"https://git.kernel.org/stable/c/747b9bbbbdfdee51aee2456388f9b94b5086de4d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cd07aef510ac6a2873e01f9ddddc5492490b0067","label":"cd07aef510ac","date":"2026-09-14T13:40:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"747b9bbbbdfdee51aee2456388f9b94b5086de4d","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/747b9bbbbdfdee51aee2456388f9b94b5086de4d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90306","title":"ARM: 9481/2: breakpoint: CFI breakpoints only on demand","status":"backported","project":false,"upstream":[{"sha":"8ed9bff906cf8036531d1559f10e82733a52b41f","url":"https://git.kernel.org/stable/c/8ed9bff906cf8036531d1559f10e82733a52b41f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/da64b150e4b7bee615b33ab21f3137c31ec36922","label":"da64b150e4b7","date":"2026-09-14T13:40:21+02:00","lore":["https://lore.kernel.org/lkml/kJqktbpLphg_Pk5I5SPptgTLjl3E3eq5mN5UzCslyFj7Q1Irp-wDid4mj5eQVd2iZtRGXgeZd8goq195EkXdjyt864YMc8mVb2B9NGH91NQ=@protonmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8ed9bff906cf8036531d1559f10e82733a52b41f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8ed9bff906cf8036531d1559f10e82733a52b41f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90306","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90306.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90265","title":"btrfs: defrag: fix deadlock between defrag and delalloc space reservation","status":"backported","project":false,"upstream":[{"sha":"ba02eab28041f9a4bbe9fc90c7249644fef6de0f","url":"https://git.kernel.org/stable/c/ba02eab28041f9a4bbe9fc90c7249644fef6de0f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/ac916391e1c70801649f7d6f85014f687983bc33","label":"ac916391e1c7","date":"2026-09-14T13:40:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"ba02eab28041f9a4bbe9fc90c7249644fef6de0f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90265","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90265.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90261","title":"btrfs: zoned: flush active metadata block group at btree_writepages() start","status":"backported","project":false,"upstream":[{"sha":"ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b","url":"https://git.kernel.org/stable/c/ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e2de2989adb3e58c2320e57c255f52e065667b5e","label":"e2de2989adb3","date":"2026-09-14T13:40:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b","lines":132,"reason":"","source":"https://github.com/torvalds/linux/commit/ecc05eda9a346848ae01a6c8bfa3f0bec133bd8b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90261","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90261.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90256","title":"Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind","status":"backported","project":false,"upstream":[{"sha":"2b66c83ff1751d6bd3201b3017206262ab46dc05","url":"https://git.kernel.org/stable/c/2b66c83ff1751d6bd3201b3017206262ab46dc05"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b495a3a9b33bc4e4613e685bf5c96c136caa22d8","label":"b495a3a9b33b","date":"2026-09-14T13:40:31+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b66c83ff1751d6bd3201b3017206262ab46dc05","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/2b66c83ff1751d6bd3201b3017206262ab46dc05.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90256","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90256.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90237","title":"netfilter: nft_ct: move custom expectation support to helper","status":"backported","project":false,"upstream":[{"sha":"3679da4ad8be84cddaf40bc307fef1fe13e051ff","url":"https://git.kernel.org/stable/c/3679da4ad8be84cddaf40bc307fef1fe13e051ff"}],"evidence":[{"url":"https://git.kernel.org/stable/c/af3fe52fd108fd38235e4813df62442ed0f1d8ff","label":"af3fe52fd108","date":"2026-09-14T13:40:35+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"3679da4ad8be84cddaf40bc307fef1fe13e051ff","lines":260,"reason":"","source":"https://github.com/torvalds/linux/commit/3679da4ad8be84cddaf40bc307fef1fe13e051ff.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90230","title":"nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()","status":"backported","project":false,"upstream":[{"sha":"5bb96cc218835769ab74ec7f3ea2bf81fbffe955","url":"https://git.kernel.org/stable/c/5bb96cc218835769ab74ec7f3ea2bf81fbffe955"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7b81e4d2230e3d2d372c826180c4ef0efc244f31","label":"7b81e4d2230e","date":"2026-09-14T13:40:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"5bb96cc218835769ab74ec7f3ea2bf81fbffe955","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/5bb96cc218835769ab74ec7f3ea2bf81fbffe955.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90230","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90230.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90227","title":"nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()","status":"backported","project":false,"upstream":[{"sha":"b53d495c7f0db46b6748b5ade48371a10dd5d3bc","url":"https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/b116e9dae433ff631f94c36c61a7a78fe400ed1e","label":"b116e9dae433","date":"2026-09-14T13:40:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b53d495c7f0db46b6748b5ade48371a10dd5d3bc","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/b53d495c7f0db46b6748b5ade48371a10dd5d3bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90227","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90227.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90220","title":"ALSA: seq: Don't leak the extension cell pointer in the bounce payload","status":"backported","project":false,"upstream":[{"sha":"59e1592d3c270ff4642d5d6dc55c545306eb0693","url":"https://git.kernel.org/stable/c/59e1592d3c270ff4642d5d6dc55c545306eb0693"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6e6e471eef1d5d8cb056c7d364023fe048249204","label":"6e6e471eef1d","date":"2026-09-14T13:40:39+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"59e1592d3c270ff4642d5d6dc55c545306eb0693","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/59e1592d3c270ff4642d5d6dc55c545306eb0693.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90220","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90220.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90217","title":"bpf: Compare iterator types during state pruning","status":"backported","project":false,"upstream":[{"sha":"83608e303b95d07afba1c15da0b5d9e513c2f15a","url":"https://git.kernel.org/stable/c/83608e303b95d07afba1c15da0b5d9e513c2f15a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6424b9cde9edc7f2098115bbfd1ee3d84a958380","label":"6424b9cde9ed","date":"2026-09-14T13:40:41+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"83608e303b95d07afba1c15da0b5d9e513c2f15a","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/83608e303b95d07afba1c15da0b5d9e513c2f15a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90211","title":"bpf, s390: Clear fetch destination on faulting arena atomic","status":"backported","project":false,"upstream":[{"sha":"cc3e12330599f097f0e1f792435686ddc276f26d","url":"https://git.kernel.org/stable/c/cc3e12330599f097f0e1f792435686ddc276f26d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/44b702fceb4cf3a4ddbfb496f487b034814bf1a3","label":"44b702fceb4c","date":"2026-09-14T13:40:43+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"cc3e12330599f097f0e1f792435686ddc276f26d","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/cc3e12330599f097f0e1f792435686ddc276f26d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90199","title":"fs/ntfs3: reject out-of-range evcn in mi_enum_attr()","status":"backported","project":false,"upstream":[{"sha":"20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3","url":"https://git.kernel.org/stable/c/20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2b9a0e57bfd365e2096706b19ae34dce3b4a884b","label":"2b9a0e57bfd3","date":"2026-09-14T13:40:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/20fd9f64c0050658f2031e6bd5d552c6f0c8f7e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90199","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90199.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90154","title":"ksmbd: scope session state changes to bound connections","status":"backported","project":false,"upstream":[{"sha":"c50e628122aed077695669e25b842e778511a43d","url":"https://git.kernel.org/stable/c/c50e628122aed077695669e25b842e778511a43d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/0875872718b98e8530fbc634e5aa7dbd3253b80d","label":"0875872718b9","date":"2026-09-14T13:40:52+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"c50e628122aed077695669e25b842e778511a43d","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/c50e628122aed077695669e25b842e778511a43d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90154","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90154.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90129","title":"virtio_balloon: quiesce balloon work before device shutdown","status":"backported","project":false,"upstream":[{"sha":"7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","url":"https://git.kernel.org/stable/c/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/bdef50a8226fc04899ef6815dd08a002247d47d5","label":"bdef50a8226f","date":"2026-09-14T13:40:57+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90119","title":"ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup","status":"backported","project":false,"upstream":[{"sha":"d736eba9c453fedce664fdf592c8b71ecff1932b","url":"https://git.kernel.org/stable/c/d736eba9c453fedce664fdf592c8b71ecff1932b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/24b399f51812d727dc25d7814c4d7e0cca38201e","label":"24b399f51812","date":"2026-09-14T13:40:59+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d736eba9c453fedce664fdf592c8b71ecff1932b","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/d736eba9c453fedce664fdf592c8b71ecff1932b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90119","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90119.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90098","title":"net: sparx5: fix sleep in atomic context in MAC table access","status":"backported","project":false,"upstream":[{"sha":"b62793a7baeea9cf20209c9fd2e333311aaf3b8d","url":"https://git.kernel.org/stable/c/b62793a7baeea9cf20209c9fd2e333311aaf3b8d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/648d196ccc03ae3b04402ae71ffa44959a85e88f","label":"648d196ccc03","date":"2026-09-14T13:41:02+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b62793a7baeea9cf20209c9fd2e333311aaf3b8d","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/b62793a7baeea9cf20209c9fd2e333311aaf3b8d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90098","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90098.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90060","title":"ALSA: control: Don't add invalid kcontrols to LED layer","status":"backported","project":false,"upstream":[{"sha":"74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11","url":"https://git.kernel.org/stable/c/74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11"}],"evidence":[{"url":"https://git.kernel.org/stable/c/18c08f84ca483029f04e426ec7ca3b5d3684cf22","label":"18c08f84ca48","date":"2026-09-14T13:41:09+02:00","lore":["https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@google.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90060","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90060.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90040","title":"KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped","status":"backported","project":false,"upstream":[{"sha":"d1a3c216233413f57f5341a9b878b7e2dde7e785","url":"https://git.kernel.org/stable/c/d1a3c216233413f57f5341a9b878b7e2dde7e785"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2640cc26ed0dd1bf6ec2f6852a60e494093db3e5","label":"2640cc26ed0d","date":"2026-09-11T11:50:44+02:00","lore":["https://lore.kernel.org/all/aimMWzAf5b3luM0b@v4bel"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"d1a3c216233413f57f5341a9b878b7e2dde7e785","lines":242,"reason":"","source":"https://github.com/torvalds/linux/commit/d1a3c216233413f57f5341a9b878b7e2dde7e785.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90040","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90040.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90036","title":"NFSD: Prevent client use-after-free during blocked-lock reaping","status":"backported","project":false,"upstream":[{"sha":"9026932ac8be4d0ae01db47f23619a98cc57b671","url":"https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0","label":"6fedb2eaff77","date":"2026-09-11T11:50:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9026932ac8be4d0ae01db47f23619a98cc57b671","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/9026932ac8be4d0ae01db47f23619a98cc57b671.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90036","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90036.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-90027","title":"usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop","status":"backported","project":false,"upstream":[{"sha":"263f7d61a4201cde16849b2d016251806e7418be","url":"https://git.kernel.org/stable/c/263f7d61a4201cde16849b2d016251806e7418be"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1ab669c2b44e1040ddfab7cd7f717aad580d17aa","label":"1ab669c2b44e","date":"2026-09-11T11:50:46+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"263f7d61a4201cde16849b2d016251806e7418be","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/263f7d61a4201cde16849b2d016251806e7418be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-90027","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-90027.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89944","title":"ASoC: hdac_hda: Fix hlink refcount leak on component registration failure","status":"backported","project":false,"upstream":[{"sha":"6ad4892c4f5cb437a928a02f5b7d37d496aa9268","url":"https://git.kernel.org/stable/c/6ad4892c4f5cb437a928a02f5b7d37d496aa9268"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cb6b0b1a9d5a61ef841739d42c6211094e9c8e2c","label":"cb6b0b1a9d5a","date":"2026-09-11T11:51:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6ad4892c4f5cb437a928a02f5b7d37d496aa9268","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89938","title":"iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF","status":"backported","project":false,"upstream":[{"sha":"be61c8c6252671ecf1fee0ad90f87669e0be1e20","url":"https://git.kernel.org/stable/c/be61c8c6252671ecf1fee0ad90f87669e0be1e20"}],"evidence":[{"url":"https://git.kernel.org/stable/c/30b0d44c978bbc857bd68b71dab371805653de70","label":"30b0d44c978b","date":"2026-09-11T11:51:04+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"be61c8c6252671ecf1fee0ad90f87669e0be1e20","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/be61c8c6252671ecf1fee0ad90f87669e0be1e20.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89938","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89938.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89935","title":"iio: light: apds9306: fix PM reference leak in apds9306_read_data()","status":"backported","project":false,"upstream":[{"sha":"d378fceaafd79e0dc59d3546bda251a3058062c0","url":"https://git.kernel.org/stable/c/d378fceaafd79e0dc59d3546bda251a3058062c0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/3ce75e455dd6eaa775fb0badb31c0b100c7a01fe","label":"3ce75e455dd6","date":"2026-09-11T11:51:05+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d378fceaafd79e0dc59d3546bda251a3058062c0","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/d378fceaafd79e0dc59d3546bda251a3058062c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89935","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89935.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89929","title":"KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU","status":"backported","project":false,"upstream":[{"sha":"6d00e67326d831e6e610933a3800712f4ffe6ec1","url":"https://git.kernel.org/stable/c/6d00e67326d831e6e610933a3800712f4ffe6ec1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9941850e8adf164d005dbd3774c4b79e91a3cb8e","label":"9941850e8adf","date":"2026-09-11T11:51:06+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6d00e67326d831e6e610933a3800712f4ffe6ec1","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/6d00e67326d831e6e610933a3800712f4ffe6ec1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89929","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89929.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89913","title":"KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables","status":"backported","project":false,"upstream":[{"sha":"f5b8f203bfc07a5a257dff859e66d2c500f9f509","url":"https://git.kernel.org/stable/c/f5b8f203bfc07a5a257dff859e66d2c500f9f509"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d3a2d20b7248ea67465af1cf79c79f90ff70926c","label":"d3a2d20b7248","date":"2026-09-11T11:51:08+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f5b8f203bfc07a5a257dff859e66d2c500f9f509","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/f5b8f203bfc07a5a257dff859e66d2c500f9f509.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89913","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89913.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89906","title":"LoongArch: BPF: Refactor jump offset calculation in tail call","status":"backported","project":false,"upstream":[{"sha":"37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","url":"https://git.kernel.org/stable/c/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8"}],"evidence":[{"url":"https://git.kernel.org/stable/c/96f44d493c280ea161569c43d7ed0f3b0815803a","label":"96f44d493c28","date":"2026-09-11T11:51:09+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89899","title":"media: cec: disable delayed work before freeing an interrupted transmit","status":"backported","project":false,"upstream":[{"sha":"0fbd5c2327020858c45b2d1c65775d64cdeca523","url":"https://git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523"}],"evidence":[{"url":"https://git.kernel.org/stable/c/9c6ceb0949227c1f0cf0e19393daec72d9889871","label":"9c6ceb094922","date":"2026-09-11T11:51:10+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fbd5c2327020858c45b2d1c65775d64cdeca523","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0fbd5c2327020858c45b2d1c65775d64cdeca523.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89866","title":"media: chips-media: wave5: Resume device before setting EOS flag","status":"backported","project":false,"upstream":[{"sha":"a52e6f7923c17a672135b485ffd96fbd72f46267","url":"https://git.kernel.org/stable/c/a52e6f7923c17a672135b485ffd96fbd72f46267"}],"evidence":[{"url":"https://git.kernel.org/stable/c/2215e55ee1e5e69ad53862d968360c5aa63dd3a7","label":"2215e55ee1e5","date":"2026-09-11T11:51:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"a52e6f7923c17a672135b485ffd96fbd72f46267","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/a52e6f7923c17a672135b485ffd96fbd72f46267.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89866","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89866.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89862","title":"scsi: qla2xxx: Fix BSG job leak on validate flash image error path","status":"backported","project":false,"upstream":[{"sha":"0fb52cc632464b0cd07f970341330466d772efe1","url":"https://git.kernel.org/stable/c/0fb52cc632464b0cd07f970341330466d772efe1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e25241f9fa01fb0c088381a156d84a725b71c1ef","label":"e25241f9fa01","date":"2026-09-11T11:51:15+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fb52cc632464b0cd07f970341330466d772efe1","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/0fb52cc632464b0cd07f970341330466d772efe1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89826","title":"drm/panthor: harden firmware build-info bounds checks","status":"backported","project":false,"upstream":[{"sha":"8321b093fa6c297b80586460ce6914d9655df170","url":"https://git.kernel.org/stable/c/8321b093fa6c297b80586460ce6914d9655df170"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6ae19dce3e8c13ae73590b3f4311abe9f96bbae8","label":"6ae19dce3e8c","date":"2026-09-11T11:51:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"8321b093fa6c297b80586460ce6914d9655df170","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/8321b093fa6c297b80586460ce6914d9655df170.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89806","title":"drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation","status":"backported","project":false,"upstream":[{"sha":"c6f48e59ece0123f6a11527ad4d89b21c2d65b87","url":"https://git.kernel.org/stable/c/c6f48e59ece0123f6a11527ad4d89b21c2d65b87"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d9daf9a6e7a6f82ef338a09386eefc6807100d3f","label":"d9daf9a6e7a6","date":"2026-09-11T11:51:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6f48e59ece0123f6a11527ad4d89b21c2d65b87","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/c6f48e59ece0123f6a11527ad4d89b21c2d65b87.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89805","title":"drm/pagemap: Fix folio allocation fallback and use-after-put","status":"backported","project":false,"upstream":[{"sha":"df72e55e754c8d449321ddddad19a8bd3cb8d032","url":"https://git.kernel.org/stable/c/df72e55e754c8d449321ddddad19a8bd3cb8d032"}],"evidence":[{"url":"https://git.kernel.org/stable/c/10e92e18e3dab081789d868878f2ecce6166948a","label":"10e92e18e3da","date":"2026-09-11T11:51:23+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"df72e55e754c8d449321ddddad19a8bd3cb8d032","lines":181,"reason":"","source":"https://github.com/torvalds/linux/commit/df72e55e754c8d449321ddddad19a8bd3cb8d032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89805","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89805.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89797","title":"power: supply: ab8500_fg: fix use-after-free on remove","status":"backported","project":false,"upstream":[{"sha":"75b1e88d34254f4fb7753345e21bfee47abddd7f","url":"https://git.kernel.org/stable/c/75b1e88d34254f4fb7753345e21bfee47abddd7f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/013731074ab6a8d11ec209eee64c5b2656954479","label":"013731074ab6","date":"2026-09-11T11:51:25+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"75b1e88d34254f4fb7753345e21bfee47abddd7f","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/75b1e88d34254f4fb7753345e21bfee47abddd7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89793","title":"ublk: clear VM_MAYWRITE on read-only ublk char device mmap","status":"backported","project":false,"upstream":[{"sha":"6e2b571b0a54755b06e092501913e1dfefe75d6c","url":"https://git.kernel.org/stable/c/6e2b571b0a54755b06e092501913e1dfefe75d6c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/fa5e1bc673ca59722608af67b27e65dba0c97926","label":"fa5e1bc673ca","date":"2026-09-11T11:50:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"6e2b571b0a54755b06e092501913e1dfefe75d6c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/6e2b571b0a54755b06e092501913e1dfefe75d6c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89793","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89793.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89788","title":"ksmbd: fix tree connection use-after-free in smb2_tree_connect()","status":"backported","project":false,"upstream":[{"sha":"b5ec6c462aab1062cf5d1e667ba7c6442f737055","url":"https://git.kernel.org/stable/c/b5ec6c462aab1062cf5d1e667ba7c6442f737055"}],"evidence":[{"url":"https://git.kernel.org/stable/c/4e30fbd26e84efa2e5cbec4eb11e126ac0c79313","label":"4e30fbd26e84","date":"2026-09-14T13:39:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5ec6c462aab1062cf5d1e667ba7c6442f737055","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/b5ec6c462aab1062cf5d1e667ba7c6442f737055.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89788","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89788.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89772","title":"btrfs: write-protect folios during data writeback","status":"backported","project":false,"upstream":[{"sha":"5376c9db45368eb210b4d71104ac00a59dc8b6e0","url":"https://git.kernel.org/stable/c/5376c9db45368eb210b4d71104ac00a59dc8b6e0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/074c715e0b498891c09fe7f11e1cd9d7a04699bd","label":"074c715e0b49","date":"2026-09-07T17:36:29+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"5376c9db45368eb210b4d71104ac00a59dc8b6e0","lines":125,"reason":"","source":"https://github.com/torvalds/linux/commit/5376c9db45368eb210b4d71104ac00a59dc8b6e0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89772","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89772.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89768","title":"fs: fix user path of nested backing files","status":"backported","project":false,"upstream":[{"sha":"f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d","url":"https://git.kernel.org/stable/c/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a35cc21355734e1acb89973d9be90ca8e4c3ed2f","label":"a35cc2135573","date":"2026-09-07T17:36:30+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89762","title":"apparmor: fix cred UAF caused by begin_current_label_crit_section()","status":"backported","project":false,"upstream":[{"sha":"3f4ae5fab613dca01d6a2a8210dd832e009fcf47","url":"https://git.kernel.org/stable/c/3f4ae5fab613dca01d6a2a8210dd832e009fcf47"}],"evidence":[{"url":"https://git.kernel.org/stable/c/580f777d6d9fd07fc034bd1aeba5c30fd48871a2","label":"580f777d6d9f","date":"2026-09-07T17:36:32+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3f4ae5fab613dca01d6a2a8210dd832e009fcf47","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89755","title":"mm/migrate_device: clear stale mapping after freeing swapcache","status":"backported","project":false,"upstream":[{"sha":"34a00895d032a414830d41106a09329ae6c251b6","url":"https://git.kernel.org/stable/c/34a00895d032a414830d41106a09329ae6c251b6"}],"evidence":[{"url":"https://git.kernel.org/stable/c/8ffedc6573a665cdc31ebe47eae7b32b78d0df83","label":"8ffedc6573a6","date":"2026-09-07T17:36:34+02:00","lore":["https://lore.kernel.org/20260728062832.1107127-1-arvind.yadav@intel.com"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"34a00895d032a414830d41106a09329ae6c251b6","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/34a00895d032a414830d41106a09329ae6c251b6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89755","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89755.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89739","title":"usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition","status":"backported","project":false,"upstream":[{"sha":"9c855832790cd488d87de1885974f4c37cfe7358","url":"https://git.kernel.org/stable/c/9c855832790cd488d87de1885974f4c37cfe7358"}],"evidence":[{"url":"https://git.kernel.org/stable/c/93e08b13a7a30e4e78556d993720e0bc36231ec7","label":"93e08b13a7a3","date":"2026-09-07T17:36:38+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"9c855832790cd488d87de1885974f4c37cfe7358","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/9c855832790cd488d87de1885974f4c37cfe7358.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89739","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89739.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89722","title":"PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()","status":"backported","project":false,"upstream":[{"sha":"dc76258d0132df1d831a5a29758bd448ca9c566e","url":"https://git.kernel.org/stable/c/dc76258d0132df1d831a5a29758bd448ca9c566e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7a99e9c7011905734cc2739038f2a224b6be0d1f","label":"7a99e9c70119","date":"2026-09-07T17:36:40+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"dc76258d0132df1d831a5a29758bd448ca9c566e","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/dc76258d0132df1d831a5a29758bd448ca9c566e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89722","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89722.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89708","title":"nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown","status":"backported","project":false,"upstream":[{"sha":"01c5d5f58a5db9b0ee5afba2e49d3157788687b2","url":"https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2"}],"evidence":[{"url":"https://git.kernel.org/stable/c/13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25","label":"13bdd486c3aa","date":"2026-09-07T17:36:42+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"01c5d5f58a5db9b0ee5afba2e49d3157788687b2","lines":324,"reason":"","source":"https://github.com/torvalds/linux/commit/01c5d5f58a5db9b0ee5afba2e49d3157788687b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89708","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89708.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89675","title":"nfsd: fix UAF in async copy cancel and shutdown","status":"backported","project":false,"upstream":[{"sha":"62c0f6eaf050bb9284c1f9cac6ed1770092e6b95","url":"https://git.kernel.org/stable/c/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95"}],"evidence":[{"url":"https://git.kernel.org/stable/c/a385cf5e016b748babf94cc664e43a26e17db117","label":"a385cf5e016b","date":"2026-09-07T17:36:45+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"62c0f6eaf050bb9284c1f9cac6ed1770092e6b95","lines":230,"reason":"","source":"https://github.com/torvalds/linux/commit/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89675","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89675.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89644","title":"btrfs: fix extent map leak in NOCOW direct I/O write","status":"backported","project":false,"upstream":[{"sha":"3f950867c307c5413d628a153ac44915bd117ffd","url":"https://git.kernel.org/stable/c/3f950867c307c5413d628a153ac44915bd117ffd"}],"evidence":[{"url":"https://git.kernel.org/stable/c/05a1a816eef8b3e4332620a64fc8cf45c4eb5c0d","label":"05a1a816eef8","date":"2026-09-07T17:36:48+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3f950867c307c5413d628a153ac44915bd117ffd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89644","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89644.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89639","title":"cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC","status":"backported","project":false,"upstream":[{"sha":"364b183230586a62660a7280c1eb20138338eeb5","url":"https://git.kernel.org/stable/c/364b183230586a62660a7280c1eb20138338eeb5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/81fc3868a7f726980ff845c1d0d271051e5f0f45","label":"81fc3868a7f7","date":"2026-09-07T17:36:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"364b183230586a62660a7280c1eb20138338eeb5","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/364b183230586a62660a7280c1eb20138338eeb5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89639","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89639.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89637","title":"smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2","status":"backported","project":false,"upstream":[{"sha":"730d0bb19507b9e19c2fe5343109ac618e2fbce5","url":"https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5e6533a683f6a851158d9f33fb4ea8f4f25d7f84","label":"5e6533a683f6","date":"2026-09-07T17:36:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"730d0bb19507b9e19c2fe5343109ac618e2fbce5","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/730d0bb19507b9e19c2fe5343109ac618e2fbce5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89637","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89637.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89633","title":"smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()","status":"backported","project":false,"upstream":[{"sha":"6343c1da561962688f203362d80d6a3bfa39fa1b","url":"https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b"}],"evidence":[{"url":"https://git.kernel.org/stable/c/033bc80019f07d158630df4e69b19a49010f54f1","label":"033bc80019f0","date":"2026-09-07T17:36:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6343c1da561962688f203362d80d6a3bfa39fa1b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89633","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89633.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89632","title":"smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()","status":"backported","project":false,"upstream":[{"sha":"05f78e6cf34ea3a285053bd5999e08e8ac298bd5","url":"https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5"}],"evidence":[{"url":"https://git.kernel.org/stable/c/711cf71300d7992f450600df8864917d3538679f","label":"711cf71300d7","date":"2026-09-07T17:36:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"05f78e6cf34ea3a285053bd5999e08e8ac298bd5","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/05f78e6cf34ea3a285053bd5999e08e8ac298bd5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89632","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89632.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89630","title":"smb: client: restore the data_offset bound in is_valid_oplock_break()","status":"backported","project":false,"upstream":[{"sha":"ba22f575de9deeae4ae0859ca4315a7698226237","url":"https://git.kernel.org/stable/c/ba22f575de9deeae4ae0859ca4315a7698226237"}],"evidence":[{"url":"https://git.kernel.org/stable/c/5b16a1967a01ad4496a7206a87c3eb16f1df2b05","label":"5b16a1967a01","date":"2026-09-07T17:36:49+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"ba22f575de9deeae4ae0859ca4315a7698226237","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/ba22f575de9deeae4ae0859ca4315a7698226237.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89630","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89630.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89611","title":"ntfs: validate non-resident attribute offsets","status":"backported","project":false,"upstream":[{"sha":"a83e82b0ec3ae523028e24813f23f18b43e8fc1c","url":"https://git.kernel.org/stable/c/a83e82b0ec3ae523028e24813f23f18b43e8fc1c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/cd7b3dc7557faadeea626034e3bac68a449851ef","label":"cd7b3dc7557f","date":"2026-09-07T17:36:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"a83e82b0ec3ae523028e24813f23f18b43e8fc1c","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/a83e82b0ec3ae523028e24813f23f18b43e8fc1c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89611","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89611.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89610","title":"ntfs: verify run length exceeding volume boundary","status":"backported","project":false,"upstream":[{"sha":"fea9e4488f384c0ef1c0e3d96b565127c1b98447","url":"https://git.kernel.org/stable/c/fea9e4488f384c0ef1c0e3d96b565127c1b98447"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6e844d4b82434a781b80d02145fd1b17cf90e3c3","label":"6e844d4b8243","date":"2026-09-07T17:36:51+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable range ended","review":null,"size":{"status":"within-limit","patches":[{"sha":"fea9e4488f384c0ef1c0e3d96b565127c1b98447","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/fea9e4488f384c0ef1c0e3d96b565127c1b98447.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89610","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89610.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89584","title":"block: validate user space vectors during extraction","status":"backported","project":false,"upstream":[{"sha":"14b007e178811db72fbb1ebb3535160db6ec1e6a","url":"https://git.kernel.org/stable/c/14b007e178811db72fbb1ebb3535160db6ec1e6a"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d44a97a3b1c00cc571245124e23e5ceb0a0225a0","label":"d44a97a3b1c0","date":"2026-09-07T17:36:55+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"14b007e178811db72fbb1ebb3535160db6ec1e6a","lines":168,"reason":"","source":"https://github.com/torvalds/linux/commit/14b007e178811db72fbb1ebb3535160db6ec1e6a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89584","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89584.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89568","title":"kho: fix size calculation in kho_preserved_memory_reserve()","status":"backported","project":false,"upstream":[{"sha":"3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded","url":"https://git.kernel.org/stable/c/3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded"}],"evidence":[{"url":"https://git.kernel.org/stable/c/42a6f03cf352eb6e6dbeef95e75e686f4cdb9bd1","label":"42a6f03cf352","date":"2026-09-07T17:36:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3a0b8fa2eb36afc88b62a95f33f0c77c71fa5ded.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89568","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89568.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89567","title":"jbd2: bound shrinker scans by examined checkpoint buffers","status":"backported","project":false,"upstream":[{"sha":"15cb16496446b94e67f7abcb049b8e2c75cd3d02","url":"https://git.kernel.org/stable/c/15cb16496446b94e67f7abcb049b8e2c75cd3d02"}],"evidence":[{"url":"https://git.kernel.org/stable/c/c2c0fb364685b8996c357d3b050394959b29d6e0","label":"c2c0fb364685","date":"2026-09-07T17:36:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"15cb16496446b94e67f7abcb049b8e2c75cd3d02","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/15cb16496446b94e67f7abcb049b8e2c75cd3d02.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89567","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89567.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89566","title":"jbd2: check need_resched() when skipping busy checkpoint buffers","status":"backported","project":false,"upstream":[{"sha":"f213e12ff5c9590b1034ae8da0e6d09665c772d0","url":"https://git.kernel.org/stable/c/f213e12ff5c9590b1034ae8da0e6d09665c772d0"}],"evidence":[{"url":"https://git.kernel.org/stable/c/595cac7f1b32d009b97f83dd2b2d6a1a445e9bb4","label":"595cac7f1b32","date":"2026-09-07T17:36:58+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"f213e12ff5c9590b1034ae8da0e6d09665c772d0","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/f213e12ff5c9590b1034ae8da0e6d09665c772d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89566","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89566.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89545","title":"sunrpc: defer rq_argp and rq_resp free until after RCU grace period","status":"backported","project":false,"upstream":[{"sha":"c479bde671cbe2f9e152834a8b0eb7c3c295bbaf","url":"https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf"}],"evidence":[{"url":"https://git.kernel.org/stable/c/e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090","label":"e0c5693d3f9a","date":"2026-09-07T17:37:00+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"c479bde671cbe2f9e152834a8b0eb7c3c295bbaf","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89545","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89545.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89534","title":"svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails","status":"backported","project":false,"upstream":[{"sha":"01500306e1d50de7ca7a2cdcdfa28ac0523eb747","url":"https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747"}],"evidence":[{"url":"https://git.kernel.org/stable/c/673e358ab7c11f8cec223c6a36a793056a67facd","label":"673e358ab7c1","date":"2026-09-07T17:37:01+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"01500306e1d50de7ca7a2cdcdfa28ac0523eb747","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/01500306e1d50de7ca7a2cdcdfa28ac0523eb747.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89534","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89534.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-89451","title":"iommu/sva: Set handle->dev before the SVA handle is visible","status":"backported","project":false,"upstream":[{"sha":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","url":"https://git.kernel.org/stable/c/530f8f9c3546cb3ebee1b135375aaee08a073ebb"}],"evidence":[{"url":"https://git.kernel.org/stable/c/37a96a30617a4c96f048a5874c00509bc4fe4d85","label":"37a96a30617a","date":"2026-09-07T17:37:13+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/530f8f9c3546cb3ebee1b135375aaee08a073ebb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-89451","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-89451.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-81016","title":"platform/x86/amd/pmc: Propagate SMU errors and validate S2D address","status":"backported","project":false,"upstream":[{"sha":"0225c1d637687b03726f00ac65b6def843d2c464","url":"https://git.kernel.org/stable/c/0225c1d637687b03726f00ac65b6def843d2c464"}],"evidence":[{"url":"https://git.kernel.org/stable/c/775d4cde1f9737796ce7d8393521e9e8c5b49891","label":"775d4cde1f97","date":"2026-09-07T17:37:16+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"0225c1d637687b03726f00ac65b6def843d2c464","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81016","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-81016.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-81010","title":"io_uring/waitid: honor task_work cancellation","status":"backported","project":false,"upstream":[{"sha":"14572de82e5022899e5856008bc9cac97004a88c","url":"https://git.kernel.org/stable/c/14572de82e5022899e5856008bc9cac97004a88c"}],"evidence":[{"url":"https://git.kernel.org/stable/c/7bc98e2de8c58a2bfaf0f540eb096a386ecfc96c","label":"7bc98e2de8c5","date":"2026-09-07T17:37:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"14572de82e5022899e5856008bc9cac97004a88c","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/14572de82e5022899e5856008bc9cac97004a88c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-81010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80999","title":"net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO","status":"backported","project":false,"upstream":[{"sha":"fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc","url":"https://git.kernel.org/stable/c/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1610a8c2b93e815e3dc8643a2a69ab1c37975a6a","label":"1610a8c2b93e","date":"2026-09-07T17:37:18+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/fb58b6a696b30bcbfbe0cfc0a91b19c816a955fc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80990","title":"net: thunderbolt: Release the Rx HopID that was handed out on mismatch","status":"backported","project":false,"upstream":[{"sha":"2f1463554d0561a2fead81e3888604e5c1125e29","url":"https://git.kernel.org/stable/c/2f1463554d0561a2fead81e3888604e5c1125e29"}],"evidence":[{"url":"https://git.kernel.org/stable/c/1c361f6cf39be7cc0ce37c0b67bd1cdf74b0a0c1","label":"1c361f6cf39b","date":"2026-09-07T17:37:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"2f1463554d0561a2fead81e3888604e5c1125e29","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80989","title":"net: thunderbolt: Mark the connection down when bringing it up fails","status":"backported","project":false,"upstream":[{"sha":"3c8b26ebf525ba5960510f48c6e9936a79ebe76f","url":"https://git.kernel.org/stable/c/3c8b26ebf525ba5960510f48c6e9936a79ebe76f"}],"evidence":[{"url":"https://git.kernel.org/stable/c/d6c0af293129345a17dc31c9b4179dc7f3d6af7a","label":"d6c0af293129","date":"2026-09-07T17:37:19+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"3c8b26ebf525ba5960510f48c6e9936a79ebe76f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80989","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80989.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80947","title":"wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop","status":"backported","project":false,"upstream":[{"sha":"6c080026ecc17eecb103f8927c64ea73a74bb818","url":"https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818"}],"evidence":[{"url":"https://git.kernel.org/stable/c/972ab8b9c08f3eb3fa535082de2950dd93604dfd","label":"972ab8b9c08f","date":"2026-09-07T17:37:25+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"unknown","patches":[{"sha":"6c080026ecc17eecb103f8927c64ea73a74bb818","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80920","title":"io_uring: defer eventfd signaling when queued from a wakeup handler","status":"backported","project":false,"upstream":[{"sha":"cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e","url":"https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e"}],"evidence":[{"url":"https://git.kernel.org/stable/c/40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a","label":"40b6ccf68731","date":"2026-08-27T14:35:22+02:00","lore":["https://lore.kernel.org/all/20260813133843.2933127-1-4ncienth@gmail.com/"]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"over-limit","patches":[{"sha":"cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e","lines":163,"reason":"","source":"https://github.com/torvalds/linux/commit/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80899","title":"erofs: remove fscache backend entirely","status":"backported","project":false,"upstream":[{"sha":"c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56","url":"https://git.kernel.org/stable/c/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56","lines":1137,"reason":"","source":"https://github.com/torvalds/linux/commit/c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80872","title":"ALSA: hda/tas2781: Cancel async firmware request at unbind","status":"backported","project":false,"upstream":[{"sha":"5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9","url":"https://git.kernel.org/stable/c/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80862","title":"nvme-tcp: fix usage of page_frag_cache","status":"backported","project":false,"upstream":[{"sha":"36ac05f7cfd59d90c597071304b14e98090d5dd1","url":"https://git.kernel.org/stable/c/36ac05f7cfd59d90c597071304b14e98090d5dd1"}],"evidence":[{"url":"https://git.kernel.org/stable/c/6e4cf281558709b92ec2ca3054fe2ffc69266ef9","label":"6e4cf2815587","date":"2026-09-02T14:33:17+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"36ac05f7cfd59d90c597071304b14e98090d5dd1","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/36ac05f7cfd59d90c597071304b14e98090d5dd1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80820","title":"xfs: don't livelock in scrub on a circular unlinked list","status":"backported","project":false,"upstream":[{"sha":"527eaaefddb6ec5c83a06c9a1559960dd6361753","url":"https://git.kernel.org/stable/c/527eaaefddb6ec5c83a06c9a1559960dd6361753"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"527eaaefddb6ec5c83a06c9a1559960dd6361753","lines":149,"reason":"","source":"https://github.com/torvalds/linux/commit/527eaaefddb6ec5c83a06c9a1559960dd6361753.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80820","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80820.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80785","title":"fbdev: serialize mode sysfs access with lock_fb_info()","status":"backported","project":false,"upstream":[{"sha":"061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2","url":"https://git.kernel.org/stable/c/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80785","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80785.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80771","title":"HID: nintendo: register input device after capabilities are set","status":"backported","project":false,"upstream":[{"sha":"d723bc1fe2e72b9252234e94c11af644ec477bf7","url":"https://git.kernel.org/stable/c/d723bc1fe2e72b9252234e94c11af644ec477bf7"}],"evidence":[{"url":"https://git.kernel.org/stable/c/27dc4b8eadac73b3c3cc526c8547d8b4ae8528be","label":"27dc4b8eadac","date":"2026-08-27T14:35:26+02:00","lore":[]}],"submission_lore":[],"basis":"CNA stable fixed range","review":null,"size":{"status":"within-limit","patches":[{"sha":"d723bc1fe2e72b9252234e94c11af644ec477bf7","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/d723bc1fe2e72b9252234e94c11af644ec477bf7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80771","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80771.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80721","title":"Bluetooth: ISO: ensure no dangling hcon references in iso_conn","status":"backported","project":false,"upstream":[{"sha":"aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb","url":"https://git.kernel.org/stable/c/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80721","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80721.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80705","title":"drm/amd/display: check if dml21_add_phantom_plane() is successful","status":"backported","project":false,"upstream":[{"sha":"000acb4ce7fb9feba3072ce468ad681f6585cd5d","url":"https://git.kernel.org/stable/c/000acb4ce7fb9feba3072ce468ad681f6585cd5d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"000acb4ce7fb9feba3072ce468ad681f6585cd5d","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/000acb4ce7fb9feba3072ce468ad681f6585cd5d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80705","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80705.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80704","title":"drm/amd/display: use proper context for logging","status":"backported","project":false,"upstream":[{"sha":"114b42507b6a23d9d24e24e4ef165233332c64d4","url":"https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"114b42507b6a23d9d24e24e4ef165233332c64d4","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/114b42507b6a23d9d24e24e4ef165233332c64d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80704","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80704.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80685","title":"mm/util: don't read __page_2 for order-1 folios in snapshot_page()","status":"backported","project":false,"upstream":[{"sha":"7441d6348c70738e9ed307510db171c7a9b3f4bf","url":"https://git.kernel.org/stable/c/7441d6348c70738e9ed307510db171c7a9b3f4bf"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7441d6348c70738e9ed307510db171c7a9b3f4bf","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7441d6348c70738e9ed307510db171c7a9b3f4bf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80685","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80685.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80676","title":"Drivers: hv: vmbus: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"331d8900121a1d74ecd45cd2db742ddcb5a0a565","url":"https://git.kernel.org/stable/c/331d8900121a1d74ecd45cd2db742ddcb5a0a565"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"331d8900121a1d74ecd45cd2db742ddcb5a0a565","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/331d8900121a1d74ecd45cd2db742ddcb5a0a565.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80676","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80676.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80670","title":"perf tools: Use perf_env__get_cpu_topology() in machine__resolve()","status":"backported","project":false,"upstream":[{"sha":"5484b43a0ec8231c36fba6ead654cb72dbba8b8f","url":"https://git.kernel.org/stable/c/5484b43a0ec8231c36fba6ead654cb72dbba8b8f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5484b43a0ec8231c36fba6ead654cb72dbba8b8f","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/5484b43a0ec8231c36fba6ead654cb72dbba8b8f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80670","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80670.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80668","title":"netfilter: nf_conntrack_expect: use conntrack GC to reap expectations","status":"backported","project":false,"upstream":[{"sha":"b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2","url":"https://git.kernel.org/stable/c/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2","lines":512,"reason":"","source":"https://github.com/torvalds/linux/commit/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80668","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80668.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80657","title":"accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer","status":"backported","project":false,"upstream":[{"sha":"506255d46bdb93a281cf39e72abbca124f5c7a1b","url":"https://git.kernel.org/stable/c/506255d46bdb93a281cf39e72abbca124f5c7a1b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"506255d46bdb93a281cf39e72abbca124f5c7a1b","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/506255d46bdb93a281cf39e72abbca124f5c7a1b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80657","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80657.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80650","title":"media: atomisp: gc2235: fix UAF and memory leak","status":"backported","project":false,"upstream":[{"sha":"628f763aee0047ff44974388d6f70f75a763026b","url":"https://git.kernel.org/stable/c/628f763aee0047ff44974388d6f70f75a763026b"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","url":"https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"628f763aee0047ff44974388d6f70f75a763026b","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/628f763aee0047ff44974388d6f70f75a763026b.patch"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","lines":168072,"reason":"","source":"https://github.com/torvalds/linux/commit/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80650","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80650.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80636","title":"netfilter: conntrack: revert ct extension genid infrastructure","status":"backported","project":false,"upstream":[{"sha":"35e21a4dccc5c255ba59ccfbfeb4629ed21da972","url":"https://git.kernel.org/stable/c/35e21a4dccc5c255ba59ccfbfeb4629ed21da972"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"35e21a4dccc5c255ba59ccfbfeb4629ed21da972","lines":183,"reason":"","source":"https://github.com/torvalds/linux/commit/35e21a4dccc5c255ba59ccfbfeb4629ed21da972.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80636","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80636.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80634","title":"netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag","status":"backported","project":false,"upstream":[{"sha":"e052f920773b73be49eb4d8702a9f85de7464363","url":"https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e052f920773b73be49eb4d8702a9f85de7464363","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80611","title":"ACPI: processor_idle: Mark LPI enter functions as __cpuidle","status":"backported","project":false,"upstream":[{"sha":"956ca5d72c76504824c8eb601879da9476973e15","url":"https://git.kernel.org/stable/c/956ca5d72c76504824c8eb601879da9476973e15"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"956ca5d72c76504824c8eb601879da9476973e15","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80611","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80611.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80580","title":"fbdev: bound mode sysfs output to the sysfs buffer","status":"backported","project":false,"upstream":[{"sha":"d15d51fb26e830af58f3f21964f1c09c239077ea","url":"https://git.kernel.org/stable/c/d15d51fb26e830af58f3f21964f1c09c239077ea"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d15d51fb26e830af58f3f21964f1c09c239077ea","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/d15d51fb26e830af58f3f21964f1c09c239077ea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80580","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80580.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80579","title":"fbdev: clear fb_info->mode before deleting a videomode","status":"backported","project":false,"upstream":[{"sha":"95e647d2a5304a8fd11f1ba3c8502de700650131","url":"https://git.kernel.org/stable/c/95e647d2a5304a8fd11f1ba3c8502de700650131"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"95e647d2a5304a8fd11f1ba3c8502de700650131","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/95e647d2a5304a8fd11f1ba3c8502de700650131.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80579","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80579.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80556","title":"mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition","status":"backported","project":false,"upstream":[{"sha":"c125ee35a49a0518521b52b27631eef061b8719a","url":"https://git.kernel.org/stable/c/c125ee35a49a0518521b52b27631eef061b8719a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c125ee35a49a0518521b52b27631eef061b8719a","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/c125ee35a49a0518521b52b27631eef061b8719a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80556","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80556.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80546","title":"s390/zcrypt: Improve CCA CPRB length and overflow checks","status":"backported","project":false,"upstream":[{"sha":"35ac6754ba6da45fd193f5ce3f665f7490b830d5","url":"https://git.kernel.org/stable/c/35ac6754ba6da45fd193f5ce3f665f7490b830d5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"35ac6754ba6da45fd193f5ce3f665f7490b830d5","lines":110,"reason":"","source":"https://github.com/torvalds/linux/commit/35ac6754ba6da45fd193f5ce3f665f7490b830d5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80546","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80546.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80545","title":"s390/zcrypt: Improve EP11 CPRB length and overflow checks","status":"backported","project":false,"upstream":[{"sha":"17ac0bc866fc624cd05f022dcd8b730c0af11bb1","url":"https://git.kernel.org/stable/c/17ac0bc866fc624cd05f022dcd8b730c0af11bb1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"17ac0bc866fc624cd05f022dcd8b730c0af11bb1","lines":197,"reason":"","source":"https://github.com/torvalds/linux/commit/17ac0bc866fc624cd05f022dcd8b730c0af11bb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80545","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80545.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80544","title":"s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing","status":"backported","project":false,"upstream":[{"sha":"0864a163783bff109b548266921829ea794edc93","url":"https://git.kernel.org/stable/c/0864a163783bff109b548266921829ea794edc93"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"0864a163783bff109b548266921829ea794edc93","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/0864a163783bff109b548266921829ea794edc93.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80544","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80544.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80543","title":"s390/zcrypt: Pad trailing CCA or EP11 message with zeros","status":"backported","project":false,"upstream":[{"sha":"eb363254472493e3458156fc11fd56dca92f4333","url":"https://git.kernel.org/stable/c/eb363254472493e3458156fc11fd56dca92f4333"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb363254472493e3458156fc11fd56dca92f4333","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/eb363254472493e3458156fc11fd56dca92f4333.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80543","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80543.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-80521","title":"af_unix: Unlink scc_entry in unix_del_edge().","status":"backported","project":false,"upstream":[{"sha":"594d905195024b228c962627ae5ae7c17bd582a4","url":"https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"594d905195024b228c962627ae5ae7c17bd582a4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-80521","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-80521.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74752","title":"sctp: validate cookie AUTH state before use","status":"backported","project":false,"upstream":[{"sha":"3dbb44d88b1e94dd31fe43588af7437b34b44d56","url":"https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"3dbb44d88b1e94dd31fe43588af7437b34b44d56","lines":105,"reason":"","source":"https://github.com/torvalds/linux/commit/3dbb44d88b1e94dd31fe43588af7437b34b44d56.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74735","title":"l2tp: fix tunnel and session refcount leak on seq_file release","status":"backported","project":false,"upstream":[{"sha":"9006c116dd111d457bf5d074990210f70a4ad2c8","url":"https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9006c116dd111d457bf5d074990210f70a4ad2c8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74735","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74735.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74725","title":"enic: fix tx_hang_reset use-after-free on device removal","status":"backported","project":false,"upstream":[{"sha":"ec680ea4ba1bca92a767fb7e7869758bfdd886e3","url":"https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ec680ea4ba1bca92a767fb7e7869758bfdd886e3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/ec680ea4ba1bca92a767fb7e7869758bfdd886e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74725","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74725.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74677","title":"net: usb: ipheth: fix carrier_work UAF on disconnect","status":"backported","project":false,"upstream":[{"sha":"fde39b8a521780391fb4e5bda2c0aa4928947f12","url":"https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"fde39b8a521780391fb4e5bda2c0aa4928947f12","lines":29,"reason":"","source":"https://github.com/torvalds/linux/commit/fde39b8a521780391fb4e5bda2c0aa4928947f12.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74677","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74677.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74653","title":"serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx","status":"backported","project":false,"upstream":[{"sha":"1423415471274abda87024967d7fe2206ceee0ea","url":"https://git.kernel.org/stable/c/1423415471274abda87024967d7fe2206ceee0ea"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1423415471274abda87024967d7fe2206ceee0ea","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/1423415471274abda87024967d7fe2206ceee0ea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74653","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74653.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74638","title":"drm/v3d: Serialize the scheduler timeout handlers","status":"backported","project":false,"upstream":[{"sha":"4da94744707b27a3ae1197bdd7127da4505dc5b1","url":"https://git.kernel.org/stable/c/4da94744707b27a3ae1197bdd7127da4505dc5b1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4da94744707b27a3ae1197bdd7127da4505dc5b1","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/4da94744707b27a3ae1197bdd7127da4505dc5b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74638","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74638.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74592","title":"ima: Instantiate file_truncate and path_truncate hooks","status":"backported","project":false,"upstream":[{"sha":"b80bed5c871a80151351342c065579405ce77145","url":"https://git.kernel.org/stable/c/b80bed5c871a80151351342c065579405ce77145"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b80bed5c871a80151351342c065579405ce77145","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/b80bed5c871a80151351342c065579405ce77145.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74592","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74592.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74560","title":"xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx","status":"backported","project":false,"upstream":[{"sha":"a3c8382ebce4780c6b3ace2c09bc342313ac0186","url":"https://git.kernel.org/stable/c/a3c8382ebce4780c6b3ace2c09bc342313ac0186"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a3c8382ebce4780c6b3ace2c09bc342313ac0186","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/a3c8382ebce4780c6b3ace2c09bc342313ac0186.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74560","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74560.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74559","title":"xsk: drain continuation descs after overflow in xsk_build_skb()","status":"backported","project":false,"upstream":[{"sha":"bd44a6dcd4248883de90f5dad53ae80066e27096","url":"https://git.kernel.org/stable/c/bd44a6dcd4248883de90f5dad53ae80066e27096"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"bd44a6dcd4248883de90f5dad53ae80066e27096","lines":97,"reason":"","source":"https://github.com/torvalds/linux/commit/bd44a6dcd4248883de90f5dad53ae80066e27096.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74559","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74559.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74558","title":"xsk: reclaim invalid Tx descriptors in ZC batch path","status":"backported","project":false,"upstream":[{"sha":"72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","url":"https://git.kernel.org/stable/c/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","lines":404,"reason":"","source":"https://github.com/torvalds/linux/commit/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74558","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74558.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74536","title":"Bluetooth: ISO: fix leaking sk after socket release","status":"backported","project":false,"upstream":[{"sha":"ce57442a379212fe3fda59c9437ee8217eceb5b1","url":"https://git.kernel.org/stable/c/ce57442a379212fe3fda59c9437ee8217eceb5b1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ce57442a379212fe3fda59c9437ee8217eceb5b1","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/ce57442a379212fe3fda59c9437ee8217eceb5b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74536","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74536.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74533","title":"Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero","status":"backported","project":false,"upstream":[{"sha":"af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","url":"https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","lines":170,"reason":"","source":"https://github.com/torvalds/linux/commit/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74533","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74533.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74531","title":"Bluetooth: hci_conn: hold conn reference in abort_conn_sync()","status":"backported","project":false,"upstream":[{"sha":"5761d003daa987ac81463f570713ce9c9dd204e5","url":"https://git.kernel.org/stable/c/5761d003daa987ac81463f570713ce9c9dd204e5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5761d003daa987ac81463f570713ce9c9dd204e5","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/5761d003daa987ac81463f570713ce9c9dd204e5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74531","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74531.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74521","title":"ksmbd: use memcmp() to compare ClientGUIDs","status":"backported","project":false,"upstream":[{"sha":"e8bb506e6ef749ac0336f3e579d8d02396b7d832","url":"https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e8bb506e6ef749ac0336f3e579d8d02396b7d832","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74521","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74521.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74513","title":"dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister","status":"backported","project":false,"upstream":[{"sha":"a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","url":"https://git.kernel.org/stable/c/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74513","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74513.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74506","title":"afs: Fix UAF when sending a message","status":"backported","project":false,"upstream":[{"sha":"4af1ec68d54b3871155914d584fb10669c41a861","url":"https://git.kernel.org/stable/c/4af1ec68d54b3871155914d584fb10669c41a861"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4af1ec68d54b3871155914d584fb10669c41a861","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/4af1ec68d54b3871155914d584fb10669c41a861.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74506","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74506.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74449","title":"drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport","status":"backported","project":false,"upstream":[{"sha":"f327e389c07cfc3a2f6ff54f6214e1a52d457edc","url":"https://git.kernel.org/stable/c/f327e389c07cfc3a2f6ff54f6214e1a52d457edc"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"f327e389c07cfc3a2f6ff54f6214e1a52d457edc","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/f327e389c07cfc3a2f6ff54f6214e1a52d457edc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74419","title":"accel/amdxdna: Adjust size for copy_to_user()","status":"backported","project":false,"upstream":[{"sha":"6e87001fe19f251e2ae14373bc76554358a13df2","url":"https://git.kernel.org/stable/c/6e87001fe19f251e2ae14373bc76554358a13df2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"6e87001fe19f251e2ae14373bc76554358a13df2","lines":264,"reason":"","source":"https://github.com/torvalds/linux/commit/6e87001fe19f251e2ae14373bc76554358a13df2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74419","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74419.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74407","title":"wifi: ath11k: cancel SSR work items during PCI shutdown","status":"backported","project":false,"upstream":[{"sha":"8c79aac429b583301f387374ff37c59be671df87","url":"https://git.kernel.org/stable/c/8c79aac429b583301f387374ff37c59be671df87"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"8c79aac429b583301f387374ff37c59be671df87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74407","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74407.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74374","title":"md/raid1,raid10: fix error-path detection with md_cloned_bio()","status":"backported","project":false,"upstream":[{"sha":"811545e0926d02a6a0b1a1258bb5544777c164d4","url":"https://git.kernel.org/stable/c/811545e0926d02a6a0b1a1258bb5544777c164d4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"811545e0926d02a6a0b1a1258bb5544777c164d4","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/811545e0926d02a6a0b1a1258bb5544777c164d4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74374","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74374.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74368","title":"wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()","status":"backported","project":false,"upstream":[{"sha":"98d4f92ab6a1af2ea2ab590d7e2801b203110981","url":"https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"98d4f92ab6a1af2ea2ab590d7e2801b203110981","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/98d4f92ab6a1af2ea2ab590d7e2801b203110981.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74368","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74368.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74354","title":"bpf: Take mmap_lock in zap_pages()","status":"backported","project":false,"upstream":[{"sha":"80b89d0226a05e8b67969de99c31b51fcd54f76a","url":"https://git.kernel.org/stable/c/80b89d0226a05e8b67969de99c31b51fcd54f76a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"80b89d0226a05e8b67969de99c31b51fcd54f76a","lines":93,"reason":"","source":"https://github.com/torvalds/linux/commit/80b89d0226a05e8b67969de99c31b51fcd54f76a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74354","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74354.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74342","title":"kernfs: link kn to its parent before the LSM init hook","status":"backported","project":false,"upstream":[{"sha":"6cccc49b027c7551ffc1d2532f2ef1922661f3da","url":"https://git.kernel.org/stable/c/6cccc49b027c7551ffc1d2532f2ef1922661f3da"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6cccc49b027c7551ffc1d2532f2ef1922661f3da","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/6cccc49b027c7551ffc1d2532f2ef1922661f3da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74342","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74342.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74337","title":"bpf: Fix NMI/tracepoint re-entry deadlock on lru locks","status":"backported","project":false,"upstream":[{"sha":"89edbdfc5d0308cef57b71359331de5c4ddbf763","url":"https://git.kernel.org/stable/c/89edbdfc5d0308cef57b71359331de5c4ddbf763"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"89edbdfc5d0308cef57b71359331de5c4ddbf763","lines":402,"reason":"","source":"https://github.com/torvalds/linux/commit/89edbdfc5d0308cef57b71359331de5c4ddbf763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74336","title":"wifi: mac80211: bound S1G TIM PVB walk to the TIM element","status":"backported","project":false,"upstream":[{"sha":"b224d18b1e5d1cddfc67f63f41d80023b2ec8889","url":"https://git.kernel.org/stable/c/b224d18b1e5d1cddfc67f63f41d80023b2ec8889"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b224d18b1e5d1cddfc67f63f41d80023b2ec8889","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b224d18b1e5d1cddfc67f63f41d80023b2ec8889.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74336","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74336.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74324","title":"wifi: mt76: mt7925: validate skb length in testmode query","status":"backported","project":false,"upstream":[{"sha":"c7369a00860a0704461d440e7c3bf9b49bfdbaee","url":"https://git.kernel.org/stable/c/c7369a00860a0704461d440e7c3bf9b49bfdbaee"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7369a00860a0704461d440e7c3bf9b49bfdbaee","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/c7369a00860a0704461d440e7c3bf9b49bfdbaee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74324","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74324.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74314","title":"bpf: Cancel special fields on map value recycle","status":"backported","project":false,"upstream":[{"sha":"a3a81d247651218e47153f2d2afd7aee236726fd","url":"https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"a3a81d247651218e47153f2d2afd7aee236726fd","lines":471,"reason":"","source":"https://github.com/torvalds/linux/commit/a3a81d247651218e47153f2d2afd7aee236726fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74314","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74314.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74294","title":"ASoC: meson: aiu: Validate written enum values","status":"backported","project":false,"upstream":[{"sha":"d65adf85477247be04ac86886f8edfaa047b5d4a","url":"https://git.kernel.org/stable/c/d65adf85477247be04ac86886f8edfaa047b5d4a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d65adf85477247be04ac86886f8edfaa047b5d4a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74294","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74294.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74291","title":"ASoC: topology: Check PCM and DAI name strings before use","status":"backported","project":false,"upstream":[{"sha":"b7e44d1986d6671342c19b82192189ca5db5dab7","url":"https://git.kernel.org/stable/c/b7e44d1986d6671342c19b82192189ca5db5dab7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"b7e44d1986d6671342c19b82192189ca5db5dab7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74291","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74291.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74289","title":"ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().","status":"backported","project":false,"upstream":[{"sha":"06b693d2eb6651a63ad85bad8673de3b7d4edd6d","url":"https://git.kernel.org/stable/c/06b693d2eb6651a63ad85bad8673de3b7d4edd6d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"06b693d2eb6651a63ad85bad8673de3b7d4edd6d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74272","title":"cxl/region: Resolve region deletion races","status":"backported","project":false,"upstream":[{"sha":"4dd86ca99ffcc413cbf79063fd9956ef54e0ca91","url":"https://git.kernel.org/stable/c/4dd86ca99ffcc413cbf79063fd9956ef54e0ca91"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"4dd86ca99ffcc413cbf79063fd9956ef54e0ca91","lines":176,"reason":"","source":"https://github.com/torvalds/linux/commit/4dd86ca99ffcc413cbf79063fd9956ef54e0ca91.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74272","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74272.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74269","title":"bnxt: fix head underflow on XDP head-grow","status":"backported","project":false,"upstream":[{"sha":"e26657fe3b85c068b01f42bb0c602f242d643ba9","url":"https://git.kernel.org/stable/c/e26657fe3b85c068b01f42bb0c602f242d643ba9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e26657fe3b85c068b01f42bb0c602f242d643ba9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74269","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74269.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-74258","title":"bpf: Guard __get_user acesss with access_ok for uprobe_multi data","status":"backported","project":false,"upstream":[{"sha":"4d87a251d45b4a95eb4c0abcfab809c9f231258a","url":"https://git.kernel.org/stable/c/4d87a251d45b4a95eb4c0abcfab809c9f231258a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"4d87a251d45b4a95eb4c0abcfab809c9f231258a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-74258","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-74258.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72501","title":"RDMA/bnxt_re: Initialize dpi variable to zero","status":"backported","project":false,"upstream":[{"sha":"978b27d6ce538bb832ccd69e45802824e4301c4b","url":"https://git.kernel.org/stable/c/978b27d6ce538bb832ccd69e45802824e4301c4b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"978b27d6ce538bb832ccd69e45802824e4301c4b","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/978b27d6ce538bb832ccd69e45802824e4301c4b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72501","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72501.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72496","title":"RDMA/bnxt_re: Proper rollback if the ioremap fails","status":"backported","project":false,"upstream":[{"sha":"87267803a8c824616eb147c5dad7030a5db6f878","url":"https://git.kernel.org/stable/c/87267803a8c824616eb147c5dad7030a5db6f878"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"87267803a8c824616eb147c5dad7030a5db6f878","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72496","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72496.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72494","title":"RDMA/irdma: Replace waitqueue and flag with completion","status":"backported","project":false,"upstream":[{"sha":"d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd","url":"https://git.kernel.org/stable/c/d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72494","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72494.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72493","title":"net: serialize netif_running() check in enqueue_to_backlog()","status":"backported","project":false,"upstream":[{"sha":"46762cefe7f4e5bffc1eb467810a7bbb02e461d7","url":"https://git.kernel.org/stable/c/46762cefe7f4e5bffc1eb467810a7bbb02e461d7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"46762cefe7f4e5bffc1eb467810a7bbb02e461d7","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/46762cefe7f4e5bffc1eb467810a7bbb02e461d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72485","title":"coresight: platform: defer connection counter increment until alloc succeeds","status":"backported","project":false,"upstream":[{"sha":"1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae","url":"https://git.kernel.org/stable/c/1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72485","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72485.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72472","title":"nfs: use nfsi->rwsem to protect traversal of the file lock list","status":"backported","project":false,"upstream":[{"sha":"4837fb36219e6c08b666bc31a86841bad8526358","url":"https://git.kernel.org/stable/c/4837fb36219e6c08b666bc31a86841bad8526358"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4837fb36219e6c08b666bc31a86841bad8526358","lines":87,"reason":"","source":"https://github.com/torvalds/linux/commit/4837fb36219e6c08b666bc31a86841bad8526358.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72472","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72472.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72469","title":"xprtrdma: Fix ep kref imbalance on ADDR_CHANGE","status":"backported","project":false,"upstream":[{"sha":"af9b65b29af341932625c4283dc7a23cdb62688a","url":"https://git.kernel.org/stable/c/af9b65b29af341932625c4283dc7a23cdb62688a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"af9b65b29af341932625c4283dc7a23cdb62688a","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/af9b65b29af341932625c4283dc7a23cdb62688a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72469","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72469.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72463","title":"xfrm: Fix dev use-after-free in xfrm async resumption","status":"backported","project":false,"upstream":[{"sha":"8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff","url":"https://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff","lines":115,"reason":"","source":"https://github.com/torvalds/linux/commit/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72463","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72463.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72454","title":"i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()","status":"backported","project":false,"upstream":[{"sha":"650716f23eac488c6696babdc7805f6a6b7427ad","url":"https://git.kernel.org/stable/c/650716f23eac488c6696babdc7805f6a6b7427ad"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"650716f23eac488c6696babdc7805f6a6b7427ad","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/650716f23eac488c6696babdc7805f6a6b7427ad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72454","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72454.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72438","title":"md/raid10: fix writes_pending and barrier reference leaks on discard failures","status":"backported","project":false,"upstream":[{"sha":"393d687131d8aa8c7e4de2cb494438e145d20fc2","url":"https://git.kernel.org/stable/c/393d687131d8aa8c7e4de2cb494438e145d20fc2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"393d687131d8aa8c7e4de2cb494438e145d20fc2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72438","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72438.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72434","title":"netfilter: ipset: make sure gc is properly stopped","status":"backported","project":false,"upstream":[{"sha":"4a597a87e2e2f608edb6be2c510dc826b4fdfb53","url":"https://git.kernel.org/stable/c/4a597a87e2e2f608edb6be2c510dc826b4fdfb53"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4a597a87e2e2f608edb6be2c510dc826b4fdfb53","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/4a597a87e2e2f608edb6be2c510dc826b4fdfb53.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72434","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72434.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72413","title":"sctp: fix err_chunk memory leaks in INIT handling","status":"backported","project":false,"upstream":[{"sha":"9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2","url":"https://git.kernel.org/stable/c/9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72413","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72413.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72402","title":"bpf: Mask pseudo pointer values in verifier logs","status":"backported","project":false,"upstream":[{"sha":"72a85e9464a5332fb2cd7efd26d9295275ceda2d","url":"https://git.kernel.org/stable/c/72a85e9464a5332fb2cd7efd26d9295275ceda2d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"72a85e9464a5332fb2cd7efd26d9295275ceda2d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72402","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72402.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72397","title":"hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()","status":"backported","project":false,"upstream":[{"sha":"828cd614e2af053ca5e1d6da767bbd8a1b5cabfb","url":"https://git.kernel.org/stable/c/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"828cd614e2af053ca5e1d6da767bbd8a1b5cabfb","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72397","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72397.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72377","title":"afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints","status":"backported","project":false,"upstream":[{"sha":"81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459","url":"https://git.kernel.org/stable/c/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72377","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72377.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72376","title":"afs: Fix misplaced inc of net->cells_outstanding","status":"backported","project":false,"upstream":[{"sha":"c9c3b615a462a4023bd148f02c564e175ed10502","url":"https://git.kernel.org/stable/c/c9c3b615a462a4023bd148f02c564e175ed10502"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c9c3b615a462a4023bd148f02c564e175ed10502","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c9c3b615a462a4023bd148f02c564e175ed10502.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72376","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72376.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72373","title":"afs: Fix missing NULL pointer check in afs_break_some_callbacks()","status":"backported","project":false,"upstream":[{"sha":"794a01110390c1b76f59ece773fb0fbfd89c6f5c","url":"https://git.kernel.org/stable/c/794a01110390c1b76f59ece773fb0fbfd89c6f5c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"794a01110390c1b76f59ece773fb0fbfd89c6f5c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/794a01110390c1b76f59ece773fb0fbfd89c6f5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72373","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72373.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72369","title":"minix: avoid overflow in bitmap block count calculation","status":"backported","project":false,"upstream":[{"sha":"fb3e566cafc38fe3ba35e6843a2d529a3748870c","url":"https://git.kernel.org/stable/c/fb3e566cafc38fe3ba35e6843a2d529a3748870c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb3e566cafc38fe3ba35e6843a2d529a3748870c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/fb3e566cafc38fe3ba35e6843a2d529a3748870c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72369","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72369.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72367","title":"iomap: guard io_size EOF trim against concurrent truncate underflow","status":"backported","project":false,"upstream":[{"sha":"55ec50d046c03b3724741957f7b007856e36dbe7","url":"https://git.kernel.org/stable/c/55ec50d046c03b3724741957f7b007856e36dbe7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"55ec50d046c03b3724741957f7b007856e36dbe7","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/55ec50d046c03b3724741957f7b007856e36dbe7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72367","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72367.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72365","title":"netfs: Fix writethrough to use collection offload","status":"backported","project":false,"upstream":[{"sha":"ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4","url":"https://git.kernel.org/stable/c/ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/ba6a9f6533c77c628eef0c0c5c19cd316e2be1b4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72365","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72365.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72355","title":"netfs: Fix barriering when walking subrequest list","status":"backported","project":false,"upstream":[{"sha":"5c6ce05e406520290c1d89da97fb3cd70c09137d","url":"https://git.kernel.org/stable/c/5c6ce05e406520290c1d89da97fb3cd70c09137d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5c6ce05e406520290c1d89da97fb3cd70c09137d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/5c6ce05e406520290c1d89da97fb3cd70c09137d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72345","title":"net/mlx5: LAG, Fix off-by-one in single-FDB error rollback","status":"backported","project":false,"upstream":[{"sha":"0f0e4ae6975c773f7854fc48932a267f6c79088f","url":"https://git.kernel.org/stable/c/0f0e4ae6975c773f7854fc48932a267f6c79088f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0f0e4ae6975c773f7854fc48932a267f6c79088f","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/0f0e4ae6975c773f7854fc48932a267f6c79088f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72345","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72345.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72334","title":"Bluetooth: ISO: fix malformed ISO_END/CONT handling","status":"backported","project":false,"upstream":[{"sha":"e054c1a6ae7310d2815778fddb87da616e11c255","url":"https://git.kernel.org/stable/c/e054c1a6ae7310d2815778fddb87da616e11c255"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e054c1a6ae7310d2815778fddb87da616e11c255","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72324","title":"gpio: mvebu: free generic chips on unbind","status":"backported","project":false,"upstream":[{"sha":"b11c513ad943f35cf5e8007d3a56279c79b7ed4b","url":"https://git.kernel.org/stable/c/b11c513ad943f35cf5e8007d3a56279c79b7ed4b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b11c513ad943f35cf5e8007d3a56279c79b7ed4b","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b11c513ad943f35cf5e8007d3a56279c79b7ed4b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72324","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72324.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72315","title":"smb: client: fix busy dentry warning on unmount after DIO","status":"backported","project":false,"upstream":[{"sha":"75f5c412fa867efa0bf9b646bffe0d912109e84a","url":"https://git.kernel.org/stable/c/75f5c412fa867efa0bf9b646bffe0d912109e84a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"75f5c412fa867efa0bf9b646bffe0d912109e84a","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/75f5c412fa867efa0bf9b646bffe0d912109e84a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72203","title":"ntfs: skip extent mft records in writeback to prevent deadlock","status":"backported","project":false,"upstream":[{"sha":"76bc14c7097ff678b2b5dbfd4fa33b46897d87ce","url":"https://git.kernel.org/stable/c/76bc14c7097ff678b2b5dbfd4fa33b46897d87ce"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"76bc14c7097ff678b2b5dbfd4fa33b46897d87ce","lines":154,"reason":"","source":"https://github.com/torvalds/linux/commit/76bc14c7097ff678b2b5dbfd4fa33b46897d87ce.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72203","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72203.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72200","title":"ntfs: detect mapping-pairs LCN accumulator overflow","status":"backported","project":false,"upstream":[{"sha":"ec4f061f2219e0f0c6465d56d0380bf749235a53","url":"https://git.kernel.org/stable/c/ec4f061f2219e0f0c6465d56d0380bf749235a53"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"ec4f061f2219e0f0c6465d56d0380bf749235a53","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/ec4f061f2219e0f0c6465d56d0380bf749235a53.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72200","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72200.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72198","title":"ntfs: reject non-resident records for resident-only attributes","status":"backported","project":false,"upstream":[{"sha":"097cdfd0a55df5af82c9753833f39a8bfadbcfcb","url":"https://git.kernel.org/stable/c/097cdfd0a55df5af82c9753833f39a8bfadbcfcb"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","url":"https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"097cdfd0a55df5af82c9753833f39a8bfadbcfcb","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/097cdfd0a55df5af82c9753833f39a8bfadbcfcb.patch"},{"sha":"7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89","lines":29331,"reason":"","source":"https://github.com/torvalds/linux/commit/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72198","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72198.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72073","title":"mmc: vub300: fix use-after-free on probe failure","status":"backported","project":false,"upstream":[{"sha":"a3b5f242997a3be7404112fd48784881560aea57","url":"https://git.kernel.org/stable/c/a3b5f242997a3be7404112fd48784881560aea57"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a3b5f242997a3be7404112fd48784881560aea57","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/a3b5f242997a3be7404112fd48784881560aea57.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72042","title":"ipmi: Fix user refcount underflow in event delivery","status":"backported","project":false,"upstream":[{"sha":"6aa9e61c46465d231e9beddf56af7effd71be682","url":"https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6aa9e61c46465d231e9beddf56af7effd71be682","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/6aa9e61c46465d231e9beddf56af7effd71be682.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72042","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72042.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72028","title":"riscv: probes: save original sp in rethook trampoline","status":"backported","project":false,"upstream":[{"sha":"bc7b086a45521a986a49045907f017e3e46c763e","url":"https://git.kernel.org/stable/c/bc7b086a45521a986a49045907f017e3e46c763e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"bc7b086a45521a986a49045907f017e3e46c763e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72009","title":"pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI","status":"backported","project":false,"upstream":[{"sha":"99611233f8cda833169fa6487d5dacdf189e5cb0","url":"https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"99611233f8cda833169fa6487d5dacdf189e5cb0","lines":126,"reason":"","source":"https://github.com/torvalds/linux/commit/99611233f8cda833169fa6487d5dacdf189e5cb0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72009","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72009.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-72007","title":"pmdomain: imx: Fix i.MX8MP VC8000E power up sequence","status":"backported","project":false,"upstream":[{"sha":"25e252bcf1593b420b12a7231d9dd64b885a2ae2","url":"https://git.kernel.org/stable/c/25e252bcf1593b420b12a7231d9dd64b885a2ae2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"25e252bcf1593b420b12a7231d9dd64b885a2ae2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-72007","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72007.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68480","title":"x86/bugs: Make Safe-RET robust against interrupt injection","status":"backported","project":false,"upstream":[{"sha":"7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9","url":"https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9"},{"sha":"52db77a13be224e09eb4ba6b4252ae8ab9085c2c","url":"https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c"},{"sha":"dfefa3c51370f84acb643cddf98bb42c885d0483","url":"https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9","lines":187,"reason":"","source":"https://github.com/torvalds/linux/commit/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9.patch"},{"sha":"52db77a13be224e09eb4ba6b4252ae8ab9085c2c","lines":190,"reason":"","source":"https://github.com/torvalds/linux/commit/52db77a13be224e09eb4ba6b4252ae8ab9085c2c.patch"},{"sha":"dfefa3c51370f84acb643cddf98bb42c885d0483","lines":190,"reason":"","source":"https://github.com/torvalds/linux/commit/dfefa3c51370f84acb643cddf98bb42c885d0483.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68480","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68480.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68471","title":"wifi: ieee80211: validate MLE common info length","status":"backported","project":false,"upstream":[{"sha":"293baeae9b2434a3e432629d7720b5603db2d77e","url":"https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"293baeae9b2434a3e432629d7720b5603db2d77e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68471","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68471.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68470","title":"wifi: mac80211: validate extension-frame layout before RX","status":"backported","project":false,"upstream":[{"sha":"57d503ce32eccfa7650065ca4c560f7e29a2e676","url":"https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"57d503ce32eccfa7650065ca4c560f7e29a2e676","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/57d503ce32eccfa7650065ca4c560f7e29a2e676.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68470","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68470.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68447","title":"drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size","status":"backported","project":false,"upstream":[{"sha":"426ffae6ecc7ec77d32bf8be065c21a1b881b084","url":"https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"426ffae6ecc7ec77d32bf8be065c21a1b881b084","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/426ffae6ecc7ec77d32bf8be065c21a1b881b084.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68447","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68447.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68421","title":"sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()","status":"backported","project":false,"upstream":[{"sha":"b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da","url":"https://git.kernel.org/stable/c/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68421","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68421.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68412","title":"wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()","status":"backported","project":false,"upstream":[{"sha":"c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6","url":"https://git.kernel.org/stable/c/c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68412","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68412.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68391","title":"Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds","status":"backported","project":false,"upstream":[{"sha":"da55f570191d5d72f10c607a7043b947eb05ea46","url":"https://git.kernel.org/stable/c/da55f570191d5d72f10c607a7043b947eb05ea46"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"da55f570191d5d72f10c607a7043b947eb05ea46","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68391","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68391.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68382","title":"drm/xe/guc: Hold device ref until queue teardown completes","status":"backported","project":false,"upstream":[{"sha":"9b7e60184f4b22e893d4ae95234d5f26261a430c","url":"https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"9b7e60184f4b22e893d4ae95234d5f26261a430c","lines":263,"reason":"","source":"https://github.com/torvalds/linux/commit/9b7e60184f4b22e893d4ae95234d5f26261a430c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68382","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68382.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68337","title":"bpf: Reject redirect helpers without a bpf_net_context","status":"backported","project":false,"upstream":[{"sha":"3f4920d165b29052255527d8ae7619e7ec132ece","url":"https://git.kernel.org/stable/c/3f4920d165b29052255527d8ae7619e7ec132ece"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f4920d165b29052255527d8ae7619e7ec132ece","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/3f4920d165b29052255527d8ae7619e7ec132ece.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68337","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68337.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68303","title":"drm/vc4: hvs/v3d: Fix null dereference in unbind","status":"backported","project":false,"upstream":[{"sha":"7dc3680b7ffe01add3e9299fde8471d2dd53a8ae","url":"https://git.kernel.org/stable/c/7dc3680b7ffe01add3e9299fde8471d2dd53a8ae"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7dc3680b7ffe01add3e9299fde8471d2dd53a8ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68303","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68303.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68290","title":"rds: tcp: unregister sysctl before tearing down listen socket","status":"backported","project":false,"upstream":[{"sha":"167e54c703ccd4fa028feb568b0d1002020cff86","url":"https://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"167e54c703ccd4fa028feb568b0d1002020cff86","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/167e54c703ccd4fa028feb568b0d1002020cff86.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68290","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68290.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68289","title":"tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()","status":"backported","project":false,"upstream":[{"sha":"47f42ff521b4eeb46e82f9a46a4783a99f7570d7","url":"https://git.kernel.org/stable/c/47f42ff521b4eeb46e82f9a46a4783a99f7570d7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"47f42ff521b4eeb46e82f9a46a4783a99f7570d7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68288","title":"net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD","status":"backported","project":false,"upstream":[{"sha":"5e9c8baee0329fbefe7c67aea945e2a07f15e98b","url":"https://git.kernel.org/stable/c/5e9c8baee0329fbefe7c67aea945e2a07f15e98b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5e9c8baee0329fbefe7c67aea945e2a07f15e98b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68287","title":"drop_monitor: fix size calculations for 64-bit attributes","status":"backported","project":false,"upstream":[{"sha":"7089f7ab99c89f443c92d8fcc585e63f2727f0b3","url":"https://git.kernel.org/stable/c/7089f7ab99c89f443c92d8fcc585e63f2727f0b3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7089f7ab99c89f443c92d8fcc585e63f2727f0b3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68287","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68287.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68286","title":"drop_monitor: perform u64_stats updates under IRQ-disabled section","status":"backported","project":false,"upstream":[{"sha":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","url":"https://git.kernel.org/stable/c/fd098a23bf8fda7eae48db9b06e7c34fc4d228fa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68286","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68286.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68245","title":"drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()","status":"backported","project":false,"upstream":[{"sha":"04cc4aa3617b0ed67e859f91f09de5d896a46f3a","url":"https://git.kernel.org/stable/c/04cc4aa3617b0ed67e859f91f09de5d896a46f3a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"04cc4aa3617b0ed67e859f91f09de5d896a46f3a","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/04cc4aa3617b0ed67e859f91f09de5d896a46f3a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68245","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68245.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68205","title":"media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()","status":"backported","project":false,"upstream":[{"sha":"06cb687a5132fcffe624c0070576ab852ac6b568","url":"https://git.kernel.org/stable/c/06cb687a5132fcffe624c0070576ab852ac6b568"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"06cb687a5132fcffe624c0070576ab852ac6b568","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/06cb687a5132fcffe624c0070576ab852ac6b568.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68205","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68205.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68161","title":"sctp: close UDP tunnel sockets during netns teardown","status":"backported","project":false,"upstream":[{"sha":"ffb2bd7ade36ec4da32c46a6eddbf4515316d08c","url":"https://git.kernel.org/stable/c/ffb2bd7ade36ec4da32c46a6eddbf4515316d08c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ffb2bd7ade36ec4da32c46a6eddbf4515316d08c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68152","title":"amt: fix use-after-free in AMT delayed works","status":"backported","project":false,"upstream":[{"sha":"ea20c44935d6142daecfa9b39d635033a7553e1b","url":"https://git.kernel.org/stable/c/ea20c44935d6142daecfa9b39d635033a7553e1b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ea20c44935d6142daecfa9b39d635033a7553e1b","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/ea20c44935d6142daecfa9b39d635033a7553e1b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68152","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68152.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68112","title":"drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()","status":"backported","project":false,"upstream":[{"sha":"00f4050f7c367d7bdce347ca279ce467c434cf15","url":"https://git.kernel.org/stable/c/00f4050f7c367d7bdce347ca279ce467c434cf15"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"00f4050f7c367d7bdce347ca279ce467c434cf15","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/00f4050f7c367d7bdce347ca279ce467c434cf15.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68112","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68112.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68103","title":"drm/amdgpu: reject mapping a reserved doorbell to a new queue","status":"backported","project":false,"upstream":[{"sha":"a609b6278bf3cde17eeee6620091465521e4b02c","url":"https://git.kernel.org/stable/c/a609b6278bf3cde17eeee6620091465521e4b02c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a609b6278bf3cde17eeee6620091465521e4b02c","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a609b6278bf3cde17eeee6620091465521e4b02c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68097","title":"ksmbd: validate ACE size against SID sub-authorities","status":"backported","project":false,"upstream":[{"sha":"5152c6d49e3fd4e9f2e857c57527aead752f1f87","url":"https://git.kernel.org/stable/c/5152c6d49e3fd4e9f2e857c57527aead752f1f87"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5152c6d49e3fd4e9f2e857c57527aead752f1f87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68086","title":"mm/khugepaged: write all dirty file folios when collapsing","status":"unfixed","project":false,"upstream":[{"sha":"2dfe9f5c91d0963058f8a5e46e1c2a908382cc46","url":"https://git.kernel.org/stable/c/2dfe9f5c91d0963058f8a5e46e1c2a908382cc46"}],"evidence":[],"submission_lore":[],"basis":"CNA default affected","review":null,"size":{"status":"within-limit","patches":[{"sha":"2dfe9f5c91d0963058f8a5e46e1c2a908382cc46","lines":57,"reason":"","source":"https://github.com/torvalds/linux/commit/2dfe9f5c91d0963058f8a5e46e1c2a908382cc46.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68086","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68086.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-68085","title":"Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled","status":"backported","project":false,"upstream":[{"sha":"1b0d946d6f08bd39211385bc703a440911b41e46","url":"https://git.kernel.org/stable/c/1b0d946d6f08bd39211385bc703a440911b41e46"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1b0d946d6f08bd39211385bc703a440911b41e46","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/1b0d946d6f08bd39211385bc703a440911b41e46.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-68085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64525","title":"xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit","status":"backported","project":false,"upstream":[{"sha":"3e52417318473782012b236d0325bf7d2266a597","url":"https://git.kernel.org/stable/c/3e52417318473782012b236d0325bf7d2266a597"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3e52417318473782012b236d0325bf7d2266a597","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/3e52417318473782012b236d0325bf7d2266a597.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64525","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64525.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64520","title":"firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies","status":"backported","project":false,"upstream":[{"sha":"3974ea1938406f9bfa7c1f48d4e43533f447bb08","url":"https://git.kernel.org/stable/c/3974ea1938406f9bfa7c1f48d4e43533f447bb08"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3974ea1938406f9bfa7c1f48d4e43533f447bb08","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/3974ea1938406f9bfa7c1f48d4e43533f447bb08.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64520","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64520.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64513","title":"KVM: x86: Unconditionally recompute CR8 intercept on PPR update","status":"backported","project":false,"upstream":[{"sha":"bb365a506b1e6fb050c0fceaad354fe395385ef0","url":"https://git.kernel.org/stable/c/bb365a506b1e6fb050c0fceaad354fe395385ef0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"bb365a506b1e6fb050c0fceaad354fe395385ef0","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/bb365a506b1e6fb050c0fceaad354fe395385ef0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64513","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64513.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64481","title":"ALSA: hda/cs35l41: Fix firmware load work teardown","status":"backported","project":false,"upstream":[{"sha":"b65020d5398f499c09498c9786dba6d67ae57664","url":"https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"b65020d5398f499c09498c9786dba6d67ae57664","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64481","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64481.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64424","title":"netpoll: fix a use-after-free on shutdown path","status":"backported","project":false,"upstream":[{"sha":"45f1458a85017a023f138b22ac5c76abd477db42","url":"https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"45f1458a85017a023f138b22ac5c76abd477db42","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/45f1458a85017a023f138b22ac5c76abd477db42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64424","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64424.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64305","title":"crypto: qat - protect service table iterations with service_lock","status":"backported","project":false,"upstream":[{"sha":"5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e","url":"https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64305","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64305.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64255","title":"wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers","status":"backported","project":false,"upstream":[{"sha":"f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","url":"https://git.kernel.org/stable/c/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64255","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64255.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64241","title":"gpio: rockchip: teardown bugs and resource leaks","status":"backported","project":false,"upstream":[{"sha":"9500077678230e36d22bf16d2b9539c13e59a801","url":"https://git.kernel.org/stable/c/9500077678230e36d22bf16d2b9539c13e59a801"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"9500077678230e36d22bf16d2b9539c13e59a801","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/9500077678230e36d22bf16d2b9539c13e59a801.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64241","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64241.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64212","title":"wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it","status":"backported","project":false,"upstream":[{"sha":"d733ed481fd20a8e7bfe5119c4e77761ba3f87ee","url":"https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d733ed481fd20a8e7bfe5119c4e77761ba3f87ee","lines":34,"reason":"","source":"https://github.com/torvalds/linux/commit/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64212","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64212.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64190","title":"net: team: fix NULL pointer dereference in team_xmit during mode change","status":"backported","project":false,"upstream":[{"sha":"25fe708bbc59289d3d1ea4b126fbc1b460a072a5","url":"https://git.kernel.org/stable/c/25fe708bbc59289d3d1ea4b126fbc1b460a072a5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"25fe708bbc59289d3d1ea4b126fbc1b460a072a5","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64190","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64190.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64163","title":"test_kprobes: clear kprobes between test runs","status":"backported","project":false,"upstream":[{"sha":"ef5581bb30efb939cc2bf093475c6cc85258e5cd","url":"https://git.kernel.org/stable/c/ef5581bb30efb939cc2bf093475c6cc85258e5cd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ef5581bb30efb939cc2bf093475c6cc85258e5cd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64163","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64163.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64160","title":"netfs: Fix potential for tearing in ->remote_i_size and ->zero_point","status":"backported","project":false,"upstream":[{"sha":"2c8f4742bb76117d735f92a3932d85239b16c494","url":"https://git.kernel.org/stable/c/2c8f4742bb76117d735f92a3932d85239b16c494"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"2c8f4742bb76117d735f92a3932d85239b16c494","lines":953,"reason":"","source":"https://github.com/torvalds/linux/commit/2c8f4742bb76117d735f92a3932d85239b16c494.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64160","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64160.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64112","title":"rbd: eliminate a race in lock_dwork draining on unmap","status":"backported","project":false,"upstream":[{"sha":"9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90","url":"https://git.kernel.org/stable/c/9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64112","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64112.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64109","title":"af_unix: Fix UAF read of tail->len in unix_stream_data_wait()","status":"backported","project":false,"upstream":[{"sha":"be309f8eae8b474a4a617eaae01324da996fc719","url":"https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"be309f8eae8b474a4a617eaae01324da996fc719","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/be309f8eae8b474a4a617eaae01324da996fc719.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64109","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64109.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64082","title":"riscv: Fix register corruption from uninitialized cregs on error","status":"backported","project":false,"upstream":[{"sha":"6ebcbb53fc9bc30843054ed99fd60b8e542628f4","url":"https://git.kernel.org/stable/c/6ebcbb53fc9bc30843054ed99fd60b8e542628f4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"6ebcbb53fc9bc30843054ed99fd60b8e542628f4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64082","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64082.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64079","title":"netfilter: x_tables: allocate hook ops while under mutex","status":"backported","project":false,"upstream":[{"sha":"b62eb8dcf2c47d4d676a434efbd57c4f776f7829","url":"https://git.kernel.org/stable/c/b62eb8dcf2c47d4d676a434efbd57c4f776f7829"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"b62eb8dcf2c47d4d676a434efbd57c4f776f7829","lines":271,"reason":"","source":"https://github.com/torvalds/linux/commit/b62eb8dcf2c47d4d676a434efbd57c4f776f7829.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64078","title":"netfilter: x_tables: add and use xtables_unregister_table_exit","status":"backported","project":false,"upstream":[{"sha":"b4597d5fd7d2f8cebfffd40dffb5e003cc78964c","url":"https://git.kernel.org/stable/c/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"b4597d5fd7d2f8cebfffd40dffb5e003cc78964c","lines":246,"reason":"","source":"https://github.com/torvalds/linux/commit/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64078","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64078.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64070","title":"powerpc/hv-gpci: fix preempt count leak in sysfs show paths","status":"backported","project":false,"upstream":[{"sha":"dbc30a57bd8e026995e9fa8e8c31cffd18542c01","url":"https://git.kernel.org/stable/c/dbc30a57bd8e026995e9fa8e8c31cffd18542c01"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"dbc30a57bd8e026995e9fa8e8c31cffd18542c01","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64070","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64070.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64068","title":"netfs: Fix missing locking around retry adding new subreqs","status":"backported","project":false,"upstream":[{"sha":"cce18c263e9623872327ba3c956012f73c1179cc","url":"https://git.kernel.org/stable/c/cce18c263e9623872327ba3c956012f73c1179cc"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"cce18c263e9623872327ba3c956012f73c1179cc","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64068","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64068.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64067","title":"netfs: Fix missing barriers when accessing stream->subrequests locklessly","status":"backported","project":false,"upstream":[{"sha":"b5782e2d462c028096f922abca46318cec890670","url":"https://git.kernel.org/stable/c/b5782e2d462c028096f922abca46318cec890670"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b5782e2d462c028096f922abca46318cec890670","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/b5782e2d462c028096f922abca46318cec890670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64067","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64067.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64066","title":"netfs: Fix netfs_read_to_pagecache() to pause on subreq failure","status":"backported","project":false,"upstream":[{"sha":"8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4","url":"https://git.kernel.org/stable/c/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64066","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64066.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64060","title":"netfs: Fix leak of request in netfs_write_begin() error handling","status":"backported","project":false,"upstream":[{"sha":"5046a34f0643441f05b0253ea64e1a3af87efe14","url":"https://git.kernel.org/stable/c/5046a34f0643441f05b0253ea64e1a3af87efe14"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5046a34f0643441f05b0253ea64e1a3af87efe14","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/5046a34f0643441f05b0253ea64e1a3af87efe14.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64060","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64060.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64026","title":"rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg","status":"backported","project":false,"upstream":[{"sha":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","url":"https://git.kernel.org/stable/c/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"d2bc90cf6c75cb96d2ce549be6c35efa3099d25b","lines":534,"reason":"","source":"https://github.com/torvalds/linux/commit/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64026","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64026.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64017","title":"blk-mq: pop cached request if it is usable","status":"backported","project":false,"upstream":[{"sha":"dc278e9bf2b9513a763353e6b9cc21e0f532954e","url":"https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"dc278e9bf2b9513a763353e6b9cc21e0f532954e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-64001","title":"ALSA: pcm: oss: Fix setup list UAF on proc write error","status":"backported","project":false,"upstream":[{"sha":"4cc54bdd54b337e77115be5b55577d1c58608eae","url":"https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4cc54bdd54b337e77115be5b55577d1c58608eae","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/4cc54bdd54b337e77115be5b55577d1c58608eae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-64001","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-64001.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63999","title":"ethtool: rss: fix indir_table and hkey leak on get_rxfh failure","status":"backported","project":false,"upstream":[{"sha":"266297692f97008ca48bc311775c087c59bd7fe3","url":"https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"266297692f97008ca48bc311775c087c59bd7fe3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/266297692f97008ca48bc311775c087c59bd7fe3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63983","title":"net/sched: fix packet loop on netem when duplicate is on","status":"backported","project":false,"upstream":[{"sha":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","url":"https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/9552b11e3edabc97cfcd9f29103d5afbce7ae183.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63983","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63983.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63977","title":"dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work","status":"backported","project":false,"upstream":[{"sha":"d733f519f6443540f8359461a34e3b0042099bbe","url":"https://git.kernel.org/stable/c/d733f519f6443540f8359461a34e3b0042099bbe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d733f519f6443540f8359461a34e3b0042099bbe","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/d733f519f6443540f8359461a34e3b0042099bbe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63977","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63977.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63959","title":"usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT","status":"backported","project":false,"upstream":[{"sha":"aa2f716327be1818e1cb156da8a2844804aaec2f","url":"https://git.kernel.org/stable/c/aa2f716327be1818e1cb156da8a2844804aaec2f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"aa2f716327be1818e1cb156da8a2844804aaec2f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63959","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63959.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63941","title":"KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor","status":"backported","project":false,"upstream":[{"sha":"83726330748981372bde86ed5411d7b306612991","url":"https://git.kernel.org/stable/c/83726330748981372bde86ed5411d7b306612991"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"83726330748981372bde86ed5411d7b306612991","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/83726330748981372bde86ed5411d7b306612991.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63941","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63941.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63871","title":"Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls","status":"backported","project":false,"upstream":[{"sha":"9ca7053d6215d89c33f28893bfd1625a32919d3f","url":"https://git.kernel.org/stable/c/9ca7053d6215d89c33f28893bfd1625a32919d3f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"9ca7053d6215d89c33f28893bfd1625a32919d3f","lines":103,"reason":"","source":"https://github.com/torvalds/linux/commit/9ca7053d6215d89c33f28893bfd1625a32919d3f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63871","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63871.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63858","title":"netfilter: nf_tables: add hook transactions for device deletions","status":"backported","project":false,"upstream":[{"sha":"10f79dbd7719d1da9f5884d13060322d8729f091","url":"https://git.kernel.org/stable/c/10f79dbd7719d1da9f5884d13060322d8729f091"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"10f79dbd7719d1da9f5884d13060322d8729f091","lines":525,"reason":"","source":"https://github.com/torvalds/linux/commit/10f79dbd7719d1da9f5884d13060322d8729f091.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63858","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63858.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63839","title":"platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()","status":"backported","project":false,"upstream":[{"sha":"0c3887a134f191723b53e2a47e501b534c8723ee","url":"https://git.kernel.org/stable/c/0c3887a134f191723b53e2a47e501b534c8723ee"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0c3887a134f191723b53e2a47e501b534c8723ee","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63839","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63839.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63819","title":"f2fs: fix to do sanity check on f2fs_get_node_folio_ra()","status":"backported","project":false,"upstream":[{"sha":"8712353ed80f87271d732297567dcdbe4b84e8c7","url":"https://git.kernel.org/stable/c/8712353ed80f87271d732297567dcdbe4b84e8c7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8712353ed80f87271d732297567dcdbe4b84e8c7","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8712353ed80f87271d732297567dcdbe4b84e8c7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63819","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63819.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63816","title":"f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode","status":"backported","project":false,"upstream":[{"sha":"e0288584baa5dc41df4a829a023c4c1b33fe53d7","url":"https://git.kernel.org/stable/c/e0288584baa5dc41df4a829a023c4c1b33fe53d7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"e0288584baa5dc41df4a829a023c4c1b33fe53d7","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/e0288584baa5dc41df4a829a023c4c1b33fe53d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63816","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63816.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-63805","title":"crypto: nx - fix nx_crypto_ctx_exit argument","status":"backported","project":false,"upstream":[{"sha":"4e67f504ee9ded15e256b64f4fde150e917381d7","url":"https://git.kernel.org/stable/c/4e67f504ee9ded15e256b64f4fde150e917381d7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4e67f504ee9ded15e256b64f4fde150e917381d7","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/4e67f504ee9ded15e256b64f4fde150e917381d7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-63805","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-63805.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53368","title":"f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage","status":"backported","project":false,"upstream":[{"sha":"019f9dda7f66e55eb94cd32e1d3fff5835f73fbc","url":"https://git.kernel.org/stable/c/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"019f9dda7f66e55eb94cd32e1d3fff5835f73fbc","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53368","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53368.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53313","title":"drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths","status":"backported","project":false,"upstream":[{"sha":"4ae3e16f4b3bf64140f773629b765d605ee079a9","url":"https://git.kernel.org/stable/c/4ae3e16f4b3bf64140f773629b765d605ee079a9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"4ae3e16f4b3bf64140f773629b765d605ee079a9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53285","title":"drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED","status":"backported","project":false,"upstream":[{"sha":"183182235f6d53bac62c6c39014738a54a68dfa6","url":"https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"183182235f6d53bac62c6c39014738a54a68dfa6","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/183182235f6d53bac62c6c39014738a54a68dfa6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53285","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53285.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53246","title":"sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing","status":"backported","project":false,"upstream":[{"sha":"0861615c28de668669d748ef4eb913ea9262d13b","url":"https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0861615c28de668669d748ef4eb913ea9262d13b","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/0861615c28de668669d748ef4eb913ea9262d13b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53246","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53246.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53226","title":"gpio: rockchip: fix generic IRQ chip leak on remove","status":"backported","project":false,"upstream":[{"sha":"1c1e0fc88d6ef65bf15d517853251f75ab9d18c3","url":"https://git.kernel.org/stable/c/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c1e0fc88d6ef65bf15d517853251f75ab9d18c3","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53226","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53226.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53185","title":"zram: fix use-after-free in zram_bvec_write_partial()","status":"backported","project":false,"upstream":[{"sha":"732fd9f0b9c1cdc6dfd77162ded60df005182cc0","url":"https://git.kernel.org/stable/c/732fd9f0b9c1cdc6dfd77162ded60df005182cc0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"732fd9f0b9c1cdc6dfd77162ded60df005182cc0","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/732fd9f0b9c1cdc6dfd77162ded60df005182cc0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53185","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53185.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53179","title":"staging: rtl8723bs: fix buffer over-read in rtw_update_protection","status":"backported","project":false,"upstream":[{"sha":"514ab98364595007d4557ecc85d7e5f012c504d3","url":"https://git.kernel.org/stable/c/514ab98364595007d4557ecc85d7e5f012c504d3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"514ab98364595007d4557ecc85d7e5f012c504d3","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/514ab98364595007d4557ecc85d7e5f012c504d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53179","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53179.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53178","title":"staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction","status":"backported","project":false,"upstream":[{"sha":"88e994c57a79f62d5338231d8d37ee8dd98baffe","url":"https://git.kernel.org/stable/c/88e994c57a79f62d5338231d8d37ee8dd98baffe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"88e994c57a79f62d5338231d8d37ee8dd98baffe","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/88e994c57a79f62d5338231d8d37ee8dd98baffe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53178","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53178.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53156","title":"nvmem: core: fix use-after-free bugs in error paths","status":"backported","project":false,"upstream":[{"sha":"5b6b6fc491899d583eaa75344e094796ae9b530b","url":"https://git.kernel.org/stable/c/5b6b6fc491899d583eaa75344e094796ae9b530b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5b6b6fc491899d583eaa75344e094796ae9b530b","lines":31,"reason":"","source":"https://github.com/torvalds/linux/commit/5b6b6fc491899d583eaa75344e094796ae9b530b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53156","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53156.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53143","title":"drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11","status":"backported","project":false,"upstream":[{"sha":"352ea59028ea48a6fff77f19ae28f98f71946a80","url":"https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"352ea59028ea48a6fff77f19ae28f98f71946a80","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/352ea59028ea48a6fff77f19ae28f98f71946a80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53143","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53143.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53132","title":"vsock/virtio: fix potential unbounded skb queue","status":"backported","project":false,"upstream":[{"sha":"059b7dbd20a6f0c539a45ddff1573cb8946685b5","url":"https://git.kernel.org/stable/c/059b7dbd20a6f0c539a45ddff1573cb8946685b5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"059b7dbd20a6f0c539a45ddff1573cb8946685b5","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/059b7dbd20a6f0c539a45ddff1573cb8946685b5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53132","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53132.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53123","title":"md: wake raid456 reshape waiters before suspend","status":"backported","project":false,"upstream":[{"sha":"cf86bb53b9c92354904a328e947a05ffbfdd1840","url":"https://git.kernel.org/stable/c/cf86bb53b9c92354904a328e947a05ffbfdd1840"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf86bb53b9c92354904a328e947a05ffbfdd1840","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/cf86bb53b9c92354904a328e947a05ffbfdd1840.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53120","title":"PCI: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"10a4206a24013be4d558d476010cbf2eb4c9fa64","url":"https://git.kernel.org/stable/c/10a4206a24013be4d558d476010cbf2eb4c9fa64"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"10a4206a24013be4d558d476010cbf2eb4c9fa64","lines":131,"reason":"","source":"https://github.com/torvalds/linux/commit/10a4206a24013be4d558d476010cbf2eb4c9fa64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53120","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53120.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53118","title":"vdpa: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"85bb534ff12aab6916058897b39c748940a7a4c6","url":"https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"85bb534ff12aab6916058897b39c748940a7a4c6","lines":85,"reason":"","source":"https://github.com/torvalds/linux/commit/85bb534ff12aab6916058897b39c748940a7a4c6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53117","title":"s390/cio: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4","url":"https://git.kernel.org/stable/c/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4","lines":74,"reason":"","source":"https://github.com/torvalds/linux/commit/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53117","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53117.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53115","title":"bus: fsl-mc: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"6c8dfb0362732bf1e4829867a2a5239fedc592d0","url":"https://git.kernel.org/stable/c/6c8dfb0362732bf1e4829867a2a5239fedc592d0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6c8dfb0362732bf1e4829867a2a5239fedc592d0","lines":99,"reason":"","source":"https://github.com/torvalds/linux/commit/6c8dfb0362732bf1e4829867a2a5239fedc592d0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53113","title":"wifi: ath11k: fix memory leaks in beacon template setup","status":"backported","project":false,"upstream":[{"sha":"ff49eba595df500e4ddccc593088c8a4ab5f2c27","url":"https://git.kernel.org/stable/c/ff49eba595df500e4ddccc593088c8a4ab5f2c27"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ff49eba595df500e4ddccc593088c8a4ab5f2c27","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53113","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53113.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53107","title":"wifi: libertas: don't kill URBs in interrupt context","status":"backported","project":false,"upstream":[{"sha":"7c5c2b661bdb78c1472b8833265c9ed1ee880039","url":"https://git.kernel.org/stable/c/7c5c2b661bdb78c1472b8833265c9ed1ee880039"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c5c2b661bdb78c1472b8833265c9ed1ee880039","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/7c5c2b661bdb78c1472b8833265c9ed1ee880039.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53107","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53107.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53106","title":"bpf: Do not allow deleting local storage in NMI","status":"backported","project":false,"upstream":[{"sha":"350de5b8a9befaa2a68861c51f671d4f5f751ca5","url":"https://git.kernel.org/stable/c/350de5b8a9befaa2a68861c51f671d4f5f751ca5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"350de5b8a9befaa2a68861c51f671d4f5f751ca5","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/350de5b8a9befaa2a68861c51f671d4f5f751ca5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53106","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53106.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53102","title":"wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()","status":"backported","project":false,"upstream":[{"sha":"c41075ce8cf05ed8c0e7b7efef000dce548ffc42","url":"https://git.kernel.org/stable/c/c41075ce8cf05ed8c0e7b7efef000dce548ffc42"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"c41075ce8cf05ed8c0e7b7efef000dce548ffc42","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53091","title":"net: pull headers in qdisc_pkt_len_segs_init()","status":"backported","project":false,"upstream":[{"sha":"7fb4c19670110f052c04e1ec1d2b953b9f4f57e4","url":"https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"7fb4c19670110f052c04e1ec1d2b953b9f4f57e4","lines":118,"reason":"","source":"https://github.com/torvalds/linux/commit/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53091","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53091.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53089","title":"bpf: Fix use-after-free in offloaded map/prog info fill","status":"backported","project":false,"upstream":[{"sha":"a0c584fc18056709c8e047a82a6045d6c209f4ce","url":"https://git.kernel.org/stable/c/a0c584fc18056709c8e047a82a6045d6c209f4ce"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a0c584fc18056709c8e047a82a6045d6c209f4ce","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53078","title":"bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops","status":"backported","project":false,"upstream":[{"sha":"10f86a2a5c91fc4c4d001960f1c21abe52545ef6","url":"https://git.kernel.org/stable/c/10f86a2a5c91fc4c4d001960f1c21abe52545ef6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"10f86a2a5c91fc4c4d001960f1c21abe52545ef6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53078","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53078.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53070","title":"sctp: disable BH before calling udp_tunnel_xmit_skb()","status":"backported","project":false,"upstream":[{"sha":"2cd7e6971fc2787408ceef17906ea152791448cf","url":"https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2cd7e6971fc2787408ceef17906ea152791448cf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53070","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53070.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53024","title":"greybus: raw: fix use-after-free if write is called after disconnect","status":"backported","project":false,"upstream":[{"sha":"84265cbd96b97058ef67e3f8be3933667a000835","url":"https://git.kernel.org/stable/c/84265cbd96b97058ef67e3f8be3933667a000835"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"84265cbd96b97058ef67e3f8be3933667a000835","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/84265cbd96b97058ef67e3f8be3933667a000835.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53024","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53024.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53015","title":"erofs: unify lcn as u64 for 32-bit platforms","status":"backported","project":false,"upstream":[{"sha":"2d8c7edcb661812249469f4a5b62e9339118846f","url":"https://git.kernel.org/stable/c/2d8c7edcb661812249469f4a5b62e9339118846f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2d8c7edcb661812249469f4a5b62e9339118846f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-53010","title":"ksmbd: fix use-after-free in smb2_open during durable reconnect","status":"backported","project":false,"upstream":[{"sha":"1baff47b81f94f9231c91236aa511420d0e266b9","url":"https://git.kernel.org/stable/c/1baff47b81f94f9231c91236aa511420d0e266b9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1baff47b81f94f9231c91236aa511420d0e266b9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-53010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-53010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52994","title":"vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting","status":"backported","project":false,"upstream":[{"sha":"1cb36e252211506f51095fe7ced8286cc77b4c80","url":"https://git.kernel.org/stable/c/1cb36e252211506f51095fe7ced8286cc77b4c80"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1cb36e252211506f51095fe7ced8286cc77b4c80","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/1cb36e252211506f51095fe7ced8286cc77b4c80.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52994","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52994.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52961","title":"ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size","status":"backported","project":false,"upstream":[{"sha":"0c22d9511cbde746622f8e4c11aaa63fe76d45f9","url":"https://git.kernel.org/stable/c/0c22d9511cbde746622f8e4c11aaa63fe76d45f9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0c22d9511cbde746622f8e4c11aaa63fe76d45f9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52960","title":"ceph: put folios not suitable for writeback","status":"backported","project":false,"upstream":[{"sha":"544576f0f05c4a759806acddfaaeb686f14fb4b0","url":"https://git.kernel.org/stable/c/544576f0f05c4a759806acddfaaeb686f14fb4b0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"544576f0f05c4a759806acddfaaeb686f14fb4b0","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/544576f0f05c4a759806acddfaaeb686f14fb4b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52960","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52960.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52953","title":"iommu/vt-d: Fix oops due to out of scope access","status":"backported","project":false,"upstream":[{"sha":"a6dea58d8625c06b9654c0555f101742481335c3","url":"https://git.kernel.org/stable/c/a6dea58d8625c06b9654c0555f101742481335c3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6dea58d8625c06b9654c0555f101742481335c3","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/a6dea58d8625c06b9654c0555f101742481335c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52953","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52953.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-52944","title":"ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE","status":"backported","project":false,"upstream":[{"sha":"cc57232cae23c0df91b4a59d0f519141ce9b5b02","url":"https://git.kernel.org/stable/c/cc57232cae23c0df91b4a59d0f519141ce9b5b02"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"cc57232cae23c0df91b4a59d0f519141ce9b5b02","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-52944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46317","title":"KVM: arm64: Reassign nested_mmus array behind mmu_lock","status":"backported","project":false,"upstream":[{"sha":"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8","url":"https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46314","title":"drm/v3d: Reject empty multisync extension to prevent infinite loop","status":"backported","project":false,"upstream":[{"sha":"fb44d589bf3148e13452185a6e772a7efbf2d684","url":"https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"fb44d589bf3148e13452185a6e772a7efbf2d684","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/fb44d589bf3148e13452185a6e772a7efbf2d684.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46314","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46314.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46282","title":"iio: frequency: admv1013: fix NULL pointer dereference on str","status":"backported","project":false,"upstream":[{"sha":"aac0a51b16700b403a55b67ba495de021db78763","url":"https://git.kernel.org/stable/c/aac0a51b16700b403a55b67ba495de021db78763"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"aac0a51b16700b403a55b67ba495de021db78763","lines":93,"reason":"","source":"https://github.com/torvalds/linux/commit/aac0a51b16700b403a55b67ba495de021db78763.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46282","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46282.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46279","title":"mm/alloc_tag: clear codetag for pages allocated before page_ext initialization","status":"backported","project":false,"upstream":[{"sha":"6b1842775a460245e97d36d3a67d0cfba7c4ff79","url":"https://git.kernel.org/stable/c/6b1842775a460245e97d36d3a67d0cfba7c4ff79"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"6b1842775a460245e97d36d3a67d0cfba7c4ff79","lines":162,"reason":"","source":"https://github.com/torvalds/linux/commit/6b1842775a460245e97d36d3a67d0cfba7c4ff79.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46279","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46279.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46274","title":"io-wq: check that the predecessor is hashed in io_wq_remove_pending()","status":"backported","project":false,"upstream":[{"sha":"d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc","url":"https://git.kernel.org/stable/c/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46274","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46274.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46254","title":"AppArmor: Allow apparmor to handle unaligned dfa tables","status":"backported","project":false,"upstream":[{"sha":"64802f731214a51dfe3c6c27636b3ddafd003eb0","url":"https://git.kernel.org/stable/c/64802f731214a51dfe3c6c27636b3ddafd003eb0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"64802f731214a51dfe3c6c27636b3ddafd003eb0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46254","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46254.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46245","title":"drm/amd/display: Fix dc_link NULL handling in HPD init","status":"backported","project":false,"upstream":[{"sha":"226a40c06a183abaeb7529a4f54d6c203bd14407","url":"https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"226a40c06a183abaeb7529a4f54d6c203bd14407","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/226a40c06a183abaeb7529a4f54d6c203bd14407.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46245","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46245.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46157","title":"ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger","status":"backported","project":false,"upstream":[{"sha":"901ac0ff15edf9503162e2cf6579bd11a30f1ed4","url":"https://git.kernel.org/stable/c/901ac0ff15edf9503162e2cf6579bd11a30f1ed4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"901ac0ff15edf9503162e2cf6579bd11a30f1ed4","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46157","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46157.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46153","title":"8021q: delete cleared egress QoS mappings","status":"backported","project":false,"upstream":[{"sha":"7dddc74af369478ba7f9bc136d0fc1dc4570cb66","url":"https://git.kernel.org/stable/c/7dddc74af369478ba7f9bc136d0fc1dc4570cb66"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7dddc74af369478ba7f9bc136d0fc1dc4570cb66","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/7dddc74af369478ba7f9bc136d0fc1dc4570cb66.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46153","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46153.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46147","title":"KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()","status":"backported","project":false,"upstream":[{"sha":"73b9c1e5da84cd69b1a86e374e450817cd051371","url":"https://git.kernel.org/stable/c/73b9c1e5da84cd69b1a86e374e450817cd051371"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"73b9c1e5da84cd69b1a86e374e450817cd051371","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/73b9c1e5da84cd69b1a86e374e450817cd051371.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46147","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46147.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46130","title":"dm-verity-fec: fix reading parity bytes split across blocks (take 3)","status":"backported","project":false,"upstream":[{"sha":"430a05cb926f6bdf53e81460a2c3a553257f3f61","url":"https://git.kernel.org/stable/c/430a05cb926f6bdf53e81460a2c3a553257f3f61"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"430a05cb926f6bdf53e81460a2c3a553257f3f61","lines":129,"reason":"","source":"https://github.com/torvalds/linux/commit/430a05cb926f6bdf53e81460a2c3a553257f3f61.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46130","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46130.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46096","title":"tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()","status":"backported","project":false,"upstream":[{"sha":"f0f75a3d98b7959a8677b6363e23190f3018636b","url":"https://git.kernel.org/stable/c/f0f75a3d98b7959a8677b6363e23190f3018636b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"f0f75a3d98b7959a8677b6363e23190f3018636b","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/f0f75a3d98b7959a8677b6363e23190f3018636b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46096","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46096.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46068","title":"crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx","status":"backported","project":false,"upstream":[{"sha":"adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c","url":"https://git.kernel.org/stable/c/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46068","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46068.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46054","title":"selinux: fix overlayfs mmap() and mprotect() access checks","status":"backported","project":false,"upstream":[{"sha":"82544d36b1729153c8aeb179e84750f0c085d3b1","url":"https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"82544d36b1729153c8aeb179e84750f0c085d3b1","lines":373,"reason":"","source":"https://github.com/torvalds/linux/commit/82544d36b1729153c8aeb179e84750f0c085d3b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46054","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46054.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46044","title":"ipmi:ssif: Clean up kthread on errors","status":"backported","project":false,"upstream":[{"sha":"75c486cb1bcaa1a3ec3a6438498176a3a4998ae4","url":"https://git.kernel.org/stable/c/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"75c486cb1bcaa1a3ec3a6438498176a3a4998ae4","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46044","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46044.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46017","title":"mm: fix deferred split queue races during migration","status":"backported","project":false,"upstream":[{"sha":"3bac01168982ec3e3bf87efdc1807c7933590a85","url":"https://git.kernel.org/stable/c/3bac01168982ec3e3bf87efdc1807c7933590a85"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3bac01168982ec3e3bf87efdc1807c7933590a85","lines":60,"reason":"","source":"https://github.com/torvalds/linux/commit/3bac01168982ec3e3bf87efdc1807c7933590a85.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-46014","title":"KVM: SVM: Add missing save/restore handling of LBR MSRs","status":"backported","project":false,"upstream":[{"sha":"3700f0788da6acf73b2df56690f4b201aa4aefd2","url":"https://git.kernel.org/stable/c/3700f0788da6acf73b2df56690f4b201aa4aefd2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3700f0788da6acf73b2df56690f4b201aa4aefd2","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/3700f0788da6acf73b2df56690f4b201aa4aefd2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-46014","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-46014.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45988","title":"rxrpc: Fix re-decryption of RESPONSE packets","status":"backported","project":false,"upstream":[{"sha":"0422e7a4883f25101903f3e8105c0808aa5f4ce9","url":"https://git.kernel.org/stable/c/0422e7a4883f25101903f3e8105c0808aa5f4ce9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0422e7a4883f25101903f3e8105c0808aa5f4ce9","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/0422e7a4883f25101903f3e8105c0808aa5f4ce9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45981","title":"s390/cio: Fix device lifecycle handling in css_alloc_subchannel()","status":"backported","project":false,"upstream":[{"sha":"f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7","url":"https://git.kernel.org/stable/c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45981","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45981.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45963","title":"ASoC: nau8821: Cancel delayed work on component remove","status":"backported","project":false,"upstream":[{"sha":"dbd3fd05cddfdeec1e49b0a66269881c09eebd17","url":"https://git.kernel.org/stable/c/dbd3fd05cddfdeec1e49b0a66269881c09eebd17"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"dbd3fd05cddfdeec1e49b0a66269881c09eebd17","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45963","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45963.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45901","title":"netfilter: nf_tables: revert commit_mutex usage in reset path","status":"backported","project":false,"upstream":[{"sha":"7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc","url":"https://git.kernel.org/stable/c/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc","lines":372,"reason":"","source":"https://github.com/torvalds/linux/commit/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45897","title":"netfilter: nft_counter: serialize reset with spinlock","status":"backported","project":false,"upstream":[{"sha":"779c60a5190c42689534172f4b49e927c9959e4e","url":"https://git.kernel.org/stable/c/779c60a5190c42689534172f4b49e927c9959e4e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"779c60a5190c42689534172f4b49e927c9959e4e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45897","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45897.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45893","title":"apparmor: Fix & Optimize table creation from possibly unaligned memory","status":"backported","project":false,"upstream":[{"sha":"6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a","url":"https://git.kernel.org/stable/c/6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45893","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45893.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45877","title":"HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients","status":"backported","project":false,"upstream":[{"sha":"56f7db581ee73af53cd512e00a6261a025bf1d58","url":"https://git.kernel.org/stable/c/56f7db581ee73af53cd512e00a6261a025bf1d58"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"56f7db581ee73af53cd512e00a6261a025bf1d58","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45877","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45877.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45858","title":"ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1","status":"backported","project":false,"upstream":[{"sha":"1bf6974822d1dba86cf11b5f05498581cf3488a2","url":"https://git.kernel.org/stable/c/1bf6974822d1dba86cf11b5f05498581cf3488a2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1bf6974822d1dba86cf11b5f05498581cf3488a2","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/1bf6974822d1dba86cf11b5f05498581cf3488a2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45858","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45858.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-45855","title":"ata: libata-scsi: avoid Non-NCQ command starvation","status":"backported","project":false,"upstream":[{"sha":"0ea84089dbf62a92dc7889c79e6b18fc89260808","url":"https://git.kernel.org/stable/c/0ea84089dbf62a92dc7889c79e6b18fc89260808"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"0ea84089dbf62a92dc7889c79e6b18fc89260808","lines":165,"reason":"","source":"https://github.com/torvalds/linux/commit/0ea84089dbf62a92dc7889c79e6b18fc89260808.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45855","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-45855.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43500","title":"rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present","status":"backported","project":false,"upstream":[{"sha":"aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","url":"https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43500","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43500.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43485","title":"nouveau/gsp: drop WARN_ON in ACPI probes","status":"backported","project":false,"upstream":[{"sha":"9478c166c46934160135e197b049b5a05753f2ad","url":"https://git.kernel.org/stable/c/9478c166c46934160135e197b049b5a05753f2ad"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"9478c166c46934160135e197b049b5a05753f2ad","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/9478c166c46934160135e197b049b5a05753f2ad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43485","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43485.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43446","title":"accel/amdxdna: Fix runtime suspend deadlock when there is pending job","status":"backported","project":false,"upstream":[{"sha":"6b13cb8f48a42ddf6dd98865b673a82e37ff238b","url":"https://git.kernel.org/stable/c/6b13cb8f48a42ddf6dd98865b673a82e37ff238b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6b13cb8f48a42ddf6dd98865b673a82e37ff238b","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/6b13cb8f48a42ddf6dd98865b673a82e37ff238b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43446","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43446.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43416","title":"powerpc, perf: Check that current->mm is alive before getting user callchain","status":"backported","project":false,"upstream":[{"sha":"e9bbfb4bfa86c6b5515b868d6982ac60505d7e39","url":"https://git.kernel.org/stable/c/e9bbfb4bfa86c6b5515b868d6982ac60505d7e39"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"e9bbfb4bfa86c6b5515b868d6982ac60505d7e39","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/e9bbfb4bfa86c6b5515b868d6982ac60505d7e39.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43416","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43416.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43409","title":"kprobes: avoid crash when rmmod/insmod after ftrace killed","status":"backported","project":false,"upstream":[{"sha":"e113f0b46d19626ec15388bcb91432c9a4fd6261","url":"https://git.kernel.org/stable/c/e113f0b46d19626ec15388bcb91432c9a4fd6261"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"e113f0b46d19626ec15388bcb91432c9a4fd6261","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/e113f0b46d19626ec15388bcb91432c9a4fd6261.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43409","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43409.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43408","title":"ceph: add a bunch of missing ceph_path_info initializers","status":"backported","project":false,"upstream":[{"sha":"43323a5934b660afae687e8e4e95ac328615a5c4","url":"https://git.kernel.org/stable/c/43323a5934b660afae687e8e4e95ac328615a5c4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"43323a5934b660afae687e8e4e95ac328615a5c4","lines":48,"reason":"","source":"https://github.com/torvalds/linux/commit/43323a5934b660afae687e8e4e95ac328615a5c4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43408","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43408.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43391","title":"nsfs: tighten permission checks for handle opening","status":"backported","project":false,"upstream":[{"sha":"d2324a9317f00013facb0ba00b00440e19d2af5e","url":"https://git.kernel.org/stable/c/d2324a9317f00013facb0ba00b00440e19d2af5e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d2324a9317f00013facb0ba00b00440e19d2af5e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43391","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43391.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43362","title":"smb: client: fix in-place encryption corruption in SMB2_write()","status":"backported","project":false,"upstream":[{"sha":"d78840a6a38d312dc1a51a65317bb67e46f0b929","url":"https://git.kernel.org/stable/c/d78840a6a38d312dc1a51a65317bb67e46f0b929"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d78840a6a38d312dc1a51a65317bb67e46f0b929","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/d78840a6a38d312dc1a51a65317bb67e46f0b929.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43362","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43362.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43344","title":"perf/x86/intel/uncore: Fix die ID init and look up bugs","status":"backported","project":false,"upstream":[{"sha":"a16d1ec4dd0cdcf689f324adde6067083bce9099","url":"https://git.kernel.org/stable/c/a16d1ec4dd0cdcf689f324adde6067083bce9099"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a16d1ec4dd0cdcf689f324adde6067083bce9099","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43344","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43344.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43326","title":"sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback","status":"backported","project":false,"upstream":[{"sha":"415cb193bb9736f0e830286c72a6fa8eb2a9cc5c","url":"https://git.kernel.org/stable/c/415cb193bb9736f0e830286c72a6fa8eb2a9cc5c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"415cb193bb9736f0e830286c72a6fa8eb2a9cc5c","lines":158,"reason":"","source":"https://github.com/torvalds/linux/commit/415cb193bb9736f0e830286c72a6fa8eb2a9cc5c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43326","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43326.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43318","title":"drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify","status":"backported","project":false,"upstream":[{"sha":"b18fc0ab837381c1a6ef28386602cd888f2d9edf","url":"https://git.kernel.org/stable/c/b18fc0ab837381c1a6ef28386602cd888f2d9edf"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b18fc0ab837381c1a6ef28386602cd888f2d9edf","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/b18fc0ab837381c1a6ef28386602cd888f2d9edf.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43318","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43318.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43317","title":"most: core: fix leak on early registration failure","status":"backported","project":false,"upstream":[{"sha":"2c198c272f9c9213b0fdf6b4a879f445c574f416","url":"https://git.kernel.org/stable/c/2c198c272f9c9213b0fdf6b4a879f445c574f416"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c198c272f9c9213b0fdf6b4a879f445c574f416","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/2c198c272f9c9213b0fdf6b4a879f445c574f416.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43309","title":"md raid: fix hang when stopping arrays with metadata through dm-raid","status":"backported","project":false,"upstream":[{"sha":"cefcb9297fbdb6d94b61787b4f8d84f55b741470","url":"https://git.kernel.org/stable/c/cefcb9297fbdb6d94b61787b4f8d84f55b741470"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"cefcb9297fbdb6d94b61787b4f8d84f55b741470","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/cefcb9297fbdb6d94b61787b4f8d84f55b741470.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43309","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43309.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43301","title":"media: chips-media: wave5: Fix PM runtime usage count underflow","status":"backported","project":false,"upstream":[{"sha":"9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38","url":"https://git.kernel.org/stable/c/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43301","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43301.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43299","title":"btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()","status":"backported","project":false,"upstream":[{"sha":"8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3","url":"https://git.kernel.org/stable/c/8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43299","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43299.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43288","title":"ext4: move ext4_percpu_param_init() before ext4_mb_init()","status":"backported","project":false,"upstream":[{"sha":"270564513489d98b721a1e4a10017978d5213bff","url":"https://git.kernel.org/stable/c/270564513489d98b721a1e4a10017978d5213bff"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"270564513489d98b721a1e4a10017978d5213bff","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43288","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43288.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43234","title":"team: avoid NETDEV_CHANGEMTU event when unregistering slave","status":"backported","project":false,"upstream":[{"sha":"bb4c698633c0e19717586a6524a33196cff01a32","url":"https://git.kernel.org/stable/c/bb4c698633c0e19717586a6524a33196cff01a32"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"bb4c698633c0e19717586a6524a33196cff01a32","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43234","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43234.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43188","title":"ceph: do not propagate page array emplacement errors as batch errors","status":"backported","project":false,"upstream":[{"sha":"707104682e3c163f7c14cdd6b07a3e95fb374759","url":"https://git.kernel.org/stable/c/707104682e3c163f7c14cdd6b07a3e95fb374759"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"707104682e3c163f7c14cdd6b07a3e95fb374759","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/707104682e3c163f7c14cdd6b07a3e95fb374759.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43188","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43188.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43174","title":"io_uring/zcrx: fix post open error handling","status":"backported","project":false,"upstream":[{"sha":"5d540e4508950c674d6feef1d95463d039bbf4f5","url":"https://git.kernel.org/stable/c/5d540e4508950c674d6feef1d95463d039bbf4f5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5d540e4508950c674d6feef1d95463d039bbf4f5","lines":32,"reason":"","source":"https://github.com/torvalds/linux/commit/5d540e4508950c674d6feef1d95463d039bbf4f5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43173","title":"net: ethernet: xscale: Check for PTP support properly","status":"backported","project":false,"upstream":[{"sha":"594163ea88a03bdb412063af50fc7177ef3cbeae","url":"https://git.kernel.org/stable/c/594163ea88a03bdb412063af50fc7177ef3cbeae"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"594163ea88a03bdb412063af50fc7177ef3cbeae","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/594163ea88a03bdb412063af50fc7177ef3cbeae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43173","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43173.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43172","title":"wifi: iwlwifi: fix 22000 series SMEM parsing","status":"backported","project":false,"upstream":[{"sha":"58192b9ce09b0f0f86e2036683bd542130b91a98","url":"https://git.kernel.org/stable/c/58192b9ce09b0f0f86e2036683bd542130b91a98"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"58192b9ce09b0f0f86e2036683bd542130b91a98","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/58192b9ce09b0f0f86e2036683bd542130b91a98.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43172","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43172.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43161","title":"iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode","status":"backported","project":false,"upstream":[{"sha":"42662d19839f34735b718129ea200e3734b07e50","url":"https://git.kernel.org/stable/c/42662d19839f34735b718129ea200e3734b07e50"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"42662d19839f34735b718129ea200e3734b07e50","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/42662d19839f34735b718129ea200e3734b07e50.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43161","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43161.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43137","title":"ASoC: SOF: Intel: hda: Fix NULL pointer dereference","status":"backported","project":false,"upstream":[{"sha":"16c589567a956d46a7c1363af3f64de3d420af20","url":"https://git.kernel.org/stable/c/16c589567a956d46a7c1363af3f64de3d420af20"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"16c589567a956d46a7c1363af3f64de3d420af20","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/16c589567a956d46a7c1363af3f64de3d420af20.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43126","title":"ALSA: mixer: oss: Add card disconnect checkpoints","status":"backported","project":false,"upstream":[{"sha":"084d5d44418148662365eced3e126ad1a81ee3e2","url":"https://git.kernel.org/stable/c/084d5d44418148662365eced3e126ad1a81ee3e2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"084d5d44418148662365eced3e126ad1a81ee3e2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43126","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43126.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43115","title":"srcu: Use irq_work to start GP in tiny SRCU","status":"backported","project":false,"upstream":[{"sha":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","url":"https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43115","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43115.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43095","title":"ASoC: SDCA: Fix errors in IRQ cleanup","status":"backported","project":false,"upstream":[{"sha":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","url":"https://git.kernel.org/stable/c/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","lines":145,"reason":"","source":"https://github.com/torvalds/linux/commit/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43095","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43095.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43088","title":"net: af_key: zero aligned sockaddr tail in PF_KEY exports","status":"backported","project":false,"upstream":[{"sha":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","url":"https://git.kernel.org/stable/c/426c355742f02cf743b347d9d7dbdc1bfbfa31ef"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43088","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43088.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43073","title":"x86-64: rename misleadingly named '__copy_user_nocache()' function","status":"backported","project":false,"upstream":[{"sha":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","url":"https://git.kernel.org/stable/c/d187a86de793f84766ea40b9ade7ac60aabbb4fe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","lines":84,"reason":"","source":"https://github.com/torvalds/linux/commit/d187a86de793f84766ea40b9ade7ac60aabbb4fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43073","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43073.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43053","title":"xfs: close crash window in attr dabtree inactivation","status":"backported","project":false,"upstream":[{"sha":"b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61","url":"https://git.kernel.org/stable/c/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61","lines":171,"reason":"","source":"https://github.com/torvalds/linux/commit/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43053","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43053.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43045","title":"mshv: Fix error handling in mshv_region_pin","status":"backported","project":false,"upstream":[{"sha":"c0e296f257671ba10249630fe58026f29e4804d9","url":"https://git.kernel.org/stable/c/c0e296f257671ba10249630fe58026f29e4804d9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c0e296f257671ba10249630fe58026f29e4804d9","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/c0e296f257671ba10249630fe58026f29e4804d9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43045","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43045.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43042","title":"mpls: add seqcount to protect the platform_label{,s} pair","status":"backported","project":false,"upstream":[{"sha":"629ec78ef8608d955ce217880cdc3e1873af3a15","url":"https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"629ec78ef8608d955ce217880cdc3e1873af3a15","lines":68,"reason":"","source":"https://github.com/torvalds/linux/commit/629ec78ef8608d955ce217880cdc3e1873af3a15.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43042","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43042.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43029","title":"mptcp: fix soft lockup in mptcp_recvmsg()","status":"backported","project":false,"upstream":[{"sha":"5dd8025a49c268ab6b94d978532af3ad341132a7","url":"https://git.kernel.org/stable/c/5dd8025a49c268ab6b94d978532af3ad341132a7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5dd8025a49c268ab6b94d978532af3ad341132a7","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/5dd8025a49c268ab6b94d978532af3ad341132a7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43029","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43029.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-43009","title":"bpf: Fix incorrect pruning due to atomic fetch precision tracking","status":"backported","project":false,"upstream":[{"sha":"179ee84a89114b854ac2dd1d293633a7f6c8dac1","url":"https://git.kernel.org/stable/c/179ee84a89114b854ac2dd1d293633a7f6c8dac1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"179ee84a89114b854ac2dd1d293633a7f6c8dac1","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-43009","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-43009.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31777","title":"ALSA: ctxfi: Check the error for index mapping","status":"backported","project":false,"upstream":[{"sha":"277c6960d4ddb94d16198afd70c92c3d4593d131","url":"https://git.kernel.org/stable/c/277c6960d4ddb94d16198afd70c92c3d4593d131"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"277c6960d4ddb94d16198afd70c92c3d4593d131","lines":162,"reason":"","source":"https://github.com/torvalds/linux/commit/277c6960d4ddb94d16198afd70c92c3d4593d131.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31777","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31777.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31729","title":"usb: typec: ucsi: validate connector number in ucsi_notify_common()","status":"backported","project":false,"upstream":[{"sha":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","url":"https://git.kernel.org/stable/c/d2d8c17ac01a1b1f638ea5d340a884ccc5015186"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/d2d8c17ac01a1b1f638ea5d340a884ccc5015186.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31729","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31729.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31710","title":"smb: client: fix dir separator in SMB1 UNIX mounts","status":"backported","project":false,"upstream":[{"sha":"c4d3fc5844d685441befd0caaab648321013cdfd","url":"https://git.kernel.org/stable/c/c4d3fc5844d685441befd0caaab648321013cdfd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c4d3fc5844d685441befd0caaab648321013cdfd","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/c4d3fc5844d685441befd0caaab648321013cdfd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31710","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31710.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31692","title":"rtnetlink: add missing netlink_ns_capable() check for peer netns","status":"backported","project":false,"upstream":[{"sha":"7b735ef81286007794a227ce2539419479c02a5f","url":"https://git.kernel.org/stable/c/7b735ef81286007794a227ce2539419479c02a5f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7b735ef81286007794a227ce2539419479c02a5f","lines":62,"reason":"","source":"https://github.com/torvalds/linux/commit/7b735ef81286007794a227ce2539419479c02a5f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31692","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31692.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31655","title":"pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled","status":"backported","project":false,"upstream":[{"sha":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","url":"https://git.kernel.org/stable/c/e91d5f94acf68618ea3ad9c92ac28614e791ae7d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31655","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31655.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31648","title":"mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()","status":"backported","project":false,"upstream":[{"sha":"f58df566524ebcdfa394329c64f47e3c9257516e","url":"https://git.kernel.org/stable/c/f58df566524ebcdfa394329c64f47e3c9257516e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"f58df566524ebcdfa394329c64f47e3c9257516e","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/f58df566524ebcdfa394329c64f47e3c9257516e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31648","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31648.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31591","title":"KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish","status":"backported","project":false,"upstream":[{"sha":"cb923ee6a80f4e604e6242a4702b59251e61a380","url":"https://git.kernel.org/stable/c/cb923ee6a80f4e604e6242a4702b59251e61a380"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"cb923ee6a80f4e604e6242a4702b59251e61a380","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/cb923ee6a80f4e604e6242a4702b59251e61a380.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31579","title":"wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit","status":"backported","project":false,"upstream":[{"sha":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","url":"https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31579","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31579.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31573","title":"media: verisilicon: Fix kernel panic due to __initconst misuse","status":"not-applicable","project":false,"upstream":[{"sha":"e8d97c270cb46a2a88739019d0f8547adc7d97da","url":"https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"e8d97c270cb46a2a88739019d0f8547adc7d97da","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/e8d97c270cb46a2a88739019d0f8547adc7d97da.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31573","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31573.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31537","title":"smb: server: make use of smbdirect_socket.send_io.bcredits","status":"backported","project":false,"upstream":[{"sha":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","url":"https://git.kernel.org/stable/c/34abd408c8ba24d7c97bd02ba874d8c714f49db1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/34abd408c8ba24d7c97bd02ba874d8c714f49db1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31537","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31537.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31536","title":"smb: server: let send_done handle a completion without IB_SEND_SIGNALED","status":"backported","project":false,"upstream":[{"sha":"9da82dc73cb03e85d716a2609364572367a5ff47","url":"https://git.kernel.org/stable/c/9da82dc73cb03e85d716a2609364572367a5ff47"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"9da82dc73cb03e85d716a2609364572367a5ff47","lines":38,"reason":"","source":"https://github.com/torvalds/linux/commit/9da82dc73cb03e85d716a2609364572367a5ff47.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31536","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31536.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31527","title":"driver core: platform: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","url":"https://git.kernel.org/stable/c/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","lines":127,"reason":"","source":"https://github.com/torvalds/linux/commit/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31527","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31527.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31516","title":"xfrm: prevent policy_hthresh.work from racing with netns teardown","status":"backported","project":false,"upstream":[{"sha":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","url":"https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/29fe3a61bcdce398ee3955101c39f89c01a8a77e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31516","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31516.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31502","title":"team: fix header_ops type confusion with non-Ethernet ports","status":"backported","project":false,"upstream":[{"sha":"425000dbf17373a4ab8be9428f5dc055ef870a56","url":"https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"425000dbf17373a4ab8be9428f5dc055ef870a56","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31502","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31502.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31499","title":"Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()","status":"backported","project":false,"upstream":[{"sha":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","url":"https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/00fdebbbc557a2fc21321ff2eaa22fd70c078608.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31499","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31499.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31493","title":"RDMA/efa: Fix use of completion ctx after free","status":"backported","project":false,"upstream":[{"sha":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","url":"https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","lines":179,"reason":"","source":"https://github.com/torvalds/linux/commit/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31493","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31493.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31487","title":"spi: use generic driver_override infrastructure","status":"backported","project":false,"upstream":[{"sha":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","url":"https://git.kernel.org/stable/c/cc34d77dd48708d810c12bfd6f5bf03304f6c824"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/cc34d77dd48708d810c12bfd6f5bf03304f6c824.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31487","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31487.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31458","title":"mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]","status":"backported","project":false,"upstream":[{"sha":"1bfe9fb5ed2667fb075682408b776b5273162615","url":"https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1bfe9fb5ed2667fb075682408b776b5273162615","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/1bfe9fb5ed2667fb075682408b776b5273162615.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31458","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31458.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31435","title":"netfs: Fix read abandonment during retry","status":"backported","project":false,"upstream":[{"sha":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","url":"https://git.kernel.org/stable/c/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31435","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31435.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-31420","title":"bridge: mrp: reject zero test interval to avoid OOM panic","status":"backported","project":false,"upstream":[{"sha":"fa6e24963342de4370e3a3c9af41e38277b74cf3","url":"https://git.kernel.org/stable/c/fa6e24963342de4370e3a3c9af41e38277b74cf3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"fa6e24963342de4370e3a3c9af41e38277b74cf3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-31420","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-31420.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23459","title":"ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS","status":"backported","project":false,"upstream":[{"sha":"8431c602f551549f082bbfa67f3003f2d8e3e132","url":"https://git.kernel.org/stable/c/8431c602f551549f082bbfa67f3003f2d8e3e132"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"8431c602f551549f082bbfa67f3003f2d8e3e132","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23459","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23459.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23448","title":"net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check","status":"backported","project":false,"upstream":[{"sha":"2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a","url":"https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23448","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23448.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23447","title":"net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check","status":"backported","project":false,"upstream":[{"sha":"77914255155e68a20aa41175edeecf8121dac391","url":"https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"77914255155e68a20aa41175edeecf8121dac391","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23447","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23447.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23393","title":"bridge: cfm: Fix race condition in peer_mep deletion","status":"backported","project":false,"upstream":[{"sha":"3715a00855316066cdda69d43648336367422127","url":"https://git.kernel.org/stable/c/3715a00855316066cdda69d43648336367422127"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3715a00855316066cdda69d43648336367422127","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/3715a00855316066cdda69d43648336367422127.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23393","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23393.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23371","title":"sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting","status":"backported","project":false,"upstream":[{"sha":"d658686a1331db3bb108ca079d76deb3208ed949","url":"https://git.kernel.org/stable/c/d658686a1331db3bb108ca079d76deb3208ed949"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d658686a1331db3bb108ca079d76deb3208ed949","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23371","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23371.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23348","title":"cxl: Fix race of nvdimm_bus object when creating nvdimm objects","status":"backported","project":false,"upstream":[{"sha":"96a1fd0d84b17360840f344826897fa71049870e","url":"https://git.kernel.org/stable/c/96a1fd0d84b17360840f344826897fa71049870e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"96a1fd0d84b17360840f344826897fa71049870e","lines":98,"reason":"","source":"https://github.com/torvalds/linux/commit/96a1fd0d84b17360840f344826897fa71049870e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23348","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23348.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23346","title":"arm64: io: Extract user memory type in ioremap_prot()","status":"backported","project":false,"upstream":[{"sha":"8f098037139b294050053123ab2bc0f819d08932","url":"https://git.kernel.org/stable/c/8f098037139b294050053123ab2bc0f819d08932"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8f098037139b294050053123ab2bc0f819d08932","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8f098037139b294050053123ab2bc0f819d08932.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23346","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23346.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23295","title":"accel/amdxdna: Fix dead lock for suspend and resume","status":"backported","project":false,"upstream":[{"sha":"1aa82181a3c285c7351523d587f7981ae4c015c8","url":"https://git.kernel.org/stable/c/1aa82181a3c285c7351523d587f7981ae4c015c8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"1aa82181a3c285c7351523d587f7981ae4c015c8","lines":144,"reason":"","source":"https://github.com/torvalds/linux/commit/1aa82181a3c285c7351523d587f7981ae4c015c8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23295","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23295.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23276","title":"net: add xmit recursion limit to tunnel xmit functions","status":"backported","project":false,"upstream":[{"sha":"6f1a9140ecda3baba3d945b9a6155af4268aafc4","url":"https://git.kernel.org/stable/c/6f1a9140ecda3baba3d945b9a6155af4268aafc4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"6f1a9140ecda3baba3d945b9a6155af4268aafc4","lines":152,"reason":"","source":"https://github.com/torvalds/linux/commit/6f1a9140ecda3baba3d945b9a6155af4268aafc4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23276","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23276.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23265","title":"f2fs: fix to do sanity check on node footer in {read,write}_end_io","status":"backported","project":false,"upstream":[{"sha":"50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4","url":"https://git.kernel.org/stable/c/50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4","lines":107,"reason":"","source":"https://github.com/torvalds/linux/commit/50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23265","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23265.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23240","title":"tls: Fix race condition in tls_sw_cancel_work_tx()","status":"backported","project":false,"upstream":[{"sha":"7bb09315f93dce6acc54bf59e5a95ba7365c2be4","url":"https://git.kernel.org/stable/c/7bb09315f93dce6acc54bf59e5a95ba7365c2be4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7bb09315f93dce6acc54bf59e5a95ba7365c2be4","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/7bb09315f93dce6acc54bf59e5a95ba7365c2be4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23240","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23240.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23239","title":"espintcp: Fix race condition in espintcp_close()","status":"backported","project":false,"upstream":[{"sha":"e1512c1db9e8794d8d130addd2615ec27231d994","url":"https://git.kernel.org/stable/c/e1512c1db9e8794d8d130addd2615ec27231d994"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"e1512c1db9e8794d8d130addd2615ec27231d994","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/e1512c1db9e8794d8d130addd2615ec27231d994.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23239","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23239.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23152","title":"wifi: mac80211: correctly decode TTLM with default link map","status":"backported","project":false,"upstream":[{"sha":"1eab33aa63c993685dd341e03bd5b267dd7403fa","url":"https://git.kernel.org/stable/c/1eab33aa63c993685dd341e03bd5b267dd7403fa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1eab33aa63c993685dd341e03bd5b267dd7403fa","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/1eab33aa63c993685dd341e03bd5b267dd7403fa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23152","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23152.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23137","title":"of: unittest: Fix memory leak in unittest_data_add()","status":"backported","project":false,"upstream":[{"sha":"235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b","url":"https://git.kernel.org/stable/c/235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23102","title":"arm64/fpsimd: signal: Fix restoration of SVE context","status":"backported","project":false,"upstream":[{"sha":"d2907cbe9ea0a54cbe078076f9d089240ee1e2d9","url":"https://git.kernel.org/stable/c/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d2907cbe9ea0a54cbe078076f9d089240ee1e2d9","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/d2907cbe9ea0a54cbe078076f9d089240ee1e2d9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23088","title":"tracing: Fix crash on synthetic stacktrace field usage","status":"backported","project":false,"upstream":[{"sha":"90f9f5d64cae4e72defd96a2a22760173cb3c9ec","url":"https://git.kernel.org/stable/c/90f9f5d64cae4e72defd96a2a22760173cb3c9ec"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"90f9f5d64cae4e72defd96a2a22760173cb3c9ec","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/90f9f5d64cae4e72defd96a2a22760173cb3c9ec.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23088","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23088.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23035","title":"net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv","status":"backported","project":false,"upstream":[{"sha":"4ef8512e1427111f7ba92b4a847d181ff0aeec42","url":"https://git.kernel.org/stable/c/4ef8512e1427111f7ba92b4a847d181ff0aeec42"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4ef8512e1427111f7ba92b4a847d181ff0aeec42","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/4ef8512e1427111f7ba92b4a847d181ff0aeec42.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23035","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23035.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23007","title":"block: zero non-PI portion of auto integrity buffer","status":"backported","project":false,"upstream":[{"sha":"ca22c566b89164f6e670af56ecc45f47ef3df819","url":"https://git.kernel.org/stable/c/ca22c566b89164f6e670af56ecc45f47ef3df819"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ca22c566b89164f6e670af56ecc45f47ef3df819","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/ca22c566b89164f6e670af56ecc45f47ef3df819.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23007","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23007.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-23000","title":"net/mlx5e: Fix crash on profile change rollback failure","status":"backported","project":false,"upstream":[{"sha":"4dadc4077e3f77d6d31e199a925fc7a705e7adeb","url":"https://git.kernel.org/stable/c/4dadc4077e3f77d6d31e199a925fc7a705e7adeb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"4dadc4077e3f77d6d31e199a925fc7a705e7adeb","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/4dadc4077e3f77d6d31e199a925fc7a705e7adeb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-23000","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-23000.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2026-22996","title":"net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv","status":"backported","project":false,"upstream":[{"sha":"123eda2e5b1638e298e3a66bb1e64a8da92de5e1","url":"https://git.kernel.org/stable/c/123eda2e5b1638e298e3a66bb1e64a8da92de5e1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"123eda2e5b1638e298e3a66bb1e64a8da92de5e1","lines":63,"reason":"","source":"https://github.com/torvalds/linux/commit/123eda2e5b1638e298e3a66bb1e64a8da92de5e1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-22996","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-22996.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71315","title":"drm/vkms: Convert to DRM's vblank timer","status":"backported","project":false,"upstream":[{"sha":"02e2681ffe1addde1fc8c35d05657b16bfa79613","url":"https://git.kernel.org/stable/c/02e2681ffe1addde1fc8c35d05657b16bfa79613"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"02e2681ffe1addde1fc8c35d05657b16bfa79613","lines":130,"reason":"","source":"https://github.com/torvalds/linux/commit/02e2681ffe1addde1fc8c35d05657b16bfa79613.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71315","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71315.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71302","title":"drm/panthor: fix for dma-fence safe access rules","status":"backported","project":false,"upstream":[{"sha":"efe24898485c5c831e629d9c6fb9350c35cb576f","url":"https://git.kernel.org/stable/c/efe24898485c5c831e629d9c6fb9350c35cb576f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"efe24898485c5c831e629d9c6fb9350c35cb576f","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/efe24898485c5c831e629d9c6fb9350c35cb576f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71302","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71302.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71272","title":"most: core: fix resource leak in most_register_interface error paths","status":"backported","project":false,"upstream":[{"sha":"1f4c9d8a1021281750c6cda126d6f8a40cc24e71","url":"https://git.kernel.org/stable/c/1f4c9d8a1021281750c6cda126d6f8a40cc24e71"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1f4c9d8a1021281750c6cda126d6f8a40cc24e71","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/1f4c9d8a1021281750c6cda126d6f8a40cc24e71.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71272","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71272.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71225","title":"md: suspend array while updating raid_disks via sysfs","status":"backported","project":false,"upstream":[{"sha":"2cc583653bbe050bacd1cadcc9776d39bf449740","url":"https://git.kernel.org/stable/c/2cc583653bbe050bacd1cadcc9776d39bf449740"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2cc583653bbe050bacd1cadcc9776d39bf449740","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/2cc583653bbe050bacd1cadcc9776d39bf449740.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71225","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71225.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71202","title":"iommu/sva: invalidate stale IOTLB entries for kernel address space","status":"backported","project":false,"upstream":[{"sha":"e37d5a2d60a338c5917c45296bac65da1382eda5","url":"https://git.kernel.org/stable/c/e37d5a2d60a338c5917c45296bac65da1382eda5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"e37d5a2d60a338c5917c45296bac65da1382eda5","lines":110,"reason":"","source":"https://github.com/torvalds/linux/commit/e37d5a2d60a338c5917c45296bac65da1382eda5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71202","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71202.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71160","title":"netfilter: nf_tables: avoid chain re-validation if possible","status":"backported","project":false,"upstream":[{"sha":"8e1a1bc4f5a42747c08130b8242ebebd1210b32f","url":"https://git.kernel.org/stable/c/8e1a1bc4f5a42747c08130b8242ebebd1210b32f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"8e1a1bc4f5a42747c08130b8242ebebd1210b32f","lines":177,"reason":"","source":"https://github.com/torvalds/linux/commit/8e1a1bc4f5a42747c08130b8242ebebd1210b32f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71160","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71160.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71129","title":"LoongArch: BPF: Sign extend kfunc call arguments","status":"backported","project":false,"upstream":[{"sha":"3f5a238f24d7b75f9efe324d3539ad388f58536e","url":"https://git.kernel.org/stable/c/3f5a238f24d7b75f9efe324d3539ad388f58536e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3f5a238f24d7b75f9efe324d3539ad388f58536e","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/3f5a238f24d7b75f9efe324d3539ad388f58536e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71117","title":"block: Remove queue freezing from several sysfs store callbacks","status":"backported","project":false,"upstream":[{"sha":"935a20d1bebf6236076785fac3ff81e3931834e9","url":"https://git.kernel.org/stable/c/935a20d1bebf6236076785fac3ff81e3931834e9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"935a20d1bebf6236076785fac3ff81e3931834e9","lines":113,"reason":"","source":"https://github.com/torvalds/linux/commit/935a20d1bebf6236076785fac3ff81e3931834e9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71117","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71117.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-71065","title":"f2fs: fix to avoid potential deadlock","status":"backported","project":false,"upstream":[{"sha":"ca8b201f28547e28343a6f00a6e91fa8c09572fe","url":"https://git.kernel.org/stable/c/ca8b201f28547e28343a6f00a6e91fa8c09572fe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ca8b201f28547e28343a6f00a6e91fa8c09572fe","lines":66,"reason":"","source":"https://github.com/torvalds/linux/commit/ca8b201f28547e28343a6f00a6e91fa8c09572fe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-71065","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-71065.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68781","title":"usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal","status":"backported","project":false,"upstream":[{"sha":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","url":"https://git.kernel.org/stable/c/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"41ca62e3e21e48c2903b3b45e232cf4f2ff7434f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/41ca62e3e21e48c2903b3b45e232cf4f2ff7434f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68781","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68781.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68768","title":"inet: frags: flush pending skbs in fqdir_pre_exit()","status":"backported","project":false,"upstream":[{"sha":"006a5035b495dec008805df249f92c22c89c3d2e","url":"https://git.kernel.org/stable/c/006a5035b495dec008805df249f92c22c89c3d2e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"006a5035b495dec008805df249f92c22c89c3d2e","lines":112,"reason":"","source":"https://github.com/torvalds/linux/commit/006a5035b495dec008805df249f92c22c89c3d2e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68751","title":"s390/fpu: Fix false-positive kmsan report in fpu_vstl()","status":"backported","project":false,"upstream":[{"sha":"14e4e4175b64dd9216b522f6ece8af6997d063b2","url":"https://git.kernel.org/stable/c/14e4e4175b64dd9216b522f6ece8af6997d063b2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"14e4e4175b64dd9216b522f6ece8af6997d063b2","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/14e4e4175b64dd9216b522f6ece8af6997d063b2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68751","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68751.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68338","title":"net: dsa: microchip: Don't free uninitialized ksz_irq","status":"backported","project":false,"upstream":[{"sha":"25b62cc5b22c45face094ae3e8717258e46d1d19","url":"https://git.kernel.org/stable/c/25b62cc5b22c45face094ae3e8717258e46d1d19"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"25b62cc5b22c45face094ae3e8717258e46d1d19","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/25b62cc5b22c45face094ae3e8717258e46d1d19.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68338","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68338.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68334","title":"platform/x86/amd/pmc: Add support for Van Gogh SoC","status":"backported","project":false,"upstream":[{"sha":"db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb","url":"https://git.kernel.org/stable/c/db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb","lines":28,"reason":"","source":"https://github.com/torvalds/linux/commit/db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68334","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68334.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68322","title":"parisc: Avoid crash due to unaligned access in unwinder","status":"backported","project":false,"upstream":[{"sha":"fd9f30d1038ee1624baa17a6ff11effe5f7617cb","url":"https://git.kernel.org/stable/c/fd9f30d1038ee1624baa17a6ff11effe5f7617cb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd9f30d1038ee1624baa17a6ff11effe5f7617cb","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/fd9f30d1038ee1624baa17a6ff11effe5f7617cb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68322","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68322.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68313","title":"x86/CPU/AMD: Add RDSEED fix for Zen5","status":"backported","project":false,"upstream":[{"sha":"607b9fb2ce248cc5b633c5949e0153838992c152","url":"https://git.kernel.org/stable/c/607b9fb2ce248cc5b633c5949e0153838992c152"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"607b9fb2ce248cc5b633c5949e0153838992c152","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/607b9fb2ce248cc5b633c5949e0153838992c152.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68313","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68313.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68304","title":"Bluetooth: hci_core: lookup hci_conn on RX path on protocol side","status":"backported","project":false,"upstream":[{"sha":"79a2d4678ba90bdba577dc3af88cc900d6dcd5ee","url":"https://git.kernel.org/stable/c/79a2d4678ba90bdba577dc3af88cc900d6dcd5ee"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"79a2d4678ba90bdba577dc3af88cc900d6dcd5ee","lines":327,"reason":"","source":"https://github.com/torvalds/linux/commit/79a2d4678ba90bdba577dc3af88cc900d6dcd5ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68304","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68304.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68296","title":"drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup","status":"backported","project":false,"upstream":[{"sha":"eb76d0f5553575599561010f24c277cc5b31d003","url":"https://git.kernel.org/stable/c/eb76d0f5553575599561010f24c277cc5b31d003"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb76d0f5553575599561010f24c277cc5b31d003","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/eb76d0f5553575599561010f24c277cc5b31d003.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68296","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68296.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68251","title":"erofs: avoid infinite loops due to corrupted subpage compact indexes","status":"backported","project":false,"upstream":[{"sha":"e13d315ae077bb7c3c6027cc292401bc0f4ec683","url":"https://git.kernel.org/stable/c/e13d315ae077bb7c3c6027cc292401bc0f4ec683"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e13d315ae077bb7c3c6027cc292401bc0f4ec683","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68251","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68251.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-68174","title":"amd/amdkfd: enhance kfd process check in switch partition","status":"backported","project":false,"upstream":[{"sha":"45da20e00d5da842e17dfc633072b127504f0d0e","url":"https://git.kernel.org/stable/c/45da20e00d5da842e17dfc633072b127504f0d0e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"45da20e00d5da842e17dfc633072b127504f0d0e","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/45da20e00d5da842e17dfc633072b127504f0d0e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-68174","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-68174.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40355","title":"sysfs: check visibility before changing group attribute ownership","status":"backported","project":false,"upstream":[{"sha":"c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33","url":"https://git.kernel.org/stable/c/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33","lines":52,"reason":"","source":"https://github.com/torvalds/linux/commit/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40355","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40355.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40354","title":"drm/amd/display: increase max link count and fix link->enc NULL pointer access","status":"backported","project":false,"upstream":[{"sha":"bec947cbe9a65783adb475a5fb47980d7b4f4796","url":"https://git.kernel.org/stable/c/bec947cbe9a65783adb475a5fb47980d7b4f4796"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"bec947cbe9a65783adb475a5fb47980d7b4f4796","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/bec947cbe9a65783adb475a5fb47980d7b4f4796.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40354","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40354.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40339","title":"drm/amdgpu: fix nullptr err of vm_handle_moved","status":"backported","project":false,"upstream":[{"sha":"859958a7faefe5b7742b7b8cdbc170713d4bf158","url":"https://git.kernel.org/stable/c/859958a7faefe5b7742b7b8cdbc170713d4bf158"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"859958a7faefe5b7742b7b8cdbc170713d4bf158","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/859958a7faefe5b7742b7b8cdbc170713d4bf158.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40339","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40339.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40333","title":"f2fs: fix infinite loop in __insert_extent_tree()","status":"backported","project":false,"upstream":[{"sha":"23361bd54966b437e1ed3eb1a704572f4b279e58","url":"https://git.kernel.org/stable/c/23361bd54966b437e1ed3eb1a704572f4b279e58"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"23361bd54966b437e1ed3eb1a704572f4b279e58","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/23361bd54966b437e1ed3eb1a704572f4b279e58.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40311","title":"accel/habanalabs: support mapping cb with vmalloc-backed coherent memory","status":"backported","project":false,"upstream":[{"sha":"513024d5a0e34fd34247043f1876b6138ca52847","url":"https://git.kernel.org/stable/c/513024d5a0e34fd34247043f1876b6138ca52847"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"513024d5a0e34fd34247043f1876b6138ca52847","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40311","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40311.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40303","title":"btrfs: ensure no dirty metadata is written back for an fs with errors","status":"backported","project":false,"upstream":[{"sha":"2618849f31e7cf51fadd4a5242458501a6d5b315","url":"https://git.kernel.org/stable/c/2618849f31e7cf51fadd4a5242458501a6d5b315"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2618849f31e7cf51fadd4a5242458501a6d5b315","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/2618849f31e7cf51fadd4a5242458501a6d5b315.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40303","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40303.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40266","title":"KVM: arm64: Check the untrusted offset in FF-A memory share","status":"backported","project":false,"upstream":[{"sha":"103e17aac09cdd358133f9e00998b75d6c1f1518","url":"https://git.kernel.org/stable/c/103e17aac09cdd358133f9e00998b75d6c1f1518"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"103e17aac09cdd358133f9e00998b75d6c1f1518","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/103e17aac09cdd358133f9e00998b75d6c1f1518.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40266","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40266.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40247","title":"drm/msm: Fix pgtable prealloc error path","status":"backported","project":false,"upstream":[{"sha":"830d68f2cb8ab6fb798bb9555016709a9e012af0","url":"https://git.kernel.org/stable/c/830d68f2cb8ab6fb798bb9555016709a9e012af0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"830d68f2cb8ab6fb798bb9555016709a9e012af0","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/830d68f2cb8ab6fb798bb9555016709a9e012af0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40247","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40247.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40217","title":"pidfs: validate extensible ioctls","status":"backported","project":false,"upstream":[{"sha":"3c17001b21b9f168c957ced9384abe969019b609","url":"https://git.kernel.org/stable/c/3c17001b21b9f168c957ced9384abe969019b609"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3c17001b21b9f168c957ced9384abe969019b609","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/3c17001b21b9f168c957ced9384abe969019b609.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40168","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().","status":"backported","project":false,"upstream":[{"sha":"235f81045c008169cc4e1955b4a64e118eebe61b","url":"https://git.kernel.org/stable/c/235f81045c008169cc4e1955b4a64e118eebe61b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"235f81045c008169cc4e1955b4a64e118eebe61b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40168","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40168.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40146","title":"blk-mq: fix potential deadlock while nr_requests grown","status":"backported","project":false,"upstream":[{"sha":"b86433721f46d934940528f28d49c1dedb690df1","url":"https://git.kernel.org/stable/c/b86433721f46d934940528f28d49c1dedb690df1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"b86433721f46d934940528f28d49c1dedb690df1","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/b86433721f46d934940528f28d49c1dedb690df1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40146","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40146.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40139","title":"smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().","status":"backported","project":false,"upstream":[{"sha":"935d783e5de9b64587f3adb25641dd8385e64ddb","url":"https://git.kernel.org/stable/c/935d783e5de9b64587f3adb25641dd8385e64ddb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"935d783e5de9b64587f3adb25641dd8385e64ddb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40139","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40139.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40102","title":"KVM: arm64: Prevent access to vCPU events before init","status":"backported","project":false,"upstream":[{"sha":"0aa1b76fe1429629215a7c79820e4b96233ac4a3","url":"https://git.kernel.org/stable/c/0aa1b76fe1429629215a7c79820e4b96233ac4a3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0aa1b76fe1429629215a7c79820e4b96233ac4a3","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40079","title":"riscv, bpf: Sign extend struct ops return values properly","status":"backported","project":false,"upstream":[{"sha":"fd2e08128944a7679e753f920e9eda72057e427c","url":"https://git.kernel.org/stable/c/fd2e08128944a7679e753f920e9eda72057e427c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"fd2e08128944a7679e753f920e9eda72057e427c","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/fd2e08128944a7679e753f920e9eda72057e427c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40064","title":"smc: Fix use-after-free in __pnet_find_base_ndev().","status":"backported","project":false,"upstream":[{"sha":"3d3466878afd8d43ec0ca2facfbc7f03e40d0f79","url":"https://git.kernel.org/stable/c/3d3466878afd8d43ec0ca2facfbc7f03e40d0f79"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3d3466878afd8d43ec0ca2facfbc7f03e40d0f79","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40064","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40064.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40025","title":"f2fs: fix to do sanity check on node footer for non inode dnode","status":"backported","project":false,"upstream":[{"sha":"c18ecd99e0c707ef8f83cace861cbc3162f4fdf1","url":"https://git.kernel.org/stable/c/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c18ecd99e0c707ef8f83cace861cbc3162f4fdf1","lines":144,"reason":"","source":"https://github.com/torvalds/linux/commit/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40025","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40025.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-40000","title":"wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()","status":"backported","project":false,"upstream":[{"sha":"3e31a6bc07312b448fad3b45de578471f86f0e77","url":"https://git.kernel.org/stable/c/3e31a6bc07312b448fad3b45de578471f86f0e77"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"3e31a6bc07312b448fad3b45de578471f86f0e77","lines":172,"reason":"","source":"https://github.com/torvalds/linux/commit/3e31a6bc07312b448fad3b45de578471f86f0e77.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-40000","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40000.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39990","title":"bpf: Check the helper function is valid in get_helper_proto","status":"backported","project":false,"upstream":[{"sha":"e4414b01c1cd9887bbde92f946c1ba94e40d6d64","url":"https://git.kernel.org/stable/c/e4414b01c1cd9887bbde92f946c1ba94e40d6d64"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"e4414b01c1cd9887bbde92f946c1ba94e40d6d64","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/e4414b01c1cd9887bbde92f946c1ba94e40d6d64.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39990","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39990.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39981","title":"Bluetooth: MGMT: Fix possible UAFs","status":"backported","project":false,"upstream":[{"sha":"302a1f674c00dd5581ab8e493ef44767c5101aab","url":"https://git.kernel.org/stable/c/302a1f674c00dd5581ab8e493ef44767c5101aab"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"302a1f674c00dd5581ab8e493ef44767c5101aab","lines":615,"reason":"","source":"https://github.com/torvalds/linux/commit/302a1f674c00dd5581ab8e493ef44767c5101aab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39981","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39981.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39961","title":"iommu/amd/pgtbl: Fix possible race while increase page table level","status":"backported","project":false,"upstream":[{"sha":"1e56310b40fd2e7e0b9493da9ff488af145bdd0c","url":"https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1e56310b40fd2e7e0b9493da9ff488af145bdd0c","lines":76,"reason":"","source":"https://github.com/torvalds/linux/commit/1e56310b40fd2e7e0b9493da9ff488af145bdd0c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39947","title":"net/mlx5e: Harden uplink netdev access against device unbind","status":"backported","project":false,"upstream":[{"sha":"6b4be64fd9fec16418f365c2d8e47a7566e9eba5","url":"https://git.kernel.org/stable/c/6b4be64fd9fec16418f365c2d8e47a7566e9eba5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6b4be64fd9fec16418f365c2d8e47a7566e9eba5","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/6b4be64fd9fec16418f365c2d8e47a7566e9eba5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39947","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39947.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39940","title":"dm-stripe: fix a possible integer overflow","status":"backported","project":false,"upstream":[{"sha":"1071d560afb4c245c2076494226df47db5a35708","url":"https://git.kernel.org/stable/c/1071d560afb4c245c2076494226df47db5a35708"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1071d560afb4c245c2076494226df47db5a35708","lines":18,"reason":"","source":"https://github.com/torvalds/linux/commit/1071d560afb4c245c2076494226df47db5a35708.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39940","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39940.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39932","title":"smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)","status":"backported","project":false,"upstream":[{"sha":"d9dcbbcf9145b68aa85c40947311a6907277e097","url":"https://git.kernel.org/stable/c/d9dcbbcf9145b68aa85c40947311a6907277e097"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d9dcbbcf9145b68aa85c40947311a6907277e097","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/d9dcbbcf9145b68aa85c40947311a6907277e097.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39927","title":"ceph: fix race condition validating r_parent before applying state","status":"backported","project":false,"upstream":[{"sha":"15f519e9f883b316d86e2bb6b767a023aafd9d83","url":"https://git.kernel.org/stable/c/15f519e9f883b316d86e2bb6b767a023aafd9d83"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"15f519e9f883b316d86e2bb6b767a023aafd9d83","lines":556,"reason":"","source":"https://github.com/torvalds/linux/commit/15f519e9f883b316d86e2bb6b767a023aafd9d83.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39927","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39927.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39925","title":"can: j1939: implement NETDEV_UNREGISTER notification handler","status":"backported","project":false,"upstream":[{"sha":"7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a","url":"https://git.kernel.org/stable/c/7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39925","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39925.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39862","title":"wifi: mt76: mt7915: fix list corruption after hardware restart","status":"backported","project":false,"upstream":[{"sha":"065c79df595af21d6d1b27d642860faa1d938774","url":"https://git.kernel.org/stable/c/065c79df595af21d6d1b27d642860faa1d938774"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"065c79df595af21d6d1b27d642860faa1d938774","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/065c79df595af21d6d1b27d642860faa1d938774.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39862","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39862.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39834","title":"net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow","status":"backported","project":false,"upstream":[{"sha":"a630f83592cdad1253523a1b760cfe78fef6cd9c","url":"https://git.kernel.org/stable/c/a630f83592cdad1253523a1b760cfe78fef6cd9c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a630f83592cdad1253523a1b760cfe78fef6cd9c","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/a630f83592cdad1253523a1b760cfe78fef6cd9c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39833","title":"mISDN: hfcpci: Fix warning when deleting uninitialized timer","status":"backported","project":false,"upstream":[{"sha":"97766512a9951b9fd6fc97f1b93211642bb0b220","url":"https://git.kernel.org/stable/c/97766512a9951b9fd6fc97f1b93211642bb0b220"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"97766512a9951b9fd6fc97f1b93211642bb0b220","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39833","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39833.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39830","title":"net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path","status":"backported","project":false,"upstream":[{"sha":"2c0a959bebdc1ada13cf9a8242f177c5400299e6","url":"https://git.kernel.org/stable/c/2c0a959bebdc1ada13cf9a8242f177c5400299e6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c0a959bebdc1ada13cf9a8242f177c5400299e6","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/2c0a959bebdc1ada13cf9a8242f177c5400299e6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39830","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39830.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39822","title":"io_uring/kbuf: fix signedness in this_len calculation","status":"backported","project":false,"upstream":[{"sha":"c64eff368ac676e8540344d27a3de47e0ad90d21","url":"https://git.kernel.org/stable/c/c64eff368ac676e8540344d27a3de47e0ad90d21"},{"sha":"c4dbca5be33c6203d2f611dbd7502f887e4cd954","url":"https://git.kernel.org/stable/c/c4dbca5be33c6203d2f611dbd7502f887e4cd954"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c64eff368ac676e8540344d27a3de47e0ad90d21","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/c64eff368ac676e8540344d27a3de47e0ad90d21.patch"},{"sha":"c4dbca5be33c6203d2f611dbd7502f887e4cd954","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/c4dbca5be33c6203d2f611dbd7502f887e4cd954.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39822","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39822.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39789","title":"crypto: x86/aegis - Add missing error checks","status":"backported","project":false,"upstream":[{"sha":"3d9eb180fbe8828cce43bce4c370124685b205c3","url":"https://git.kernel.org/stable/c/3d9eb180fbe8828cce43bce4c370124685b205c3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3d9eb180fbe8828cce43bce4c370124685b205c3","lines":97,"reason":"","source":"https://github.com/torvalds/linux/commit/3d9eb180fbe8828cce43bce4c370124685b205c3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39789","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39789.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39779","title":"btrfs: subpage: keep TOWRITE tag until folio is cleaned","status":"backported","project":false,"upstream":[{"sha":"b1511360c8ac882b0c52caa263620538e8d73220","url":"https://git.kernel.org/stable/c/b1511360c8ac882b0c52caa263620538e8d73220"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b1511360c8ac882b0c52caa263620538e8d73220","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/b1511360c8ac882b0c52caa263620538e8d73220.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39779","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39779.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39775","title":"mm/mremap: fix WARN with uffd that has remap events disabled","status":"backported","project":false,"upstream":[{"sha":"772e5b4a5e8360743645b9a466842d16092c4f94","url":"https://git.kernel.org/stable/c/772e5b4a5e8360743645b9a466842d16092c4f94"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"772e5b4a5e8360743645b9a466842d16092c4f94","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/772e5b4a5e8360743645b9a466842d16092c4f94.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39762","title":"drm/amd/display: add null check","status":"backported","project":false,"upstream":[{"sha":"158b9201c17fc93ed4253c2f03b77fd2671669a1","url":"https://git.kernel.org/stable/c/158b9201c17fc93ed4253c2f03b77fd2671669a1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"158b9201c17fc93ed4253c2f03b77fd2671669a1","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/158b9201c17fc93ed4253c2f03b77fd2671669a1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39747","title":"drm/msm: Add error handling for krealloc in metadata setup","status":"backported","project":false,"upstream":[{"sha":"1c8c354098ea9d4376a58c96ae6b65288a6f15d8","url":"https://git.kernel.org/stable/c/1c8c354098ea9d4376a58c96ae6b65288a6f15d8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c8c354098ea9d4376a58c96ae6b65288a6f15d8","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/1c8c354098ea9d4376a58c96ae6b65288a6f15d8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39747","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39747.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39746","title":"wifi: ath10k: shutdown driver when hardware is unreliable","status":"backported","project":false,"upstream":[{"sha":"c256a94d1b1b15109740306f7f2a7c2173e12072","url":"https://git.kernel.org/stable/c/c256a94d1b1b15109740306f7f2a7c2173e12072"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c256a94d1b1b15109740306f7f2a7c2173e12072","lines":135,"reason":"","source":"https://github.com/torvalds/linux/commit/c256a94d1b1b15109740306f7f2a7c2173e12072.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39746","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39746.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39732","title":"wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()","status":"backported","project":false,"upstream":[{"sha":"65c12b104cb942d588a1a093acc4537fb3d3b129","url":"https://git.kernel.org/stable/c/65c12b104cb942d588a1a093acc4537fb3d3b129"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"65c12b104cb942d588a1a093acc4537fb3d3b129","lines":24,"reason":"","source":"https://github.com/torvalds/linux/commit/65c12b104cb942d588a1a093acc4537fb3d3b129.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39732","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39732.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-39707","title":"drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities","status":"backported","project":false,"upstream":[{"sha":"b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288","url":"https://git.kernel.org/stable/c/b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-39707","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-39707.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38722","title":"habanalabs: fix UAF in export_dmabuf()","status":"backported","project":false,"upstream":[{"sha":"33927f3d0ecdcff06326d6e4edb6166aed42811c","url":"https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"33927f3d0ecdcff06326d6e4edb6166aed42811c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38722","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38722.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38717","title":"net: kcm: Fix race condition in kcm_unattach()","status":"backported","project":false,"upstream":[{"sha":"52565a935213cd6a8662ddb8efe5b4219343a25d","url":"https://git.kernel.org/stable/c/52565a935213cd6a8662ddb8efe5b4219343a25d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"52565a935213cd6a8662ddb8efe5b4219343a25d","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/52565a935213cd6a8662ddb8efe5b4219343a25d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38717","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38717.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38716","title":"hfs: fix general protection fault in hfs_find_init()","status":"backported","project":false,"upstream":[{"sha":"736a0516a16268995f4898eded49bfef077af709","url":"https://git.kernel.org/stable/c/736a0516a16268995f4898eded49bfef077af709"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"736a0516a16268995f4898eded49bfef077af709","lines":124,"reason":"","source":"https://github.com/torvalds/linux/commit/736a0516a16268995f4898eded49bfef077af709.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38716","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38716.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38675","title":"xfrm: state: initialize state_ptrs earlier in xfrm_state_find","status":"backported","project":false,"upstream":[{"sha":"94d077c331730510d5611b438640a292097341f0","url":"https://git.kernel.org/stable/c/94d077c331730510d5611b438640a292097341f0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"94d077c331730510d5611b438640a292097341f0","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/94d077c331730510d5611b438640a292097341f0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38675","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38675.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38660","title":"[ceph] parse_longname(): strrchr() expects NUL-terminated string","status":"backported","project":false,"upstream":[{"sha":"101841c38346f4ca41dc1802c867da990ffb32eb","url":"https://git.kernel.org/stable/c/101841c38346f4ca41dc1802c867da990ffb32eb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"101841c38346f4ca41dc1802c867da990ffb32eb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38660","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38660.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38656","title":"wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()","status":"not-applicable","project":false,"upstream":[{"sha":"cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6","url":"https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38656","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38656.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38636","title":"rv: Use strings in da monitors tracepoints","status":"backported","project":false,"upstream":[{"sha":"7f904ff6e58d398c4336f3c19c42b338324451f7","url":"https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7f904ff6e58d398c4336f3c19c42b338324451f7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38636","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38636.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38621","title":"md: make rdev_addable usable for rcu mode","status":"backported","project":false,"upstream":[{"sha":"13017b427118f4311471ee47df74872372ca8482","url":"https://git.kernel.org/stable/c/13017b427118f4311471ee47df74872372ca8482"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"13017b427118f4311471ee47df74872372ca8482","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38621","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38621.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38616","title":"tls: handle data disappearing from under the TLS ULP","status":"backported","project":false,"upstream":[{"sha":"6db015fc4b5d5f63a64a193f65d98da3a7fc811d","url":"https://git.kernel.org/stable/c/6db015fc4b5d5f63a64a193f65d98da3a7fc811d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"6db015fc4b5d5f63a64a193f65d98da3a7fc811d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38616","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38616.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38591","title":"bpf: Reject narrower access to pointer ctx fields","status":"backported","project":false,"upstream":[{"sha":"e09299225d5ba3916c91ef70565f7d2187e4cca0","url":"https://git.kernel.org/stable/c/e09299225d5ba3916c91ef70565f7d2187e4cca0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e09299225d5ba3916c91ef70565f7d2187e4cca0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38585","title":"staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()","status":"backported","project":false,"upstream":[{"sha":"ee4cf798202d285dcbe85e4467a094c44f5ed8e6","url":"https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","url":"https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"ee4cf798202d285dcbe85e4467a094c44f5ed8e6","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/ee4cf798202d285dcbe85e4467a094c44f5ed8e6.patch"},{"sha":"51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654","lines":168072,"reason":"","source":"https://github.com/torvalds/linux/commit/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38585","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38585.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38449","title":"drm/gem: Acquire references on GEM handles for framebuffers","status":"backported","project":false,"upstream":[{"sha":"5307dce878d4126e1b375587318955bd019c3741","url":"https://git.kernel.org/stable/c/5307dce878d4126e1b375587318955bd019c3741"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"5307dce878d4126e1b375587318955bd019c3741","lines":122,"reason":"","source":"https://github.com/torvalds/linux/commit/5307dce878d4126e1b375587318955bd019c3741.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38449","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38449.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38438","title":"ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.","status":"backported","project":false,"upstream":[{"sha":"6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e","url":"https://git.kernel.org/stable/c/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e","lines":21,"reason":"","source":"https://github.com/torvalds/linux/commit/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38438","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38438.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38426","title":"drm/amdgpu: Add basic validation for RAS header","status":"backported","project":false,"upstream":[{"sha":"5df0d6addb7e9b6f71f7162d1253762a5be9138e","url":"https://git.kernel.org/stable/c/5df0d6addb7e9b6f71f7162d1253762a5be9138e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5df0d6addb7e9b6f71f7162d1253762a5be9138e","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/5df0d6addb7e9b6f71f7162d1253762a5be9138e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38426","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38426.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38372","title":"RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling","status":"backported","project":false,"upstream":[{"sha":"2c6b640ea08bff1a192bf87fa45246ff1e40767c","url":"https://git.kernel.org/stable/c/2c6b640ea08bff1a192bf87fa45246ff1e40767c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2c6b640ea08bff1a192bf87fa45246ff1e40767c","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/2c6b640ea08bff1a192bf87fa45246ff1e40767c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38372","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38372.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38369","title":"dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using","status":"backported","project":false,"upstream":[{"sha":"17502e7d7b7113346296f6758324798d536c31fd","url":"https://git.kernel.org/stable/c/17502e7d7b7113346296f6758324798d536c31fd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"17502e7d7b7113346296f6758324798d536c31fd","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/17502e7d7b7113346296f6758324798d536c31fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38369","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38369.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38333","title":"f2fs: fix to bail out in get_new_segment()","status":"backported","project":false,"upstream":[{"sha":"bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2","url":"https://git.kernel.org/stable/c/bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38333","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38333.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38311","title":"iavf: get rid of the crit lock","status":"backported","project":false,"upstream":[{"sha":"120f28a6f314fef7f282c99f196923fe44081cad","url":"https://git.kernel.org/stable/c/120f28a6f314fef7f282c99f196923fe44081cad"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"120f28a6f314fef7f282c99f196923fe44081cad","lines":513,"reason":"","source":"https://github.com/torvalds/linux/commit/120f28a6f314fef7f282c99f196923fe44081cad.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38311","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38311.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38264","title":"nvme-tcp: sanitize request list handling","status":"backported","project":false,"upstream":[{"sha":"0bf04c874fcb1ae46a863034296e4b33d8fbd66c","url":"https://git.kernel.org/stable/c/0bf04c874fcb1ae46a863034296e4b33d8fbd66c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0bf04c874fcb1ae46a863034296e4b33d8fbd66c","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/0bf04c874fcb1ae46a863034296e4b33d8fbd66c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38264","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38264.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38237","title":"media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()","status":"backported","project":false,"upstream":[{"sha":"bd9f6ce7d512fa21249415c16af801a4ed5d97b6","url":"https://git.kernel.org/stable/c/bd9f6ce7d512fa21249415c16af801a4ed5d97b6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"bd9f6ce7d512fa21249415c16af801a4ed5d97b6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38207","title":"mm: fix uprobe pte be overwritten when expanding vma","status":"backported","project":false,"upstream":[{"sha":"2b12d06c37fd3a394376f42f026a7478d826ed63","url":"https://git.kernel.org/stable/c/2b12d06c37fd3a394376f42f026a7478d826ed63"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b12d06c37fd3a394376f42f026a7478d826ed63","lines":58,"reason":"","source":"https://github.com/torvalds/linux/commit/2b12d06c37fd3a394376f42f026a7478d826ed63.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38207","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38207.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38206","title":"exfat: fix double free in delayed_free","status":"backported","project":false,"upstream":[{"sha":"1f3d9724e16d62c7d42c67d6613b8512f2887c22","url":"https://git.kernel.org/stable/c/1f3d9724e16d62c7d42c67d6613b8512f2887c22"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1f3d9724e16d62c7d42c67d6613b8512f2887c22","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38206","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38206.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38205","title":"drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1","status":"backported","project":false,"upstream":[{"sha":"7e40f64896e8e3dca471e287672db5ace12ea0be","url":"https://git.kernel.org/stable/c/7e40f64896e8e3dca471e287672db5ace12ea0be"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7e40f64896e8e3dca471e287672db5ace12ea0be","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38205","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38205.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38203","title":"jfs: Fix null-ptr-deref in jfs_ioc_trim","status":"backported","project":false,"upstream":[{"sha":"a4685408ff6c3e2af366ad9a7274f45ff3f394ee","url":"https://git.kernel.org/stable/c/a4685408ff6c3e2af366ad9a7274f45ff3f394ee"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a4685408ff6c3e2af366ad9a7274f45ff3f394ee","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38203","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38203.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38199","title":"wifi: ath12k: Fix memory leak due to multiple rx_stats allocation","status":"backported","project":false,"upstream":[{"sha":"c426497fa2055c8005196922e7d29c41d7e0948a","url":"https://git.kernel.org/stable/c/c426497fa2055c8005196922e7d29c41d7e0948a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c426497fa2055c8005196922e7d29c41d7e0948a","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/c426497fa2055c8005196922e7d29c41d7e0948a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38199","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38199.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38187","title":"drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()","status":"backported","project":false,"upstream":[{"sha":"9802f0a63b641f4cddb2139c814c2e95cb825099","url":"https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"9802f0a63b641f4cddb2139c814c2e95cb825099","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/9802f0a63b641f4cddb2139c814c2e95cb825099.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38187","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38187.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38140","title":"dm: limit swapping tables for devices with zone write plugs","status":"backported","project":false,"upstream":[{"sha":"121218bef4c1df165181f5cd8fc3a2246bac817e","url":"https://git.kernel.org/stable/c/121218bef4c1df165181f5cd8fc3a2246bac817e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"121218bef4c1df165181f5cd8fc3a2246bac817e","lines":166,"reason":"","source":"https://github.com/torvalds/linux/commit/121218bef4c1df165181f5cd8fc3a2246bac817e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38140","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38140.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38137","title":"PCI/pwrctrl: Cancel outstanding rescan work when unregistering","status":"backported","project":false,"upstream":[{"sha":"8b926f237743f020518162c62b93cb7107a2b5eb","url":"https://git.kernel.org/stable/c/8b926f237743f020518162c62b93cb7107a2b5eb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8b926f237743f020518162c62b93cb7107a2b5eb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/8b926f237743f020518162c62b93cb7107a2b5eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38137","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38137.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38080","title":"drm/amd/display: Increase block_sequence array size","status":"backported","project":false,"upstream":[{"sha":"3a7810c212bcf2f722671dadf4b23ff70a7d23ee","url":"https://git.kernel.org/stable/c/3a7810c212bcf2f722671dadf4b23ff70a7d23ee"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a7810c212bcf2f722671dadf4b23ff70a7d23ee","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3a7810c212bcf2f722671dadf4b23ff70a7d23ee.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38080","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38080.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38039","title":"net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled","status":"backported","project":false,"upstream":[{"sha":"689805dcc474c2accb5cffbbcea1c06ee4a54570","url":"https://git.kernel.org/stable/c/689805dcc474c2accb5cffbbcea1c06ee4a54570"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"689805dcc474c2accb5cffbbcea1c06ee4a54570","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/689805dcc474c2accb5cffbbcea1c06ee4a54570.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38039","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38039.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38038","title":"cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost","status":"backported","project":false,"upstream":[{"sha":"db1cafc77aaaf871509da06f4a864e9af6d6791f","url":"https://git.kernel.org/stable/c/db1cafc77aaaf871509da06f4a864e9af6d6791f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"db1cafc77aaaf871509da06f4a864e9af6d6791f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/db1cafc77aaaf871509da06f4a864e9af6d6791f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38038","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38038.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38036","title":"drm/xe/vf: Perform early GT MMIO initialization to read GMDID","status":"backported","project":false,"upstream":[{"sha":"13265fe7426ec9ba5aa86baab913417ca361e8a4","url":"https://git.kernel.org/stable/c/13265fe7426ec9ba5aa86baab913417ca361e8a4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"13265fe7426ec9ba5aa86baab913417ca361e8a4","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/13265fe7426ec9ba5aa86baab913417ca361e8a4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38036","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38036.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-38014","title":"dmaengine: idxd: Refactor remove call with idxd_cleanup() helper","status":"backported","project":false,"upstream":[{"sha":"a409e919ca321cc0e28f8abf96fde299f0072a81","url":"https://git.kernel.org/stable/c/a409e919ca321cc0e28f8abf96fde299f0072a81"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a409e919ca321cc0e28f8abf96fde299f0072a81","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/a409e919ca321cc0e28f8abf96fde299f0072a81.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-38014","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38014.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37907","title":"accel/ivpu: Fix locking order in ivpu_job_submit","status":"backported","project":false,"upstream":[{"sha":"ab680dc6c78aa035e944ecc8c48a1caab9f39924","url":"https://git.kernel.org/stable/c/ab680dc6c78aa035e944ecc8c48a1caab9f39924"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ab680dc6c78aa035e944ecc8c48a1caab9f39924","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/ab680dc6c78aa035e944ecc8c48a1caab9f39924.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37907","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37907.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37880","title":"um: work around sched_yield not yielding in time-travel mode","status":"backported","project":false,"upstream":[{"sha":"887c5c12e80c8424bd471122d2e8b6b462e12874","url":"https://git.kernel.org/stable/c/887c5c12e80c8424bd471122d2e8b6b462e12874"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"887c5c12e80c8424bd471122d2e8b6b462e12874","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/887c5c12e80c8424bd471122d2e8b6b462e12874.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37880","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37880.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37870","title":"drm/amd/display: prevent hang on link training fail","status":"backported","project":false,"upstream":[{"sha":"8058061ed9d6bc259d1e678607b07d259342c08f","url":"https://git.kernel.org/stable/c/8058061ed9d6bc259d1e678607b07d259342c08f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8058061ed9d6bc259d1e678607b07d259342c08f","lines":25,"reason":"","source":"https://github.com/torvalds/linux/commit/8058061ed9d6bc259d1e678607b07d259342c08f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37834","title":"mm/vmscan: don't try to reclaim hwpoison folio","status":"backported","project":false,"upstream":[{"sha":"1b0449544c6482179ac84530b61fc192a6527bfd","url":"https://git.kernel.org/stable/c/1b0449544c6482179ac84530b61fc192a6527bfd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1b0449544c6482179ac84530b61fc192a6527bfd","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/1b0449544c6482179ac84530b61fc192a6527bfd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37833","title":"net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads","status":"backported","project":false,"upstream":[{"sha":"fbb429ddff5c8e479edcc7dde5a542c9295944e6","url":"https://git.kernel.org/stable/c/fbb429ddff5c8e479edcc7dde5a542c9295944e6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"fbb429ddff5c8e479edcc7dde5a542c9295944e6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37833","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37833.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37826","title":"scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()","status":"backported","project":false,"upstream":[{"sha":"08a966a917fe3d92150fa3cc15793ad5e57051eb","url":"https://git.kernel.org/stable/c/08a966a917fe3d92150fa3cc15793ad5e57051eb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"08a966a917fe3d92150fa3cc15793ad5e57051eb","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/08a966a917fe3d92150fa3cc15793ad5e57051eb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37826","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37826.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37802","title":"ksmbd: fix WARNING \"do not call blocking ops when !TASK_RUNNING\"","status":"backported","project":false,"upstream":[{"sha":"1df0d4c616138784e033ad337961b6e1a6bcd999","url":"https://git.kernel.org/stable/c/1df0d4c616138784e033ad337961b6e1a6bcd999"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1df0d4c616138784e033ad337961b6e1a6bcd999","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/1df0d4c616138784e033ad337961b6e1a6bcd999.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37802","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37802.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37800","title":"driver core: fix potential NULL pointer dereference in dev_uevent()","status":"backported","project":false,"upstream":[{"sha":"18daa52418e7e4629ed1703b64777294209d2622","url":"https://git.kernel.org/stable/c/18daa52418e7e4629ed1703b64777294209d2622"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"18daa52418e7e4629ed1703b64777294209d2622","lines":79,"reason":"","source":"https://github.com/torvalds/linux/commit/18daa52418e7e4629ed1703b64777294209d2622.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37800","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37800.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37777","title":"ksmbd: fix use-after-free in __smb2_lease_break_noti()","status":"backported","project":false,"upstream":[{"sha":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","url":"https://git.kernel.org/stable/c/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37777","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37777.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37776","title":"ksmbd: fix use-after-free in smb_break_all_levII_oplock()","status":"backported","project":false,"upstream":[{"sha":"18b4fac5ef17f77fed9417d22210ceafd6525fc7","url":"https://git.kernel.org/stable/c/18b4fac5ef17f77fed9417d22210ceafd6525fc7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"18b4fac5ef17f77fed9417d22210ceafd6525fc7","lines":91,"reason":"","source":"https://github.com/torvalds/linux/commit/18b4fac5ef17f77fed9417d22210ceafd6525fc7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37776","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37776.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-37750","title":"smb: client: fix UAF in decryption with multichannel","status":"backported","project":false,"upstream":[{"sha":"9502dd5c7029902f4a425bf959917a5a9e7c0e50","url":"https://git.kernel.org/stable/c/9502dd5c7029902f4a425bf959917a5a9e7c0e50"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9502dd5c7029902f4a425bf959917a5a9e7c0e50","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-37750","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-37750.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23133","title":"wifi: ath11k: update channel list in reg notifier instead reg worker","status":"backported","project":false,"upstream":[{"sha":"933ab187e679e6fbdeea1835ae39efcc59c022d2","url":"https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"933ab187e679e6fbdeea1835ae39efcc59c022d2","lines":46,"reason":"","source":"https://github.com/torvalds/linux/commit/933ab187e679e6fbdeea1835ae39efcc59c022d2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23133","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23133.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23132","title":"f2fs: quota: fix to avoid warning in dquot_writeback_dquots()","status":"backported","project":false,"upstream":[{"sha":"eb85c2410d6f581e957cd03a644ff6ddbe592af9","url":"https://git.kernel.org/stable/c/eb85c2410d6f581e957cd03a644ff6ddbe592af9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"eb85c2410d6f581e957cd03a644ff6ddbe592af9","lines":232,"reason":"","source":"https://github.com/torvalds/linux/commit/eb85c2410d6f581e957cd03a644ff6ddbe592af9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23132","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23132.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23130","title":"f2fs: fix to avoid panic once fallocation fails for pinfile","status":"backported","project":false,"upstream":[{"sha":"48ea8b200414ac69ea96f4c231f5c7ef1fbeffef","url":"https://git.kernel.org/stable/c/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"48ea8b200414ac69ea96f4c231f5c7ef1fbeffef","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23130","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23130.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-23129","title":"wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path","status":"backported","project":false,"upstream":[{"sha":"68410c5bd381a81bcc92b808e7dc4e6b9ed25d11","url":"https://git.kernel.org/stable/c/68410c5bd381a81bcc92b808e7dc4e6b9ed25d11"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"68410c5bd381a81bcc92b808e7dc4e6b9ed25d11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-23129","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-23129.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22127","title":"f2fs: fix potential deadloop in prepare_compress_overwrite()","status":"backported","project":false,"upstream":[{"sha":"3147ee567dd9004a49826ddeaf0a4b12865d4409","url":"https://git.kernel.org/stable/c/3147ee567dd9004a49826ddeaf0a4b12865d4409"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3147ee567dd9004a49826ddeaf0a4b12865d4409","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22127","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22127.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22125","title":"md/raid1,raid10: don't ignore IO flags","status":"backported","project":false,"upstream":[{"sha":"e879a0d9cb086c8e52ce6c04e5bfa63825a6213c","url":"https://git.kernel.org/stable/c/e879a0d9cb086c8e52ce6c04e5bfa63825a6213c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"e879a0d9cb086c8e52ce6c04e5bfa63825a6213c","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/e879a0d9cb086c8e52ce6c04e5bfa63825a6213c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22125","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22125.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22124","title":"md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb","status":"backported","project":false,"upstream":[{"sha":"6130825f34d41718c98a9b1504a79a23e379701e","url":"https://git.kernel.org/stable/c/6130825f34d41718c98a9b1504a79a23e379701e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"6130825f34d41718c98a9b1504a79a23e379701e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22124","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22124.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22113","title":"ext4: avoid journaling sb update on error if journal is destroying","status":"backported","project":false,"upstream":[{"sha":"ce2f26e73783b4a7c46a86e3af5b5c8de0971790","url":"https://git.kernel.org/stable/c/ce2f26e73783b4a7c46a86e3af5b5c8de0971790"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ce2f26e73783b4a7c46a86e3af5b5c8de0971790","lines":77,"reason":"","source":"https://github.com/torvalds/linux/commit/ce2f26e73783b4a7c46a86e3af5b5c8de0971790.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22113","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22113.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22108","title":"bnxt_en: Mask the bd_cnt field in the TX BD properly","status":"backported","project":false,"upstream":[{"sha":"107b25db61122d8f990987895c2912927b8b6e3f","url":"https://git.kernel.org/stable/c/107b25db61122d8f990987895c2912927b8b6e3f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"107b25db61122d8f990987895c2912927b8b6e3f","lines":33,"reason":"","source":"https://github.com/torvalds/linux/commit/107b25db61122d8f990987895c2912927b8b6e3f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22108","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22108.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22104","title":"ibmvnic: Use kernel helpers for hex dumps","status":"backported","project":false,"upstream":[{"sha":"d93a6caab5d7d9b5ce034d75b1e1e993338e3852","url":"https://git.kernel.org/stable/c/d93a6caab5d7d9b5ce034d75b1e1e993338e3852"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d93a6caab5d7d9b5ce034d75b1e1e993338e3852","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22104","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22104.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22103","title":"net: fix NULL pointer dereference in l3mdev_l3_rcv","status":"backported","project":false,"upstream":[{"sha":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","url":"https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22103","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22103.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22101","title":"net: libwx: fix Tx L4 checksum","status":"backported","project":false,"upstream":[{"sha":"c7d82913d5f9e97860772ee4051eaa66b56a6273","url":"https://git.kernel.org/stable/c/c7d82913d5f9e97860772ee4051eaa66b56a6273"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"c7d82913d5f9e97860772ee4051eaa66b56a6273","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22101","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22101.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22043","title":"ksmbd: add bounds check for durable handle context","status":"backported","project":false,"upstream":[{"sha":"542027e123fc0bfd61dd59e21ae0ee4ef2101b29","url":"https://git.kernel.org/stable/c/542027e123fc0bfd61dd59e21ae0ee4ef2101b29"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"542027e123fc0bfd61dd59e21ae0ee4ef2101b29","lines":39,"reason":"","source":"https://github.com/torvalds/linux/commit/542027e123fc0bfd61dd59e21ae0ee4ef2101b29.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22039","title":"ksmbd: fix overflow in dacloffset bounds check","status":"backported","project":false,"upstream":[{"sha":"beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42","url":"https://git.kernel.org/stable/c/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22039","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22039.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-22028","title":"media: vimc: skip .s_stream() for stopped entities","status":"backported","project":false,"upstream":[{"sha":"36cef585e2a31e4ddf33a004b0584a7a572246de","url":"https://git.kernel.org/stable/c/36cef585e2a31e4ddf33a004b0584a7a572246de"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"36cef585e2a31e4ddf33a004b0584a7a572246de","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/36cef585e2a31e4ddf33a004b0584a7a572246de.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-22028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-22028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21985","title":"drm/amd/display: Fix out-of-bound accesses","status":"backported","project":false,"upstream":[{"sha":"8adbb2a98b00926315fd513b5fe2596b5716b82d","url":"https://git.kernel.org/stable/c/8adbb2a98b00926315fd513b5fe2596b5716b82d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8adbb2a98b00926315fd513b5fe2596b5716b82d","lines":40,"reason":"","source":"https://github.com/torvalds/linux/commit/8adbb2a98b00926315fd513b5fe2596b5716b82d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21985","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21985.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21976","title":"fbdev: hyperv_fb: Allow graceful removal of framebuffer","status":"backported","project":false,"upstream":[{"sha":"ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","url":"https://git.kernel.org/stable/c/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","lines":54,"reason":"","source":"https://github.com/torvalds/linux/commit/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21976","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21976.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21949","title":"LoongArch: Set hugetlb mmap base address aligned with pmd size","status":"backported","project":false,"upstream":[{"sha":"3109d5ff484b7bc7b955f166974c6776d91f247b","url":"https://git.kernel.org/stable/c/3109d5ff484b7bc7b955f166974c6776d91f247b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3109d5ff484b7bc7b955f166974c6776d91f247b","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/3109d5ff484b7bc7b955f166974c6776d91f247b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21942","title":"btrfs: zoned: fix extent range end unlock in cow_file_range()","status":"not-applicable","project":false,"upstream":[{"sha":"5a4041f2c47247575a6c2e53ce14f7b0ac946c33","url":"https://git.kernel.org/stable/c/5a4041f2c47247575a6c2e53ce14f7b0ac946c33"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"5a4041f2c47247575a6c2e53ce14f7b0ac946c33","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/5a4041f2c47247575a6c2e53ce14f7b0ac946c33.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21942","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21942.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21907","title":"mm: memory-failure: update ttu flag inside unmap_poisoned_folio","status":"backported","project":false,"upstream":[{"sha":"b81679b1633aa43c0d973adfa816d78c1ed0d032","url":"https://git.kernel.org/stable/c/b81679b1633aa43c0d973adfa816d78c1ed0d032"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"b81679b1633aa43c0d973adfa816d78c1ed0d032","lines":128,"reason":"","source":"https://github.com/torvalds/linux/commit/b81679b1633aa43c0d973adfa816d78c1ed0d032.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21907","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21907.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21886","title":"RDMA/mlx5: Fix implicit ODP hang on parent deregistration","status":"not-applicable","project":false,"upstream":[{"sha":"3d8c6f26893d55fab218ad086719de1fc9bb86ba","url":"https://git.kernel.org/stable/c/3d8c6f26893d55fab218ad086719de1fc9bb86ba"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"within-limit","patches":[{"sha":"3d8c6f26893d55fab218ad086719de1fc9bb86ba","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/3d8c6f26893d55fab218ad086719de1fc9bb86ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21886","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21886.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21870","title":"ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers","status":"backported","project":false,"upstream":[{"sha":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","url":"https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21836","title":"io_uring/kbuf: reallocate buf lists on upgrade","status":"backported","project":false,"upstream":[{"sha":"8802766324e1f5d414a81ac43365c20142e85603","url":"https://git.kernel.org/stable/c/8802766324e1f5d414a81ac43365c20142e85603"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8802766324e1f5d414a81ac43365c20142e85603","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/8802766324e1f5d414a81ac43365c20142e85603.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21836","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21836.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21825","title":"bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT","status":"backported","project":false,"upstream":[{"sha":"58f038e6d209d2dd862fcf5de55407855856794d","url":"https://git.kernel.org/stable/c/58f038e6d209d2dd862fcf5de55407855856794d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"58f038e6d209d2dd862fcf5de55407855856794d","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/58f038e6d209d2dd862fcf5de55407855856794d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21825","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21825.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21817","title":"block: mark GFP_NOIO around sysfs ->store()","status":"not-applicable","project":false,"upstream":[{"sha":"7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c","url":"https://git.kernel.org/stable/c/7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c"}],"evidence":[],"submission_lore":[],"basis":"CNA default unaffected","review":null,"size":{"status":"unknown","patches":[{"sha":"7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21817","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21817.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21752","title":"btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents","status":"backported","project":false,"upstream":[{"sha":"dc14ba10781bd2629835696b7cc1febf914768e9","url":"https://git.kernel.org/stable/c/dc14ba10781bd2629835696b7cc1febf914768e9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"dc14ba10781bd2629835696b7cc1febf914768e9","lines":56,"reason":"","source":"https://github.com/torvalds/linux/commit/dc14ba10781bd2629835696b7cc1febf914768e9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21732","title":"RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error","status":"backported","project":false,"upstream":[{"sha":"abb604a1a9c87255c7a6f3b784410a9707baf467","url":"https://git.kernel.org/stable/c/abb604a1a9c87255c7a6f3b784410a9707baf467"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"abb604a1a9c87255c7a6f3b784410a9707baf467","lines":43,"reason":"","source":"https://github.com/torvalds/linux/commit/abb604a1a9c87255c7a6f3b784410a9707baf467.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21732","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21732.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21693","title":"mm: zswap: properly synchronize freeing resources during CPU hotunplug","status":"backported","project":false,"upstream":[{"sha":"12dcb0ef540629a281533f9dedc1b6b8e14cfb65","url":"https://git.kernel.org/stable/c/12dcb0ef540629a281533f9dedc1b6b8e14cfb65"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"12dcb0ef540629a281533f9dedc1b6b8e14cfb65","lines":133,"reason":"","source":"https://github.com/torvalds/linux/commit/12dcb0ef540629a281533f9dedc1b6b8e14cfb65.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21693","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21693.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21651","title":"net: hns3: don't auto enable misc vector","status":"backported","project":false,"upstream":[{"sha":"98b1e3b27734139c76295754b6c317aa4df6d32e","url":"https://git.kernel.org/stable/c/98b1e3b27734139c76295754b6c317aa4df6d32e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"98b1e3b27734139c76295754b6c317aa4df6d32e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21651","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21651.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21649","title":"net: hns3: fix kernel crash when 1588 is sent on HIP08 devices","status":"backported","project":false,"upstream":[{"sha":"9741e72b2286de8b38de9db685588ac421a95c87","url":"https://git.kernel.org/stable/c/9741e72b2286de8b38de9db685588ac421a95c87"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9741e72b2286de8b38de9db685588ac421a95c87","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21649","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21649.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2025-21634","title":"cgroup/cpuset: remove kernfs active break","status":"backported","project":false,"upstream":[{"sha":"3cb97a927fffe443e1e7e8eddbfebfdb062e86ed","url":"https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3cb97a927fffe443e1e7e8eddbfebfdb062e86ed","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-21634","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21634.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58241","title":"Bluetooth: hci_core: Disable works on hci_unregister_dev","status":"backported","project":false,"upstream":[{"sha":"989fa5171f005ecf63440057218d8aeb1795287d","url":"https://git.kernel.org/stable/c/989fa5171f005ecf63440057218d8aeb1795287d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"989fa5171f005ecf63440057218d8aeb1795287d","lines":64,"reason":"","source":"https://github.com/torvalds/linux/commit/989fa5171f005ecf63440057218d8aeb1795287d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58241","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58241.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58237","title":"bpf: consider that tail calls invalidate packet pointers","status":"backported","project":false,"upstream":[{"sha":"1a4607ffba35bf2a630aab299e34dd3f6e658d70","url":"https://git.kernel.org/stable/c/1a4607ffba35bf2a630aab299e34dd3f6e658d70"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a4607ffba35bf2a630aab299e34dd3f6e658d70","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/1a4607ffba35bf2a630aab299e34dd3f6e658d70.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58237","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58237.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58100","title":"bpf: check changes_pkt_data property for extension programs","status":"backported","project":false,"upstream":[{"sha":"81f6d0530ba031b5f038a091619bf2ff29568852","url":"https://git.kernel.org/stable/c/81f6d0530ba031b5f038a091619bf2ff29568852"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"81f6d0530ba031b5f038a091619bf2ff29568852","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/81f6d0530ba031b5f038a091619bf2ff29568852.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58100","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58100.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58098","title":"bpf: track changes_pkt_data property for global functions","status":"backported","project":false,"upstream":[{"sha":"51081a3f25c742da5a659d7fc6fd77ebfdd555be","url":"https://git.kernel.org/stable/c/51081a3f25c742da5a659d7fc6fd77ebfdd555be"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"51081a3f25c742da5a659d7fc6fd77ebfdd555be","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/51081a3f25c742da5a659d7fc6fd77ebfdd555be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58098","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58098.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58097","title":"wifi: ath11k: fix RCU stall while reaping monitor destination ring","status":"backported","project":false,"upstream":[{"sha":"16c6c35c03ea73054a1f6d3302a4ce4a331b427d","url":"https://git.kernel.org/stable/c/16c6c35c03ea73054a1f6d3302a4ce4a331b427d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"16c6c35c03ea73054a1f6d3302a4ce4a331b427d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58097","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58097.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58095","title":"jfs: add check read-only before txBeginAnon() call","status":"backported","project":false,"upstream":[{"sha":"0176e69743ecc02961f2ae1ea42439cd2bf9ed58","url":"https://git.kernel.org/stable/c/0176e69743ecc02961f2ae1ea42439cd2bf9ed58"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0176e69743ecc02961f2ae1ea42439cd2bf9ed58","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58095","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58095.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58094","title":"jfs: add check read-only before truncation in jfs_truncate_nolock()","status":"backported","project":false,"upstream":[{"sha":"b5799dd77054c1ec49b0088b006c9908e256843b","url":"https://git.kernel.org/stable/c/b5799dd77054c1ec49b0088b006c9908e256843b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"b5799dd77054c1ec49b0088b006c9908e256843b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58094","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58094.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58089","title":"btrfs: fix double accounting race when btrfs_run_delalloc_range() failed","status":"backported","project":false,"upstream":[{"sha":"72dad8e377afa50435940adfb697e070d3556670","url":"https://git.kernel.org/stable/c/72dad8e377afa50435940adfb697e070d3556670"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"72dad8e377afa50435940adfb697e070d3556670","lines":109,"reason":"","source":"https://github.com/torvalds/linux/commit/72dad8e377afa50435940adfb697e070d3556670.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58053","title":"rxrpc: Fix handling of received connection abort","status":"backported","project":false,"upstream":[{"sha":"0e56ebde245e4799ce74d38419426f2a80d39950","url":"https://git.kernel.org/stable/c/0e56ebde245e4799ce74d38419426f2a80d39950"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0e56ebde245e4799ce74d38419426f2a80d39950","lines":73,"reason":"","source":"https://github.com/torvalds/linux/commit/0e56ebde245e4799ce74d38419426f2a80d39950.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58053","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58053.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58015","title":"wifi: ath12k: Fix for out-of bound access error","status":"backported","project":false,"upstream":[{"sha":"eb8c0534713865d190856f10bfc97cf0b88475b1","url":"https://git.kernel.org/stable/c/eb8c0534713865d190856f10bfc97cf0b88475b1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"eb8c0534713865d190856f10bfc97cf0b88475b1","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/eb8c0534713865d190856f10bfc97cf0b88475b1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-58012","title":"ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params","status":"backported","project":false,"upstream":[{"sha":"569922b82ca660f8b24e705f6cf674e6b1f99cc7","url":"https://git.kernel.org/stable/c/569922b82ca660f8b24e705f6cf674e6b1f99cc7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"569922b82ca660f8b24e705f6cf674e6b1f99cc7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-58012","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-58012.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57984","title":"i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition","status":"backported","project":false,"upstream":[{"sha":"b75439c945b94dd8a2b645355bdb56f948052601","url":"https://git.kernel.org/stable/c/b75439c945b94dd8a2b645355bdb56f948052601"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b75439c945b94dd8a2b645355bdb56f948052601","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/b75439c945b94dd8a2b645355bdb56f948052601.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57984","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57984.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57975","title":"btrfs: do proper folio cleanup when run_delalloc_nocow() failed","status":"backported","project":false,"upstream":[{"sha":"c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","url":"https://git.kernel.org/stable/c/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","lines":150,"reason":"","source":"https://github.com/torvalds/linux/commit/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57872","title":"scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()","status":"backported","project":false,"upstream":[{"sha":"897df60c16d54ad515a3d0887edab5c63da06d1f","url":"https://git.kernel.org/stable/c/897df60c16d54ad515a3d0887edab5c63da06d1f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"897df60c16d54ad515a3d0887edab5c63da06d1f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/897df60c16d54ad515a3d0887edab5c63da06d1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57857","title":"RDMA/siw: Remove direct link to net_device","status":"backported","project":false,"upstream":[{"sha":"16b87037b48889d21854c8e97aec8a1baf2642b3","url":"https://git.kernel.org/stable/c/16b87037b48889d21854c8e97aec8a1baf2642b3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"16b87037b48889d21854c8e97aec8a1baf2642b3","lines":204,"reason":"","source":"https://github.com/torvalds/linux/commit/16b87037b48889d21854c8e97aec8a1baf2642b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57857","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57857.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57809","title":"PCI: imx6: Fix suspend/resume support on i.MX6QDL","status":"backported","project":false,"upstream":[{"sha":"0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3","url":"https://git.kernel.org/stable/c/0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3","lines":82,"reason":"","source":"https://github.com/torvalds/linux/commit/0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57809","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57809.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-57795","title":"RDMA/rxe: Remove the direct link to net_device","status":"backported","project":false,"upstream":[{"sha":"2ac5415022d16d63d912a39a06f32f1f51140261","url":"https://git.kernel.org/stable/c/2ac5415022d16d63d912a39a06f32f1f51140261"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"2ac5415022d16d63d912a39a06f32f1f51140261","lines":260,"reason":"","source":"https://github.com/torvalds/linux/commit/2ac5415022d16d63d912a39a06f32f1f51140261.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-57795","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-57795.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56775","title":"drm/amd/display: Fix handling of plane refcount","status":"backported","project":false,"upstream":[{"sha":"27227a234c1487cb7a684615f0749c455218833a","url":"https://git.kernel.org/stable/c/27227a234c1487cb7a684615f0749c455218833a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"27227a234c1487cb7a684615f0749c455218833a","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/27227a234c1487cb7a684615f0749c455218833a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56591","title":"Bluetooth: hci_conn: Use disable_delayed_work_sync","status":"backported","project":false,"upstream":[{"sha":"2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df","url":"https://git.kernel.org/stable/c/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56591","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56591.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56544","title":"udmabuf: change folios array from kmalloc to kvmalloc","status":"backported","project":false,"upstream":[{"sha":"1c0844c6184e658064e14c4335885785ad3bf84b","url":"https://git.kernel.org/stable/c/1c0844c6184e658064e14c4335885785ad3bf84b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1c0844c6184e658064e14c4335885785ad3bf84b","lines":78,"reason":"","source":"https://github.com/torvalds/linux/commit/1c0844c6184e658064e14c4335885785ad3bf84b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56544","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56544.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-56538","title":"drm: zynqmp_kms: Unplug DRM device before removal","status":"backported","project":false,"upstream":[{"sha":"2e07c88914fc5289c21820b1aa94f058feb38197","url":"https://git.kernel.org/stable/c/2e07c88914fc5289c21820b1aa94f058feb38197"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2e07c88914fc5289c21820b1aa94f058feb38197","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-56538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-56538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53687","title":"riscv: Fix IPIs usage in kfence_protect_page()","status":"backported","project":false,"upstream":[{"sha":"b3431a8bb336cece8adc452437befa7d4534b2fd","url":"https://git.kernel.org/stable/c/b3431a8bb336cece8adc452437befa7d4534b2fd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b3431a8bb336cece8adc452437befa7d4534b2fd","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/b3431a8bb336cece8adc452437befa7d4534b2fd.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53687","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53687.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53219","title":"virtiofs: use pages instead of pointer for kernel direct IO","status":"backported","project":false,"upstream":[{"sha":"41748675c0bf252b3c5f600a95830f0936d366c1","url":"https://git.kernel.org/stable/c/41748675c0bf252b3c5f600a95830f0936d366c1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"41748675c0bf252b3c5f600a95830f0936d366c1","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/41748675c0bf252b3c5f600a95830f0936d366c1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53219","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53219.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53218","title":"f2fs: fix race in concurrent f2fs_stop_gc_thread","status":"backported","project":false,"upstream":[{"sha":"7b0033dbc48340a1c1c3f12448ba17d6587ca092","url":"https://git.kernel.org/stable/c/7b0033dbc48340a1c1c3f12448ba17d6587ca092"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7b0033dbc48340a1c1c3f12448ba17d6587ca092","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/7b0033dbc48340a1c1c3f12448ba17d6587ca092.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53218","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53218.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53201","title":"drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe","status":"backported","project":false,"upstream":[{"sha":"6a057072ddd127255350357dd880903e8fa23f36","url":"https://git.kernel.org/stable/c/6a057072ddd127255350357dd880903e8fa23f36"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6a057072ddd127255350357dd880903e8fa23f36","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/6a057072ddd127255350357dd880903e8fa23f36.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53201","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53201.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53187","title":"io_uring: check for overflows in io_pin_pages","status":"backported","project":false,"upstream":[{"sha":"0c0a4eae26ac78379d0c1db053de168a8febc6c9","url":"https://git.kernel.org/stable/c/0c0a4eae26ac78379d0c1db053de168a8febc6c9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0c0a4eae26ac78379d0c1db053de168a8febc6c9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53187","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53187.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53176","title":"smb: During unmount, ensure all cached dir instances drop their dentry","status":"backported","project":false,"upstream":[{"sha":"3fa640d035e5ae526769615c35cb9ed4be6e3662","url":"https://git.kernel.org/stable/c/3fa640d035e5ae526769615c35cb9ed4be6e3662"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"3fa640d035e5ae526769615c35cb9ed4be6e3662","lines":357,"reason":"","source":"https://github.com/torvalds/linux/commit/3fa640d035e5ae526769615c35cb9ed4be6e3662.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53176","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53176.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53134","title":"pmdomain: imx93-blk-ctrl: correct remove path","status":"backported","project":false,"upstream":[{"sha":"f7c7c5aa556378a2c8da72c1f7f238b6648f95fb","url":"https://git.kernel.org/stable/c/f7c7c5aa556378a2c8da72c1f7f238b6648f95fb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"f7c7c5aa556378a2c8da72c1f7f238b6648f95fb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53134","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53134.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53114","title":"x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client","status":"backported","project":false,"upstream":[{"sha":"a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0","url":"https://git.kernel.org/stable/c/a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53114","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53114.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53089","title":"LoongArch: KVM: Mark hrtimer to expire in hard interrupt context","status":"backported","project":false,"upstream":[{"sha":"73adbd92f3223dc0c3506822b71c6b259d5d537b","url":"https://git.kernel.org/stable/c/73adbd92f3223dc0c3506822b71c6b259d5d537b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"73adbd92f3223dc0c3506822b71c6b259d5d537b","lines":22,"reason":"","source":"https://github.com/torvalds/linux/commit/73adbd92f3223dc0c3506822b71c6b259d5d537b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53089","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53089.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53085","title":"tpm: Lock TPM chip in tpm_pm_suspend() first","status":"backported","project":false,"upstream":[{"sha":"9265fed6db601ee2ec47577815387458ef4f047a","url":"https://git.kernel.org/stable/c/9265fed6db601ee2ec47577815387458ef4f047a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"9265fed6db601ee2ec47577815387458ef4f047a","lines":70,"reason":"","source":"https://github.com/torvalds/linux/commit/9265fed6db601ee2ec47577815387458ef4f047a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53079","title":"mm/thp: fix deferred split unqueue naming and locking","status":"backported","project":false,"upstream":[{"sha":"f8f931bba0f92052cf842b7e30917b1afcc77d5a","url":"https://git.kernel.org/stable/c/f8f931bba0f92052cf842b7e30917b1afcc77d5a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"f8f931bba0f92052cf842b7e30917b1afcc77d5a","lines":214,"reason":"","source":"https://github.com/torvalds/linux/commit/f8f931bba0f92052cf842b7e30917b1afcc77d5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53056","title":"drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()","status":"backported","project":false,"upstream":[{"sha":"4018651ba5c409034149f297d3dd3328b91561fd","url":"https://git.kernel.org/stable/c/4018651ba5c409034149f297d3dd3328b91561fd"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"4018651ba5c409034149f297d3dd3328b91561fd","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53056","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53056.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53051","title":"drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability","status":"backported","project":false,"upstream":[{"sha":"31b42af516afa1e184d1a9f9dd4096c54044269a","url":"https://git.kernel.org/stable/c/31b42af516afa1e184d1a9f9dd4096c54044269a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"31b42af516afa1e184d1a9f9dd4096c54044269a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53051","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53051.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-53050","title":"drm/i915/hdcp: Add encoder check in hdcp2_get_capability","status":"backported","project":false,"upstream":[{"sha":"d34f4f058edf1235c103ca9c921dc54820d14d40","url":"https://git.kernel.org/stable/c/d34f4f058edf1235c103ca9c921dc54820d14d40"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d34f4f058edf1235c103ca9c921dc54820d14d40","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-53050","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-53050.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50289","title":"media: av7110: fix a spectre vulnerability","status":"backported","project":false,"upstream":[{"sha":"458ea1c0be991573ec436aa0afa23baacfae101a","url":"https://git.kernel.org/stable/c/458ea1c0be991573ec436aa0afa23baacfae101a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"458ea1c0be991573ec436aa0afa23baacfae101a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50289","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50289.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50282","title":"drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()","status":"backported","project":false,"upstream":[{"sha":"4d75b9468021c73108b4439794d69e892b1d24e3","url":"https://git.kernel.org/stable/c/4d75b9468021c73108b4439794d69e892b1d24e3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4d75b9468021c73108b4439794d69e892b1d24e3","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/4d75b9468021c73108b4439794d69e892b1d24e3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50282","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50282.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50225","title":"btrfs: fix error propagation of split bios","status":"backported","project":false,"upstream":[{"sha":"d48e1dea3931de64c26717adc2b89743c7ab6594","url":"https://git.kernel.org/stable/c/d48e1dea3931de64c26717adc2b89743c7ab6594"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d48e1dea3931de64c26717adc2b89743c7ab6594","lines":69,"reason":"","source":"https://github.com/torvalds/linux/commit/d48e1dea3931de64c26717adc2b89743c7ab6594.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50225","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50225.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50217","title":"btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()","status":"backported","project":false,"upstream":[{"sha":"aec8e6bf839101784f3ef037dcdb9432c3f32343","url":"https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"aec8e6bf839101784f3ef037dcdb9432c3f32343","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/aec8e6bf839101784f3ef037dcdb9432c3f32343.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50217","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50217.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50211","title":"udf: refactor inode_bmap() to handle error","status":"backported","project":false,"upstream":[{"sha":"c226964ec786f3797ed389a16392ce4357697d24","url":"https://git.kernel.org/stable/c/c226964ec786f3797ed389a16392ce4357697d24"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c226964ec786f3797ed389a16392ce4357697d24","lines":173,"reason":"","source":"https://github.com/torvalds/linux/commit/c226964ec786f3797ed389a16392ce4357697d24.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50211","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50211.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50166","title":"fsl/fman: Fix refcount handling of fman-related devices","status":"backported","project":false,"upstream":[{"sha":"1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1","url":"https://git.kernel.org/stable/c/1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1","lines":151,"reason":"","source":"https://github.com/torvalds/linux/commit/1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50166","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50166.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50111","title":"LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context","status":"backported","project":false,"upstream":[{"sha":"69cc6fad5df4ce652d969be69acc60e269e5eea1","url":"https://git.kernel.org/stable/c/69cc6fad5df4ce652d969be69acc60e269e5eea1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"69cc6fad5df4ce652d969be69acc60e269e5eea1","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/69cc6fad5df4ce652d969be69acc60e269e5eea1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50111","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50111.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50102","title":"x86: fix user address masking non-canonical speculation issue","status":"backported","project":false,"upstream":[{"sha":"86e6b1547b3d013bc392adf775b89318441403c2","url":"https://git.kernel.org/stable/c/86e6b1547b3d013bc392adf775b89318441403c2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"86e6b1547b3d013bc392adf775b89318441403c2","lines":116,"reason":"","source":"https://github.com/torvalds/linux/commit/86e6b1547b3d013bc392adf775b89318441403c2.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50102","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50102.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50057","title":"usb: typec: tipd: Free IRQ only if it was requested before","status":"backported","project":false,"upstream":[{"sha":"db63d9868f7f310de44ba7bea584e2454f8b4ed0","url":"https://git.kernel.org/stable/c/db63d9868f7f310de44ba7bea584e2454f8b4ed0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"db63d9868f7f310de44ba7bea584e2454f8b4ed0","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/db63d9868f7f310de44ba7bea584e2454f8b4ed0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50057","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50057.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50043","title":"nfsd: fix possible badness in FREE_STATEID","status":"backported","project":false,"upstream":[{"sha":"c88c150a467fcb670a1608e2272beeee3e86df6e","url":"https://git.kernel.org/stable/c/c88c150a467fcb670a1608e2272beeee3e86df6e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c88c150a467fcb670a1608e2272beeee3e86df6e","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/c88c150a467fcb670a1608e2272beeee3e86df6e.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50043","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50043.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50028","title":"thermal: core: Reference count the zone in thermal_zone_get_by_id()","status":"backported","project":false,"upstream":[{"sha":"a42a5839f400e929c489bb1b58f54596c4535167","url":"https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a42a5839f400e929c489bb1b58f54596c4535167","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/a42a5839f400e929c489bb1b58f54596c4535167.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50028","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50028.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-50017","title":"x86/mm/ident_map: Use gbpages only where full GB page should be mapped.","status":"backported","project":false,"upstream":[{"sha":"cc31744a294584a36bf764a0ffa3255a8e69f036","url":"https://git.kernel.org/stable/c/cc31744a294584a36bf764a0ffa3255a8e69f036"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"cc31744a294584a36bf764a0ffa3255a8e69f036","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-50017","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50017.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49988","title":"ksmbd: add refcnt to ksmbd_conn struct","status":"backported","project":false,"upstream":[{"sha":"ee426bfb9d09b29987369b897fe9b6485ac2be27","url":"https://git.kernel.org/stable/c/ee426bfb9d09b29987369b897fe9b6485ac2be27"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"ee426bfb9d09b29987369b897fe9b6485ac2be27","lines":186,"reason":"","source":"https://github.com/torvalds/linux/commit/ee426bfb9d09b29987369b897fe9b6485ac2be27.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49988","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49988.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49970","title":"drm/amd/display: Implement bounds check for stream encoder creation in DCN401","status":"backported","project":false,"upstream":[{"sha":"bdf606810210e8e07a0cdf1af3c467291363b295","url":"https://git.kernel.org/stable/c/bdf606810210e8e07a0cdf1af3c467291363b295"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"bdf606810210e8e07a0cdf1af3c467291363b295","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49970","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49970.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49923","title":"drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags","status":"backported","project":false,"upstream":[{"sha":"5559598742fb4538e4c51c48ef70563c49c2af23","url":"https://git.kernel.org/stable/c/5559598742fb4538e4c51c48ef70563c49c2af23"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5559598742fb4538e4c51c48ef70563c49c2af23","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49923","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49923.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49922","title":"drm/amd/display: Check null pointers before using them","status":"backported","project":false,"upstream":[{"sha":"1ff12bcd7deaeed25efb5120433c6a45dd5504a8","url":"https://git.kernel.org/stable/c/1ff12bcd7deaeed25efb5120433c6a45dd5504a8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1ff12bcd7deaeed25efb5120433c6a45dd5504a8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49922","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49922.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49919","title":"drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer","status":"backported","project":false,"upstream":[{"sha":"f22f4754aaa47d8c59f166ba3042182859e5dff7","url":"https://git.kernel.org/stable/c/f22f4754aaa47d8c59f166ba3042182859e5dff7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"f22f4754aaa47d8c59f166ba3042182859e5dff7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49919","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49919.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49918","title":"drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer","status":"backported","project":false,"upstream":[{"sha":"ac2140449184a26eac99585b7f69814bd3ba8f2d","url":"https://git.kernel.org/stable/c/ac2140449184a26eac99585b7f69814bd3ba8f2d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ac2140449184a26eac99585b7f69814bd3ba8f2d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49916","title":"drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw","status":"backported","project":false,"upstream":[{"sha":"4b6377f0e96085cbec96eb7f0b282430ccdd3d75","url":"https://git.kernel.org/stable/c/4b6377f0e96085cbec96eb7f0b282430ccdd3d75"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4b6377f0e96085cbec96eb7f0b282430ccdd3d75","lines":26,"reason":"","source":"https://github.com/torvalds/linux/commit/4b6377f0e96085cbec96eb7f0b282430ccdd3d75.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49916","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49916.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49914","title":"drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe","status":"backported","project":false,"upstream":[{"sha":"8e4ed3cf1642df0c4456443d865cff61a9598aa8","url":"https://git.kernel.org/stable/c/8e4ed3cf1642df0c4456443d865cff61a9598aa8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"8e4ed3cf1642df0c4456443d865cff61a9598aa8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49910","title":"drm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func","status":"backported","project":false,"upstream":[{"sha":"dd340acd42c24a3f28dd22fae6bf38662334264c","url":"https://git.kernel.org/stable/c/dd340acd42c24a3f28dd22fae6bf38662334264c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"dd340acd42c24a3f28dd22fae6bf38662334264c","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/dd340acd42c24a3f28dd22fae6bf38662334264c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49910","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49910.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49908","title":"drm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2)","status":"backported","project":false,"upstream":[{"sha":"0fe20258b4989b9112b5e9470df33a0939403fd4","url":"https://git.kernel.org/stable/c/0fe20258b4989b9112b5e9470df33a0939403fd4"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0fe20258b4989b9112b5e9470df33a0939403fd4","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/0fe20258b4989b9112b5e9470df33a0939403fd4.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49908","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49908.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49906","title":"drm/amd/display: Check null pointer before try to access it","status":"backported","project":false,"upstream":[{"sha":"1b686053c06ffb9f4524b288110cf2a831ff7a25","url":"https://git.kernel.org/stable/c/1b686053c06ffb9f4524b288110cf2a831ff7a25"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1b686053c06ffb9f4524b288110cf2a831ff7a25","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49906","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49906.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-49893","title":"drm/amd/display: Check stream_status before it is used","status":"backported","project":false,"upstream":[{"sha":"58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9","url":"https://git.kernel.org/stable/c/58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-49893","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-49893.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47752","title":"media: mediatek: vcodec: Fix H264 stateless decoder smatch warning","status":"backported","project":false,"upstream":[{"sha":"7878d3a385efab560dce793b595447867fb163f2","url":"https://git.kernel.org/stable/c/7878d3a385efab560dce793b595447867fb163f2"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7878d3a385efab560dce793b595447867fb163f2","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47752","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47752.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47703","title":"bpf, lsm: Add check for BPF LSM return value","status":"backported","project":false,"upstream":[{"sha":"5d99e198be279045e6ecefe220f5c52f8ce9bfd5","url":"https://git.kernel.org/stable/c/5d99e198be279045e6ecefe220f5c52f8ce9bfd5"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"5d99e198be279045e6ecefe220f5c52f8ce9bfd5","lines":200,"reason":"","source":"https://github.com/torvalds/linux/commit/5d99e198be279045e6ecefe220f5c52f8ce9bfd5.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47703","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47703.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47702","title":"bpf: Fail verification for sign-extension of packet data/data_end/data_meta","status":"backported","project":false,"upstream":[{"sha":"92de36080c93296ef9005690705cba260b9bd68a","url":"https://git.kernel.org/stable/c/92de36080c93296ef9005690705cba260b9bd68a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"92de36080c93296ef9005690705cba260b9bd68a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47702","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47702.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47691","title":"f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()","status":"backported","project":false,"upstream":[{"sha":"c7f114d864ac91515bb07ac271e9824a20f5ed95","url":"https://git.kernel.org/stable/c/c7f114d864ac91515bb07ac271e9824a20f5ed95"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c7f114d864ac91515bb07ac271e9824a20f5ed95","lines":51,"reason":"","source":"https://github.com/torvalds/linux/commit/c7f114d864ac91515bb07ac271e9824a20f5ed95.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47691","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47691.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47683","title":"drm/amd/display: Skip Recompute DSC Params if no Stream on Link","status":"backported","project":false,"upstream":[{"sha":"8151a6c13111b465dbabe07c19f572f7cbd16fef","url":"https://git.kernel.org/stable/c/8151a6c13111b465dbabe07c19f572f7cbd16fef"},{"sha":"50e376f1fe3bf571d0645ddf48ad37eb58323919","url":"https://git.kernel.org/stable/c/50e376f1fe3bf571d0645ddf48ad37eb58323919"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"8151a6c13111b465dbabe07c19f572f7cbd16fef","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/8151a6c13111b465dbabe07c19f572f7cbd16fef.patch"},{"sha":"50e376f1fe3bf571d0645ddf48ad37eb58323919","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/50e376f1fe3bf571d0645ddf48ad37eb58323919.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47683","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47683.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47662","title":"drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection","status":"backported","project":false,"upstream":[{"sha":"466423c6dd8af23ebb3a69d43434d01aed0db356","url":"https://git.kernel.org/stable/c/466423c6dd8af23ebb3a69d43434d01aed0db356"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"466423c6dd8af23ebb3a69d43434d01aed0db356","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/466423c6dd8af23ebb3a69d43434d01aed0db356.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47662","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47662.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-47661","title":"drm/amd/display: Avoid overflow from uint32_t to uint8_t","status":"backported","project":false,"upstream":[{"sha":"d6b54900c564e35989cf6813e4071504fa0a90e0","url":"https://git.kernel.org/stable/c/d6b54900c564e35989cf6813e4071504fa0a90e0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d6b54900c564e35989cf6813e4071504fa0a90e0","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-47661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-47661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46870","title":"drm/amd/display: Disable DMCUB timeout for DCN35","status":"backported","project":false,"upstream":[{"sha":"7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f","url":"https://git.kernel.org/stable/c/7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/7c70e60fbf4bff1123f0e8d5cb1ae71df6164d7f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46870","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46870.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46842","title":"scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info","status":"backported","project":false,"upstream":[{"sha":"ede596b1434b57c0b3fd5c02b326efe5c54f6e48","url":"https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ede596b1434b57c0b3fd5c02b326efe5c54f6e48","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46842","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46842.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46834","title":"ethtool: fail closed if we can't get max channel used in indirection tables","status":"backported","project":false,"upstream":[{"sha":"2899d58462ba868287d6ff3acad3675e7adf934f","url":"https://git.kernel.org/stable/c/2899d58462ba868287d6ff3acad3675e7adf934f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2899d58462ba868287d6ff3acad3675e7adf934f","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46834","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46834.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46813","title":"drm/amd/display: Check link_index before accessing dc->links[]","status":"backported","project":false,"upstream":[{"sha":"8aa2864044b9d13e95fe224f32e808afbf79ecdf","url":"https://git.kernel.org/stable/c/8aa2864044b9d13e95fe224f32e808afbf79ecdf"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"8aa2864044b9d13e95fe224f32e808afbf79ecdf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46813","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46813.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46808","title":"drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range","status":"backported","project":false,"upstream":[{"sha":"5524fa301ba649f8cf00848f91468e0ba7e4f24c","url":"https://git.kernel.org/stable/c/5524fa301ba649f8cf00848f91468e0ba7e4f24c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5524fa301ba649f8cf00848f91468e0ba7e4f24c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46806","title":"drm/amdgpu: Fix the warning division or modulo by zero","status":"backported","project":false,"upstream":[{"sha":"1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c","url":"https://git.kernel.org/stable/c/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c","lines":12,"reason":"","source":"https://github.com/torvalds/linux/commit/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46806","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46806.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46776","title":"drm/amd/display: Run DC_LOG_DC after checking link->link_enc","status":"backported","project":false,"upstream":[{"sha":"3a82f62b0d9d7687eac47603bb6cd14a50fa718b","url":"https://git.kernel.org/stable/c/3a82f62b0d9d7687eac47603bb6cd14a50fa718b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3a82f62b0d9d7687eac47603bb6cd14a50fa718b","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/3a82f62b0d9d7687eac47603bb6cd14a50fa718b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46776","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46776.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46775","title":"drm/amd/display: Validate function returns","status":"backported","project":false,"upstream":[{"sha":"673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c","url":"https://git.kernel.org/stable/c/673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46775","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46775.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46760","title":"wifi: rtw88: usb: schedule rx work after everything is set up","status":"backported","project":false,"upstream":[{"sha":"adc539784c98a7cc602cbf557debfc2e7b9be8b3","url":"https://git.kernel.org/stable/c/adc539784c98a7cc602cbf557debfc2e7b9be8b3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"adc539784c98a7cc602cbf557debfc2e7b9be8b3","lines":36,"reason":"","source":"https://github.com/torvalds/linux/commit/adc539784c98a7cc602cbf557debfc2e7b9be8b3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46760","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46760.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46754","title":"bpf: Remove tst_run from lwt_seg6local_prog_ops.","status":"backported","project":false,"upstream":[{"sha":"c13fda93aca118b8e5cd202e339046728ee7dddb","url":"https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"c13fda93aca118b8e5cd202e339046728ee7dddb","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46754","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46754.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46730","title":"drm/amd/display: Ensure array index tg_inst won't be -1","status":"backported","project":false,"upstream":[{"sha":"687fe329f18ab0ab0496b20ed2cb003d4879d931","url":"https://git.kernel.org/stable/c/687fe329f18ab0ab0496b20ed2cb003d4879d931"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"687fe329f18ab0ab0496b20ed2cb003d4879d931","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46730","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46730.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46729","title":"drm/amd/display: Fix incorrect size calculation for loop","status":"backported","project":false,"upstream":[{"sha":"3941a3aa4b653b69876d894d08f3fff1cc965267","url":"https://git.kernel.org/stable/c/3941a3aa4b653b69876d894d08f3fff1cc965267"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3941a3aa4b653b69876d894d08f3fff1cc965267","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/3941a3aa4b653b69876d894d08f3fff1cc965267.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46729","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46729.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46728","title":"drm/amd/display: Check index for aux_rd_interval before using","status":"backported","project":false,"upstream":[{"sha":"9ba2ea6337b4f159aecb177555a6a81da92d302e","url":"https://git.kernel.org/stable/c/9ba2ea6337b4f159aecb177555a6a81da92d302e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9ba2ea6337b4f159aecb177555a6a81da92d302e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46728","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46728.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46727","title":"drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update","status":"backported","project":false,"upstream":[{"sha":"871cd9d881fa791d3f82885000713de07041c0ae","url":"https://git.kernel.org/stable/c/871cd9d881fa791d3f82885000713de07041c0ae"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"871cd9d881fa791d3f82885000713de07041c0ae","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/871cd9d881fa791d3f82885000713de07041c0ae.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46727","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46727.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46701","title":"libfs: fix infinite directory reads for offset dir","status":"backported","project":false,"upstream":[{"sha":"64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a","url":"https://git.kernel.org/stable/c/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46701","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46701.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46698","title":"video/aperture: optionally match the device in sysfb_disable()","status":"backported","project":false,"upstream":[{"sha":"b49420d6a1aeb399e5b107fc6eb8584d0860fbd7","url":"https://git.kernel.org/stable/c/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"b49420d6a1aeb399e5b107fc6eb8584d0860fbd7","lines":108,"reason":"","source":"https://github.com/torvalds/linux/commit/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46698","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46698.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46682","title":"nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open","status":"backported","project":false,"upstream":[{"sha":"a204501e1743d695ca2930ed25a2be9f8ced96d3","url":"https://git.kernel.org/stable/c/a204501e1743d695ca2930ed25a2be9f8ced96d3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"a204501e1743d695ca2930ed25a2be9f8ced96d3","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/a204501e1743d695ca2930ed25a2be9f8ced96d3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46682","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46682.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-46678","title":"bonding: change ipsec_lock from spin lock to mutex","status":"backported","project":false,"upstream":[{"sha":"2aeeef906d5a526dc60cf4af92eda69836c39b1f","url":"https://git.kernel.org/stable/c/2aeeef906d5a526dc60cf4af92eda69836c39b1f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"2aeeef906d5a526dc60cf4af92eda69836c39b1f","lines":199,"reason":"","source":"https://github.com/torvalds/linux/commit/2aeeef906d5a526dc60cf4af92eda69836c39b1f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-46678","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-46678.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-45015","title":"drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()","status":"backported","project":false,"upstream":[{"sha":"aedf02e46eb549dac8db4821a6b9f0c6bf6e3990","url":"https://git.kernel.org/stable/c/aedf02e46eb549dac8db4821a6b9f0c6bf6e3990"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"aedf02e46eb549dac8db4821a6b9f0c6bf6e3990","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/aedf02e46eb549dac8db4821a6b9f0c6bf6e3990.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-45015","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-45015.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43901","title":"drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401","status":"backported","project":false,"upstream":[{"sha":"5af757124792817f8eb1bd0c80ad60fab519586b","url":"https://git.kernel.org/stable/c/5af757124792817f8eb1bd0c80ad60fab519586b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5af757124792817f8eb1bd0c80ad60fab519586b","lines":71,"reason":"","source":"https://github.com/torvalds/linux/commit/5af757124792817f8eb1bd0c80ad60fab519586b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43901","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43901.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43899","title":"drm/amd/display: Fix null pointer deref in dcn20_resource.c","status":"backported","project":false,"upstream":[{"sha":"ecbf60782662f0a388493685b85a645a0ba1613c","url":"https://git.kernel.org/stable/c/ecbf60782662f0a388493685b85a645a0ba1613c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ecbf60782662f0a388493685b85a645a0ba1613c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43899","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43899.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43888","title":"mm: list_lru: fix UAF for memory cgroup","status":"backported","project":false,"upstream":[{"sha":"5161b48712dcd08ec427c450399d4d1483e21dea","url":"https://git.kernel.org/stable/c/5161b48712dcd08ec427c450399d4d1483e21dea"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"5161b48712dcd08ec427c450399d4d1483e21dea","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/5161b48712dcd08ec427c450399d4d1483e21dea.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43888","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43888.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43872","title":"RDMA/hns: Fix soft lockup under heavy CEQE load","status":"backported","project":false,"upstream":[{"sha":"2fdf34038369c0a27811e7b4680662a14ada1d6b","url":"https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"2fdf34038369c0a27811e7b4680662a14ada1d6b","lines":153,"reason":"","source":"https://github.com/torvalds/linux/commit/2fdf34038369c0a27811e7b4680662a14ada1d6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43872","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43872.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43824","title":"PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()","status":"backported","project":false,"upstream":[{"sha":"5a5095a8bd1bd349cce1c879e5e44407a34dda8a","url":"https://git.kernel.org/stable/c/5a5095a8bd1bd349cce1c879e5e44407a34dda8a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5a5095a8bd1bd349cce1c879e5e44407a34dda8a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43824","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43824.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-43819","title":"kvm: s390: Reject memory region operations for ucontrol VMs","status":"backported","project":false,"upstream":[{"sha":"7816e58967d0e6cadce05c8540b47ed027dc2499","url":"https://git.kernel.org/stable/c/7816e58967d0e6cadce05c8540b47ed027dc2499"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7816e58967d0e6cadce05c8540b47ed027dc2499","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-43819","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-43819.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42317","title":"mm/huge_memory: avoid PMD-size page cache if needed","status":"backported","project":false,"upstream":[{"sha":"d659b715e94ac039803d7601505d3473393fc0be","url":"https://git.kernel.org/stable/c/d659b715e94ac039803d7601505d3473393fc0be"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d659b715e94ac039803d7601505d3473393fc0be","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/d659b715e94ac039803d7601505d3473393fc0be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42317","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42317.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42239","title":"bpf: Fail bpf_timer_cancel when callback is being cancelled","status":"backported","project":false,"upstream":[{"sha":"d4523831f07a267a943f0dde844bf8ead7495f13","url":"https://git.kernel.org/stable/c/d4523831f07a267a943f0dde844bf8ead7495f13"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d4523831f07a267a943f0dde844bf8ead7495f13","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42239","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42239.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42162","title":"gve: Account for stopped queues when reading NIC stats","status":"backported","project":false,"upstream":[{"sha":"af9bcf910b1f86244f39e15e701b2dc564b469a6","url":"https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"af9bcf910b1f86244f39e15e701b2dc564b469a6","lines":107,"reason":"","source":"https://github.com/torvalds/linux/commit/af9bcf910b1f86244f39e15e701b2dc564b469a6.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42162","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42162.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42158","title":"s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings","status":"backported","project":false,"upstream":[{"sha":"22e6824622e8a8889df0f8fc4ed5aea0e702a694","url":"https://git.kernel.org/stable/c/22e6824622e8a8889df0f8fc4ed5aea0e702a694"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"22e6824622e8a8889df0f8fc4ed5aea0e702a694","lines":27,"reason":"","source":"https://github.com/torvalds/linux/commit/22e6824622e8a8889df0f8fc4ed5aea0e702a694.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42158","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42158.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42123","title":"drm/amdgpu: fix double free err_addr pointer warnings","status":"backported","project":false,"upstream":[{"sha":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","url":"https://git.kernel.org/stable/c/506c245f3f1cd989cb89811a7f06e04ff8813a0d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42123","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42123.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-42118","title":"drm/amd/display: Do not return negative stream id for array","status":"backported","project":false,"upstream":[{"sha":"3ac31c9a707dd1c7c890b95333182f955e9dcb57","url":"https://git.kernel.org/stable/c/3ac31c9a707dd1c7c890b95333182f955e9dcb57"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3ac31c9a707dd1c7c890b95333182f955e9dcb57","lines":13,"reason":"","source":"https://github.com/torvalds/linux/commit/3ac31c9a707dd1c7c890b95333182f955e9dcb57.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-42118","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-42118.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41932","title":"sched: fix warning in sched_setaffinity","status":"backported","project":false,"upstream":[{"sha":"70ee7947a29029736a1a06c73a48ff37674a851b","url":"https://git.kernel.org/stable/c/70ee7947a29029736a1a06c73a48ff37674a851b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"70ee7947a29029736a1a06c73a48ff37674a851b","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/70ee7947a29029736a1a06c73a48ff37674a851b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41932","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41932.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41085","title":"cxl/mem: Fix no cxl_nvd during pmem region auto-assembling","status":"backported","project":false,"upstream":[{"sha":"84ec985944ef34a34a1605b93ce401aa8737af96","url":"https://git.kernel.org/stable/c/84ec985944ef34a34a1605b93ce401aa8737af96"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"84ec985944ef34a34a1605b93ce401aa8737af96","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41085","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41085.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41082","title":"nvme-fabrics: use reserved tag for reg read/write command","status":"backported","project":false,"upstream":[{"sha":"7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa","url":"https://git.kernel.org/stable/c/7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41082","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41082.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41045","title":"bpf: Defer work in bpf_timer_cancel_and_free","status":"backported","project":false,"upstream":[{"sha":"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69","url":"https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41045","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41045.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-41023","title":"sched/deadline: Fix task_struct reference leak","status":"backported","project":false,"upstream":[{"sha":"b58652db66c910c2245f5bee7deca41c12d707b9","url":"https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"b58652db66c910c2245f5bee7deca41c12d707b9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-41023","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-41023.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40999","title":"net: ena: Add validation for completion descriptors consistency","status":"backported","project":false,"upstream":[{"sha":"b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7","url":"https://git.kernel.org/stable/c/b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40979","title":"wifi: ath12k: fix kernel crash during resume","status":"backported","project":false,"upstream":[{"sha":"303c017821d88ebad887814114d4e5966d320b28","url":"https://git.kernel.org/stable/c/303c017821d88ebad887814114d4e5966d320b28"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"303c017821d88ebad887814114d4e5966d320b28","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40979","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40979.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40975","title":"platform/x86: x86-android-tablets: Unregister devices in reverse order","status":"backported","project":false,"upstream":[{"sha":"3de0f2627ef849735f155c1818247f58404dddfe","url":"https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3de0f2627ef849735f155c1818247f58404dddfe","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40975","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40975.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40969","title":"f2fs: don't set RO when shutting down f2fs","status":"backported","project":false,"upstream":[{"sha":"3bdb7f161697e2d5123b89fe1778ef17a44858e7","url":"https://git.kernel.org/stable/c/3bdb7f161697e2d5123b89fe1778ef17a44858e7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3bdb7f161697e2d5123b89fe1778ef17a44858e7","lines":17,"reason":"","source":"https://github.com/torvalds/linux/commit/3bdb7f161697e2d5123b89fe1778ef17a44858e7.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40969","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40969.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40965","title":"i2c: lpi2c: Avoid calling clk_get_rate during transfer","status":"backported","project":false,"upstream":[{"sha":"4268254a39484fc11ba991ae148bacbe75d9cc0a","url":"https://git.kernel.org/stable/c/4268254a39484fc11ba991ae148bacbe75d9cc0a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4268254a39484fc11ba991ae148bacbe75d9cc0a","lines":37,"reason":"","source":"https://github.com/torvalds/linux/commit/4268254a39484fc11ba991ae148bacbe75d9cc0a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40965","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40965.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-40918","title":"parisc: Try to fix random segmentation faults in package builds","status":"backported","project":false,"upstream":[{"sha":"72d95924ee35c8cd16ef52f912483ee938a34d49","url":"https://git.kernel.org/stable/c/72d95924ee35c8cd16ef52f912483ee938a34d49"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"72d95924ee35c8cd16ef52f912483ee938a34d49","lines":655,"reason":"","source":"https://github.com/torvalds/linux/commit/72d95924ee35c8cd16ef52f912483ee938a34d49.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-40918","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-40918.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-39508","title":"io_uring/io-wq: Use set_bit() and test_bit() at worker->flags","status":"backported","project":false,"upstream":[{"sha":"8a565304927fbd28c9f028c492b5c1714002cbab","url":"https://git.kernel.org/stable/c/8a565304927fbd28c9f028c492b5c1714002cbab"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"8a565304927fbd28c9f028c492b5c1714002cbab","lines":137,"reason":"","source":"https://github.com/torvalds/linux/commit/8a565304927fbd28c9f028c492b5c1714002cbab.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-39508","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-39508.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-39478","title":"crypto: starfive - Do not free stack buffer","status":"backported","project":false,"upstream":[{"sha":"d7f01649f4eaf1878472d3d3f480ae1e50d98f6c","url":"https://git.kernel.org/stable/c/d7f01649f4eaf1878472d3d3f480ae1e50d98f6c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"d7f01649f4eaf1878472d3d3f480ae1e50d98f6c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-39478","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-39478.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-38608","title":"net/mlx5e: Fix netif state handling","status":"backported","project":false,"upstream":[{"sha":"3d5918477f94e4c2f064567875c475468e264644","url":"https://git.kernel.org/stable/c/3d5918477f94e4c2f064567875c475468e264644"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3d5918477f94e4c2f064567875c475468e264644","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-38608","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-38608.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-38595","title":"net/mlx5: Fix peer devlink set for SF representor devlink port","status":"backported","project":false,"upstream":[{"sha":"3c453e8cc672de1f9c662948dba43176bc68d7f0","url":"https://git.kernel.org/stable/c/3c453e8cc672de1f9c662948dba43176bc68d7f0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"3c453e8cc672de1f9c662948dba43176bc68d7f0","lines":72,"reason":"","source":"https://github.com/torvalds/linux/commit/3c453e8cc672de1f9c662948dba43176bc68d7f0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-38595","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-38595.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36951","title":"drm/amdkfd: range check cp bad op exception interrupts","status":"backported","project":false,"upstream":[{"sha":"0cac183b98d8a8c692c98e8dba37df15a9e9210d","url":"https://git.kernel.org/stable/c/0cac183b98d8a8c692c98e8dba37df15a9e9210d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0cac183b98d8a8c692c98e8dba37df15a9e9210d","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/0cac183b98d8a8c692c98e8dba37df15a9e9210d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36951","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36951.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36949","title":"amd/amdkfd: sync all devices to wait all processes being evicted","status":"backported","project":false,"upstream":[{"sha":"d06af584be5a769d124b7302b32a033e9559761d","url":"https://git.kernel.org/stable/c/d06af584be5a769d124b7302b32a033e9559761d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"d06af584be5a769d124b7302b32a033e9559761d","lines":44,"reason":"","source":"https://github.com/torvalds/linux/commit/d06af584be5a769d124b7302b32a033e9559761d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36949","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36949.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-36024","title":"drm/amd/display: Disable idle reallow as part of command/gpint execution","status":"backported","project":false,"upstream":[{"sha":"6226a5aa77370329e01ee8abe50a95e60618ce97","url":"https://git.kernel.org/stable/c/6226a5aa77370329e01ee8abe50a95e60618ce97"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6226a5aa77370329e01ee8abe50a95e60618ce97","lines":30,"reason":"","source":"https://github.com/torvalds/linux/commit/6226a5aa77370329e01ee8abe50a95e60618ce97.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-36024","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-36024.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35961","title":"net/mlx5: Register devlink first under devlink lock","status":"backported","project":false,"upstream":[{"sha":"c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8","url":"https://git.kernel.org/stable/c/c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8","lines":106,"reason":"","source":"https://github.com/torvalds/linux/commit/c6e77aa9dd82bc18a89bf49418f8f7e961cfccc8.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35961","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35961.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35942","title":"pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain","status":"backported","project":false,"upstream":[{"sha":"697624ee8ad557ab5417f985d2c804241a7ad30d","url":"https://git.kernel.org/stable/c/697624ee8ad557ab5417f985d2c804241a7ad30d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"697624ee8ad557ab5417f985d2c804241a7ad30d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35942","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35942.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35931","title":"drm/amdgpu: Skip do PCI error slot reset during RAS recovery","status":"backported","project":false,"upstream":[{"sha":"601429cca96b4af3be44172c3b64e4228515dbe1","url":"https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"601429cca96b4af3be44172c3b64e4228515dbe1","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/601429cca96b4af3be44172c3b64e4228515dbe1.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35931","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35931.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35887","title":"ax25: fix use-after-free bugs caused by ax25_ds_del_timer","status":"backported","project":false,"upstream":[{"sha":"fd819ad3ecf6f3c232a06b27423ce9ed8c20da89","url":"https://git.kernel.org/stable/c/fd819ad3ecf6f3c232a06b27423ce9ed8c20da89"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"fd819ad3ecf6f3c232a06b27423ce9ed8c20da89","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35887","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35887.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35843","title":"iommu/vt-d: Use device rbtree in iopf reporting path","status":"backported","project":false,"upstream":[{"sha":"def054b01a867822254e1dda13d587f5c7a99e2a","url":"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"def054b01a867822254e1dda13d587f5c7a99e2a","lines":65,"reason":"","source":"https://github.com/torvalds/linux/commit/def054b01a867822254e1dda13d587f5c7a99e2a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35843","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35843.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35808","title":"md/dm-raid: don't call md_reap_sync_thread() directly","status":"backported","project":false,"upstream":[{"sha":"cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","url":"https://git.kernel.org/stable/c/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"cd32b27a66db8776d8b8e82ec7d7dde97a8693b0","lines":41,"reason":"","source":"https://github.com/torvalds/linux/commit/cd32b27a66db8776d8b8e82ec7d7dde97a8693b0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35808","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35808.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35799","title":"drm/amd/display: Prevent crash when disable stream","status":"backported","project":false,"upstream":[{"sha":"72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c","url":"https://git.kernel.org/stable/c/72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"72d72e8fddbcd6c98e1b02d32cf6f2b04e10bd1c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35799","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35799.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-35794","title":"dm-raid: really frozen sync_thread during suspend","status":"backported","project":false,"upstream":[{"sha":"16c4770c75b1223998adbeb7286f9a15c65fba73","url":"https://git.kernel.org/stable/c/16c4770c75b1223998adbeb7286f9a15c65fba73"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"16c4770c75b1223998adbeb7286f9a15c65fba73","lines":75,"reason":"","source":"https://github.com/torvalds/linux/commit/16c4770c75b1223998adbeb7286f9a15c65fba73.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-35794","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35794.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27079","title":"iommu/vt-d: Fix NULL domain on device release","status":"backported","project":false,"upstream":[{"sha":"81e921fd321614c2ad8ac333b041aae1da7a1c6d","url":"https://git.kernel.org/stable/c/81e921fd321614c2ad8ac333b041aae1da7a1c6d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"81e921fd321614c2ad8ac333b041aae1da7a1c6d","lines":121,"reason":"","source":"https://github.com/torvalds/linux/commit/81e921fd321614c2ad8ac333b041aae1da7a1c6d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27079","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27079.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27012","title":"netfilter: nf_tables: restore set elements when delete set fails","status":"backported","project":false,"upstream":[{"sha":"e79b47a8615d42c68aaeb68971593333667382ed","url":"https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"e79b47a8615d42c68aaeb68971593333667382ed","lines":201,"reason":"","source":"https://github.com/torvalds/linux/commit/e79b47a8615d42c68aaeb68971593333667382ed.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27012","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27012.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-27010","title":"net/sched: Fix mirred deadlock on device recursion","status":"backported","project":false,"upstream":[{"sha":"0f022d32c3eca477fbf79a205243a6123ed0fe11","url":"https://git.kernel.org/stable/c/0f022d32c3eca477fbf79a205243a6123ed0fe11"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"0f022d32c3eca477fbf79a205243a6123ed0fe11","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-27010","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-27010.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26962","title":"dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape","status":"backported","project":false,"upstream":[{"sha":"41425f96d7aa59bc865f60f5dda3d7697b555677","url":"https://git.kernel.org/stable/c/41425f96d7aa59bc865f60f5dda3d7697b555677"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"41425f96d7aa59bc865f60f5dda3d7697b555677","lines":217,"reason":"","source":"https://github.com/torvalds/linux/commit/41425f96d7aa59bc865f60f5dda3d7697b555677.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26962","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26962.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26948","title":"drm/amd/display: Add a dc_state NULL check in dc_state_release","status":"backported","project":false,"upstream":[{"sha":"334b56cea5d9df5989be6cf1a5898114fa70ad98","url":"https://git.kernel.org/stable/c/334b56cea5d9df5989be6cf1a5898114fa70ad98"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"334b56cea5d9df5989be6cf1a5898114fa70ad98","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26948","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26948.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26944","title":"btrfs: zoned: fix use-after-free in do_zone_finish()","status":"backported","project":false,"upstream":[{"sha":"1ec17ef59168a1a6f1105f5dc517f783839a5302","url":"https://git.kernel.org/stable/c/1ec17ef59168a1a6f1105f5dc517f783839a5302"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1ec17ef59168a1a6f1105f5dc517f783839a5302","lines":50,"reason":"","source":"https://github.com/torvalds/linux/commit/1ec17ef59168a1a6f1105f5dc517f783839a5302.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26944","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26944.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26914","title":"drm/amd/display: fix incorrect mpc_combine array size","status":"backported","project":false,"upstream":[{"sha":"39079fe8e660851abbafa90cd55cbf029210661f","url":"https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"39079fe8e660851abbafa90cd55cbf029210661f","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/39079fe8e660851abbafa90cd55cbf029210661f.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26914","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26914.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26913","title":"drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue","status":"backported","project":false,"upstream":[{"sha":"faf51b201bc42adf500945732abb6220c707d6f3","url":"https://git.kernel.org/stable/c/faf51b201bc42adf500945732abb6220c707d6f3"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"faf51b201bc42adf500945732abb6220c707d6f3","lines":61,"reason":"","source":"https://github.com/torvalds/linux/commit/faf51b201bc42adf500945732abb6220c707d6f3.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26913","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26913.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26836","title":"platform/x86: think-lmi: Fix password opcode ordering for workstations","status":"backported","project":false,"upstream":[{"sha":"6f7d0f5fd8e440c3446560100ac4ff9a55eec340","url":"https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"6f7d0f5fd8e440c3446560100ac4ff9a55eec340","lines":35,"reason":"","source":"https://github.com/torvalds/linux/commit/6f7d0f5fd8e440c3446560100ac4ff9a55eec340.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26836","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26836.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26768","title":"LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]","status":"backported","project":false,"upstream":[{"sha":"4551b30525cf3d2f026b92401ffe241eb04dfebe","url":"https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4551b30525cf3d2f026b92401ffe241eb04dfebe","lines":23,"reason":"","source":"https://github.com/torvalds/linux/commit/4551b30525cf3d2f026b92401ffe241eb04dfebe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26768","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26768.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26758","title":"md: Don't ignore suspended array in md_check_recovery()","status":"backported","project":false,"upstream":[{"sha":"1baae052cccd08daf9a9d64c3f959d8cdb689757","url":"https://git.kernel.org/stable/c/1baae052cccd08daf9a9d64c3f959d8cdb689757"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"1baae052cccd08daf9a9d64c3f959d8cdb689757","lines":9,"reason":"","source":"https://github.com/torvalds/linux/commit/1baae052cccd08daf9a9d64c3f959d8cdb689757.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26758","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26758.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26757","title":"md: Don't ignore read-only array in md_check_recovery()","status":"backported","project":false,"upstream":[{"sha":"55a48ad2db64737f7ffc0407634218cc6e4c513b","url":"https://git.kernel.org/stable/c/55a48ad2db64737f7ffc0407634218cc6e4c513b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"55a48ad2db64737f7ffc0407634218cc6e4c513b","lines":55,"reason":"","source":"https://github.com/torvalds/linux/commit/55a48ad2db64737f7ffc0407634218cc6e4c513b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26757","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26757.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26756","title":"md: Don't register sync_thread for reshape directly","status":"backported","project":false,"upstream":[{"sha":"ad39c08186f8a0f221337985036ba86731d6aafe","url":"https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ad39c08186f8a0f221337985036ba86731d6aafe","lines":89,"reason":"","source":"https://github.com/torvalds/linux/commit/ad39c08186f8a0f221337985036ba86731d6aafe.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26756","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26756.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26691","title":"KVM: arm64: Fix circular locking dependency","status":"backported","project":false,"upstream":[{"sha":"10c02aad111df02088d1a81792a709f6a7eca6cc","url":"https://git.kernel.org/stable/c/10c02aad111df02088d1a81792a709f6a7eca6cc"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"10c02aad111df02088d1a81792a709f6a7eca6cc","lines":53,"reason":"","source":"https://github.com/torvalds/linux/commit/10c02aad111df02088d1a81792a709f6a7eca6cc.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26691","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26691.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26672","title":"drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'","status":"backported","project":false,"upstream":[{"sha":"4f32504a2f85a7b40fe149436881381f48e9c0c0","url":"https://git.kernel.org/stable/c/4f32504a2f85a7b40fe149436881381f48e9c0c0"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"4f32504a2f85a7b40fe149436881381f48e9c0c0","lines":20,"reason":"","source":"https://github.com/torvalds/linux/commit/4f32504a2f85a7b40fe149436881381f48e9c0c0.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26672","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26672.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26662","title":"drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'","status":"backported","project":false,"upstream":[{"sha":"e96fddb32931d007db12b1fce9b5e8e4c080401b","url":"https://git.kernel.org/stable/c/e96fddb32931d007db12b1fce9b5e8e4c080401b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e96fddb32931d007db12b1fce9b5e8e4c080401b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26662","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26662.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2024-26661","title":"drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'","status":"backported","project":false,"upstream":[{"sha":"66951d98d9bf45ba25acf37fe0747253fafdf298","url":"https://git.kernel.org/stable/c/66951d98d9bf45ba25acf37fe0747253fafdf298"},{"sha":"17ba9cde11c2bfebbd70867b0a2ac4a22e573379","url":"https://git.kernel.org/stable/c/17ba9cde11c2bfebbd70867b0a2ac4a22e573379"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"66951d98d9bf45ba25acf37fe0747253fafdf298","lines":42,"reason":"","source":"https://github.com/torvalds/linux/commit/66951d98d9bf45ba25acf37fe0747253fafdf298.patch"},{"sha":"17ba9cde11c2bfebbd70867b0a2ac4a22e573379","lines":16,"reason":"","source":"https://github.com/torvalds/linux/commit/17ba9cde11c2bfebbd70867b0a2ac4a22e573379.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2024-26661","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26661.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54280","title":"cifs: fix potential race when tree connecting ipc","status":"backported","project":false,"upstream":[{"sha":"ee20d7c6100752eaf2409d783f4f1449c29ea33d","url":"https://git.kernel.org/stable/c/ee20d7c6100752eaf2409d783f4f1449c29ea33d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"ee20d7c6100752eaf2409d783f4f1449c29ea33d","lines":81,"reason":"","source":"https://github.com/torvalds/linux/commit/ee20d7c6100752eaf2409d783f4f1449c29ea33d.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54280","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54280.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54263","title":"drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP","status":"backported","project":false,"upstream":[{"sha":"ea293f823a8805735d9e00124df81a8f448ed1ae","url":"https://git.kernel.org/stable/c/ea293f823a8805735d9e00124df81a8f448ed1ae"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ea293f823a8805735d9e00124df81a8f448ed1ae","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54263","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54263.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54233","title":"ASoC: SOF: avoid a NULL dereference with unsupported widgets","status":"backported","project":false,"upstream":[{"sha":"e3720f92e0237921da537e47a0b24e27899203f8","url":"https://git.kernel.org/stable/c/e3720f92e0237921da537e47a0b24e27899203f8"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e3720f92e0237921da537e47a0b24e27899203f8","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54233","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54233.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54227","title":"blk-mq: fix tags leak when shrink nr_hw_queues","status":"backported","project":false,"upstream":[{"sha":"e1dd7bc93029024af5688253b0c05181d6e01f8e","url":"https://git.kernel.org/stable/c/e1dd7bc93029024af5688253b0c05181d6e01f8e"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e1dd7bc93029024af5688253b0c05181d6e01f8e","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54227","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54227.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54141","title":"wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018","status":"backported","project":false,"upstream":[{"sha":"ce282d8de71f07f0056ea319541141152c65f552","url":"https://git.kernel.org/stable/c/ce282d8de71f07f0056ea319541141152c65f552"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ce282d8de71f07f0056ea319541141152c65f552","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54141","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54141.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-54030","title":"io_uring/net: don't overflow multishot recv","status":"backported","project":false,"upstream":[{"sha":"b2e74db55dd93d6db22a813c9a775b5dbf87c560","url":"https://git.kernel.org/stable/c/b2e74db55dd93d6db22a813c9a775b5dbf87c560"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"b2e74db55dd93d6db22a813c9a775b5dbf87c560","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/b2e74db55dd93d6db22a813c9a775b5dbf87c560.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-54030","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-54030.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53999","title":"net/mlx5e: TC, Fix internal port memory leak","status":"backported","project":false,"upstream":[{"sha":"ac5da544a3c2047cbfd715acd9cec8380d7fe5c6","url":"https://git.kernel.org/stable/c/ac5da544a3c2047cbfd715acd9cec8380d7fe5c6"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"ac5da544a3c2047cbfd715acd9cec8380d7fe5c6","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53999","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53999.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53857","title":"bpf: bpf_sk_storage: Fix invalid wait context lockdep report","status":"backported","project":false,"upstream":[{"sha":"a96a44aba556c42b432929d37d60158aca21ad4c","url":"https://git.kernel.org/stable/c/a96a44aba556c42b432929d37d60158aca21ad4c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a96a44aba556c42b432929d37d60158aca21ad4c","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53857","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53857.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53851","title":"drm/msm/dp: Drop aux devices together with DP controller","status":"backported","project":false,"upstream":[{"sha":"a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d","url":"https://git.kernel.org/stable/c/a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53851","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53851.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53762","title":"Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync","status":"backported","project":false,"upstream":[{"sha":"94d9ba9f9888b748d4abd2aa1547af56ae85f772","url":"https://git.kernel.org/stable/c/94d9ba9f9888b748d4abd2aa1547af56ae85f772"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"94d9ba9f9888b748d4abd2aa1547af56ae85f772","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53762","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53762.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53627","title":"scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list","status":"backported","project":false,"upstream":[{"sha":"71fb36b5ff113a7674710b9d6063241eada84ff7","url":"https://git.kernel.org/stable/c/71fb36b5ff113a7674710b9d6063241eada84ff7"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"71fb36b5ff113a7674710b9d6063241eada84ff7","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53627","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53627.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53574","title":"wifi: rtw88: delete timer and free skb queue when unloading","status":"backported","project":false,"upstream":[{"sha":"634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216","url":"https://git.kernel.org/stable/c/634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53574","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53574.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53538","title":"btrfs: insert tree mod log move in push_node_left","status":"backported","project":false,"upstream":[{"sha":"5cead5422a0e3d13b0bcee986c0f5c4ebb94100b","url":"https://git.kernel.org/stable/c/5cead5422a0e3d13b0bcee986c0f5c4ebb94100b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"5cead5422a0e3d13b0bcee986c0f5c4ebb94100b","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53538","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53538.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53529","title":"wifi: rtw88: Fix memory leak in rtw88_usb","status":"backported","project":false,"upstream":[{"sha":"59a3a312009723e3e5082899655fdcc420e2b47a","url":"https://git.kernel.org/stable/c/59a3a312009723e3e5082899655fdcc420e2b47a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"59a3a312009723e3e5082899655fdcc420e2b47a","lines":7,"reason":"","source":"https://github.com/torvalds/linux/commit/59a3a312009723e3e5082899655fdcc420e2b47a.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53529","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53529.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53460","title":"wifi: rtw88: fix memory leak in rtw_usb_probe()","status":"backported","project":false,"upstream":[{"sha":"48181d285623198c33bb9698992502687b258efa","url":"https://git.kernel.org/stable/c/48181d285623198c33bb9698992502687b258efa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"48181d285623198c33bb9698992502687b258efa","lines":8,"reason":"","source":"https://github.com/torvalds/linux/commit/48181d285623198c33bb9698992502687b258efa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53460","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53460.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53429","title":"btrfs: don't check PageError in __extent_writepage","status":"backported","project":false,"upstream":[{"sha":"3e92499e3b004baffb479d61e191b41b604ece9a","url":"https://git.kernel.org/stable/c/3e92499e3b004baffb479d61e191b41b604ece9a"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"3e92499e3b004baffb479d61e191b41b604ece9a","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53429","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53429.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53367","title":"accel/habanalabs: fix mem leak in capture user mappings","status":"backported","project":false,"upstream":[{"sha":"314a7ffd7c196b27eedd50cb7553029e17789b55","url":"https://git.kernel.org/stable/c/314a7ffd7c196b27eedd50cb7553029e17789b55"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"314a7ffd7c196b27eedd50cb7553029e17789b55","lines":14,"reason":"","source":"https://github.com/torvalds/linux/commit/314a7ffd7c196b27eedd50cb7553029e17789b55.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53367","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53367.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53353","title":"accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()","status":"backported","project":false,"upstream":[{"sha":"2e8e9a895c4589f124a37fc84d123b5114406e94","url":"https://git.kernel.org/stable/c/2e8e9a895c4589f124a37fc84d123b5114406e94"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"2e8e9a895c4589f124a37fc84d123b5114406e94","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53353","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53353.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53336","title":"media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings","status":"backported","project":false,"upstream":[{"sha":"284be5693163343e1cf17c03917eecd1d6681bcf","url":"https://git.kernel.org/stable/c/284be5693163343e1cf17c03917eecd1d6681bcf"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"284be5693163343e1cf17c03917eecd1d6681bcf","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53336","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53336.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53231","title":"erofs: Fix detection of atomic context","status":"backported","project":false,"upstream":[{"sha":"12d0a24afd9ea58e581ea64d64e066f2027b28d9","url":"https://git.kernel.org/stable/c/12d0a24afd9ea58e581ea64d64e066f2027b28d9"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"12d0a24afd9ea58e581ea64d64e066f2027b28d9","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53231","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53231.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-53218","title":"rxrpc: Make it so that a waiting process can be aborted","status":"backported","project":false,"upstream":[{"sha":"0eb362d254814ce04848730bf32e75b8ee1a4d6c","url":"https://git.kernel.org/stable/c/0eb362d254814ce04848730bf32e75b8ee1a4d6c"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"0eb362d254814ce04848730bf32e75b8ee1a4d6c","lines":15,"reason":"","source":"https://github.com/torvalds/linux/commit/0eb362d254814ce04848730bf32e75b8ee1a4d6c.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-53218","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-53218.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52920","title":"bpf: support non-r10 register spill/fill to/from stack in precision tracking","status":"backported","project":false,"upstream":[{"sha":"41f6f64e6999a837048b1bd13a2f8742964eca6b","url":"https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6b"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"41f6f64e6999a837048b1bd13a2f8742964eca6b","lines":496,"reason":"","source":"https://github.com/torvalds/linux/commit/41f6f64e6999a837048b1bd13a2f8742964eca6b.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52920","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52920.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52888","title":"media: mediatek: vcodec: Only free buffer VA that is not NULL","status":"backported","project":false,"upstream":[{"sha":"eb005c801ec70ff4307727bd3bd6e8280169ef32","url":"https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"eb005c801ec70ff4307727bd3bd6e8280169ef32","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52888","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52888.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52797","title":"drivers: perf: Check find_first_bit() return value","status":"backported","project":false,"upstream":[{"sha":"c6e316ac05532febb0c966fa9b55f5258ed037be","url":"https://git.kernel.org/stable/c/c6e316ac05532febb0c966fa9b55f5258ed037be"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"c6e316ac05532febb0c966fa9b55f5258ed037be","lines":11,"reason":"","source":"https://github.com/torvalds/linux/commit/c6e316ac05532febb0c966fa9b55f5258ed037be.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52797","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52797.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52676","title":"bpf: Guard stack limits against 32bit overflow","status":"backported","project":false,"upstream":[{"sha":"1d38a9ee81570c4bd61f557832dead4d6f816760","url":"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"1d38a9ee81570c4bd61f557832dead4d6f816760","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52676","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52676.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52671","title":"drm/amd/display: Fix hang/underflow when transitioning to ODM4:1","status":"backported","project":false,"upstream":[{"sha":"e7b2b108cdeab76a7e7324459e50b0c1214c0386","url":"https://git.kernel.org/stable/c/e7b2b108cdeab76a7e7324459e50b0c1214c0386"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"e7b2b108cdeab76a7e7324459e50b0c1214c0386","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52671","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52671.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52648","title":"drm/vmwgfx: Unmap the surface before resetting it on a plane state","status":"backported","project":false,"upstream":[{"sha":"27571c64f1855881753e6f33c3186573afbab7ba","url":"https://git.kernel.org/stable/c/27571c64f1855881753e6f33c3186573afbab7ba"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"within-limit","patches":[{"sha":"27571c64f1855881753e6f33c3186573afbab7ba","lines":10,"reason":"","source":"https://github.com/torvalds/linux/commit/27571c64f1855881753e6f33c3186573afbab7ba.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52648","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52648.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52629","title":"sh: push-switch: Reorder cleanup operations to avoid use-after-free bug","status":"backported","project":false,"upstream":[{"sha":"246f80a0b17f8f582b2c0996db02998239057c65","url":"https://git.kernel.org/stable/c/246f80a0b17f8f582b2c0996db02998239057c65"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"246f80a0b17f8f582b2c0996db02998239057c65","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52629","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52629.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52625","title":"drm/amd/display: Refactor DMCUB enter/exit idle interface","status":"backported","project":false,"upstream":[{"sha":"8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa","url":"https://git.kernel.org/stable/c/8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa","lines":118,"reason":"","source":"https://github.com/torvalds/linux/commit/8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52625","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52625.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52624","title":"drm/amd/display: Wake DMCUB before executing GPINT commands","status":"backported","project":false,"upstream":[{"sha":"e5ffd1263dd5b44929c676171802e7b6af483f21","url":"https://git.kernel.org/stable/c/e5ffd1263dd5b44929c676171802e7b6af483f21"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"over-limit","patches":[{"sha":"e5ffd1263dd5b44929c676171802e7b6af483f21","lines":213,"reason":"","source":"https://github.com/torvalds/linux/commit/e5ffd1263dd5b44929c676171802e7b6af483f21.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52624","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52624.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2023-52590","title":"ocfs2: Avoid touching renamed directory if parent does not change","status":"backported","project":false,"upstream":[{"sha":"9d618d19b29c2943527e3a43da0a35aea91062fc","url":"https://git.kernel.org/stable/c/9d618d19b29c2943527e3a43da0a35aea91062fc"}],"evidence":[],"submission_lore":[],"basis":"mainline-fixed","review":null,"size":{"status":"unknown","patches":[{"sha":"9d618d19b29c2943527e3a43da0a35aea91062fc","lines":null}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-52590","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2023/CVE-2023-52590.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"},{"id":"CVE-2021-47645","title":"media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com","status":"not-applicable","project":false,"upstream":[{"sha":"e3b86f4e558cea9eed71d894df2f19b10d60a207","url":"https://git.kernel.org/stable/c/e3b86f4e558cea9eed71d894df2f19b10d60a207"},{"sha":"8dce4b265a5357731058f69645840dabc718c687","url":"https://git.kernel.org/stable/c/8dce4b265a5357731058f69645840dabc718c687"}],"evidence":[],"submission_lore":[],"basis":"The relocated Zoran driver already uses the corrected even buffer index and checks for a NULL buffer in zoran_reap_stat_com. Both effective fix changes are present. The separate 2019 driver-removal commit is not required for this restored driver implementation.","review":{"id":"CVE-2021-47645","series":"7.2.y","upstream":["e3b86f4e558cea9eed71d894df2f19b10d60a207","8dce4b265a5357731058f69645840dabc718c687"],"checked_sha":"9a66fdc0d7fd55f54235524a73435af99051e46f","checked_version":"7.2.8","kind":"already-fixed","applicability":"fixed","reason":"The relocated Zoran driver already uses the corrected even buffer index and checks for a NULL buffer in zoran_reap_stat_com. Both effective fix changes are present. The separate 2019 driver-removal commit is not required for this restored driver implementation.","source":"Pinned source applicability review, 2026-10-02","reviewed_at":"2026-10-02","evidence":[{"label":"Checked source: drivers/media/pci/zoran/zoran_device.c","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/media/pci/zoran/zoran_device.c?id=9a66fdc0d7fd55f54235524a73435af99051e46f#n794"},{"label":"Upstream fix 8dce4b265a53","url":"https://git.kernel.org/stable/c/8dce4b265a5357731058f69645840dabc718c687"},{"label":"Upstream fix e3b86f4e558c","url":"https://git.kernel.org/stable/c/e3b86f4e558cea9eed71d894df2f19b10d60a207"}]},"size":{"status":"over-limit","patches":[{"sha":"e3b86f4e558cea9eed71d894df2f19b10d60a207","lines":19,"reason":"","source":"https://github.com/torvalds/linux/commit/e3b86f4e558cea9eed71d894df2f19b10d60a207.patch"},{"sha":"8dce4b265a5357731058f69645840dabc718c687","lines":11302,"reason":"","source":"https://github.com/torvalds/linux/commit/8dce4b265a5357731058f69645840dabc718c687.patch"}],"basis":"Upstream diff, three context lines"},"cve_url":"https://www.cve.org/CVERecord?id=CVE-2021-47645","source_url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2021/CVE-2021-47645.json?id=604accad567eb6e7fb4c7fdc422470c25f35f467"}],"counts":{"backported":0,"queued":0,"unfixed":2,"unknown":0,"not-applicable":6},"triage_counts":{"over-limit":1,"within-limit":1,"size-unknown":0,"already-fixed":1,"applicable":0,"ineffective-fix":0,"needs-review":0,"no-op":0,"not-applicable":0}}],"warnings":[]}