- Add NetworkManager-CVE-2025-9615.patch: avoid that non-admin user
  using other users' certificates
  (bsc#1257359, CVE-2025-9615, glfd#NetworkManager/NetworkManager!2324).

n/a

- Fix dependency replace -serial with -pyserial

- Drop unneeded test dependency on httpretty, fixed long ago
  * https://github.com/canonical/cloud-init/pull/1720

- Update to version 1.18
  +  Fix issue with link-local address routing (bsc#1258730)

- Update to version 1.17
  + Do not set broadcast address explicitly (bsc#1258406)

- Update to version 11.0.2 (bsc#1260421)
  + Add iputils as a dependency to make automatic NVIDIA repo enablement
    work

- Update to version 11.0.1
  + Fix attempt to read a deleted file resulting in an error. Refresh
    the file list for repos and services for each pass over the
    server domains we are looking to clean up the registration.
  + Update user visible messages only showing messages for the
    application configuration file.

- Update to version 11.0.0 (bsc#1254960, bsc#1254982, bsc#1253777)
  + Major version bump for main package and plugin sub-packages due to
    interpreter change in SLE 15 SP4+ from Python 3.6 to Python 3.11
  + Create cache directory in code and drop from package (jsc#PED-14732)
  + Fix race condition between license watcher timer and registration
    (bsc#1254984)
  + Fix cleanup issue in hosts (bsc#1254702)
  + Fix cache clean up
  + Fix exit condition from container registry setup
  + Lock the registration process to ensure single execution (bsc#1254984)
  + Fix traceback on FP and cert mismatch
  + Switch remaining code to updated logging implementation
  + Increase loggin information in log to help with issue debugging
  + Fix exit code on partial registration success
  + Remove obsolete switchcloudguestservices

- Update to version 10.5.3
  + Move project setup to poetry and apply python standards
  + Fix use of logging facility
    Use logging facility in the desired way throughout the entire
    code base. This includes the following changes and refactor
  * Add handler and formatter for the logfile containing more
    information about function and position in code for the message
  * Add handler for stdout (INFO and WARNING)
  * Add handler for stderr (ERROR).
  * Implement Logger class providing the logging setup and methods
  * Drop the start_logging() method.
  * Fix and refactor all unit tests around the use of logging
    with a proper fixture and place all tests for registerutils
    into its own class TestRegisterUtils.
  * Add --debug switch for registercloudguest. Allow to increase
    logfile information. All messages produced via log.debug(...)
    in code will be part of the logfile. Debug messages will not
    be shown on the console
  * Update SLE12 patches due to logging refactor
  * Use --debug flag in guestregister service
    This Fixes #188

- Update dependencies to fix bsc#1258641/CVE-2026-26996

- Update dependencies to fix bsc#1257836/CVE-2026-25547 bsc#1258641/CVE-2026-26996

- Update dependencies to fix bsc#1257836/CVE-2026-25547 bsc#1258641/CVE-2026-26996

- Add patch for CVE-2026-33186 (bsc#1260296):
  * 0002-CVE-2026-33186-containerd-google.golang.org-grpc-aut.patch

- Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
  * Enable and prioritize sntrup761x25519-sha512 for OpenSSH by default
  * Add crypto-policies-OpenSSH-PQC.patch

- Security fixes:
  * CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631)
  * CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632)
  * CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635)
  * CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636)
  * CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638)
  * sws: prevent "connection monitor" to say disconnect twice (bsc#1259362)
  * Add patches:
  - curl-CVE-2026-4873.patch
  - curl-CVE-2026-5545.patch
  - curl-CVE-2026-6253.patch
  - curl-CVE-2026-6276.patch
  - curl-CVE-2026-6429.patch
  - curl-CVE-2026-1965-disable-ntlm-fix.patch

- Security fixes:
  * CVE-2026-1965: Bad reuse of HTTP Negotiate connection (bsc#1259362)
  * CVE-2026-3783: Token leak with redirect and netrc (bsc#1259363)
  * CVE-2026-3784: Wrong proxy connection reuse with credentials (bsc#1259364)
  * CVE-2026-3805: Use after free in SMB connection reuse (bsc#1259365)
  * Add patches:
  - curl-CVE-2026-1965.patch
  - curl-CVE-2026-3783.patch
  - curl-CVE-2026-3784.patch
  - curl-CVE-2026-3805.patch

- resolv-count-resource-records.patch: resolv: Count records correctly
  (CVE-2026-4437, bsc#1260078, BZ #34014)
- resolv-check-hostname.patch: resolv: Check hostname for validity
  (CVE-2026-4438, bsc#1260082, BZ #34015)

- Fix Y2K38 FTBFS:
  * gpg2 quick-key-manipulation test FTBFS-2038 (bsc#1251214)
  * Upstream issue: dev.gnupg.org/T8096
  * Add gnupg-gpgscm-New-operator-long-time-t-to-detect-proper-tim.patch

- crypto: authencesn - Fix src offset when decrypting in-place
  (bsc#1262573 CVE-2026-31431).
- commit 2513bb5

- crypto: authencesn - Do not place hiseq at end of dst for
  out-of-place decryption (bsc#1262573 CVE-2026-31431).
- commit bdd01a3

- crypto: authenc - use memcpy_sglist() instead of null skcipher
  (bsc#1262573 CVE-2026-31431).
- Refresh
  patches.suse/crypto-authencesn-reject-too-short-AAD-assoclen-8-to.patch
- commit cafc295

- kABI: Restore af_alg_{count,pull}_tsgl() signatures (bsc#1262573
  CVE-2026-31431).
- commit 6b01c90

- crypto: algif_aead - Revert to operating out-of-place
  (bsc#1262573 CVE-2026-31431).
- commit 6bcb58c

- crypto: algif_aead - use memcpy_sglist() instead of null skcipher
  (bsc#1262573 CVE-2026-31431).
- commit ad83acd

- crypto: scatterwalk - Fix memcpy_sglist() to always succeed
  (bsc#1262573 CVE-2026-31431).
- commit 18a46ad

- crypto: scatterwalk - Add memcpy_sglist (bsc#1262573
  CVE-2026-31431).
- commit 174b840

- bpf, arm64: Force 8-byte alignment for JIT buffer to prevent
  atomic tearing (CVE-2026-23383 bsc#1260497).
- commit 62599f7

- ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
  (CVE-2026-23304 bsc#1260544).
- commit 0e2cfb3

- selftests/powerpc: make sub-folders buildable on their own (bsc#1261669 ltc#212590).
- Refresh patches.suse/selftests-powerpc-dexcr-Add-no-pie-to-hashchk-tests.patch.
- commit b39cae9

- selftests/powerpc: Re-order *FLAGS to follow lib.mk (bsc#1261669
  ltc#212590).
- commit cdc7ba4

- selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15
  (bsc#1261669 ltc#212590).
- commit 875a091

- xdp: produce a warning when calculated tailroom is negative
  (CVE-2026-23343 bsc#1260527).
- commit 3ff31fa

- tg3: Fix race for querying speed/duplex (bsc#1257183).
- commit 50cbd22

- net/rds: Fix circular locking dependency in rds_tcp_tune
  (CVE-2026-23419 bsc#1261507).
- commit 5d48507

- RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (CVE-2026-23335 bsc#1260550)
- commit 9fa90c7

- gve: Fix stats report corruption on queue count change
  (CVE-2026-23262 bsc#1259870).
- commit 56ed553

- netfilter: bpf: defer hook memory release until rcu readers
  are done (CVE-2026-23412 bsc#1261412).
- commit 1299d5b

- Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
  (CVE-2026-23395 bsc#1260580).
- commit 942ba6f

- soc: aspeed: socinfo: Mask table entries for accurate SoC ID
  matching (git-fixes).
- commit df6cd61

- net/sched: teql: fix NULL pointer dereference in iptunnel_xmit
  on TEQL slave xmit (CVE-2026-23277 bsc#1259997).
- commit 852cc2c

- scsi: target: Fix recursive locking in __configfs_open_file()
  (CVE-2026-23292 bsc#1260500).
- scsi: target: iscsi: Fix use-after-free in
  iscsit_dec_session_usage_count() (CVE-2026-23193 bsc#1258414).
- scsi: target: iscsi: Fix use-after-free in
  iscsit_dec_conn_usage_count() (CVE-2026-23216 bsc#1258447).
- commit e7b5dcd

- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs
  and shared blocks (CVE-2026-23270 bsc#1259886).
- commit 00821f1

- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
  (CVE-2026-23381 bsc#1260471).
- commit 21aa5bd

- clsact: Fix use-after-free in init/destroy rollback asymmetry
  (CVE-2026-23413 bsc#1261498).
- commit eaf3b22

- icmp: fix NULL pointer dereference in icmp_tag_validation()
  (CVE-2026-23398 bsc#1260730).
- net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
  (CVE-2026-23293 bsc#1260486).
- commit 05f5f64

- net/sched: ets: fix divide by zero in the offload path
  (CVE-2026-23379 bsc#1260481).
- commit 3672900

- tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414
  bsc#1261496).
- commit 1058925

- usb: gadget: uvc: fix NULL pointer dereference during unbind
  race (git-fixes).
- commit 4a9ee96

- misc: fastrpc: possible double-free of cctx->remote_heap
  (git-fixes).
- comedi: Reinit dev->spinlock between attachments to low-level
  drivers (git-fixes).
- comedi: me_daq: Fix potential overrun of firmware buffer
  (git-fixes).
- comedi: me4000: Fix potential overrun of firmware buffer
  (git-fixes).
- comedi: ni_atmio16d: Fix invalid clean-up after failed attach
  (git-fixes).
- iio: dac: ad5770r: fix error return in ad5770r_read_raw()
  (git-fixes).
- iio: accel: fix ADXL355 temperature signature value (git-fixes).
- iio: light: vcnl4035: fix scan buffer on big-endian (git-fixes).
- iio: adc: ti-adc161s626: fix buffer read on big-endian
  (git-fixes).
- iio: imu: bmi160: Remove potential undefined behavior in
  bmi160_config_pin() (git-fixes).
- iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
  (git-fixes).
- iio: gyro: mpu3050: Fix out-of-sequence free_irq() (git-fixes).
- iio: gyro: mpu3050: Move iio_device_register() to correct
  location (git-fixes).
- iio: gyro: mpu3050: Fix irq resource leak (git-fixes).
- iio: gyro: mpu3050: Fix incorrect free_irq() variable
  (git-fixes).
- iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and
  gyroscope only (git-fixes).
- usb: cdns3: gadget: fix state inconsistency on gadget init
  failure (git-fixes).
- usb: ulpi: fix double free in ulpi_register_interface() error
  path (git-fixes).
- usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
  (git-fixes).
- usb: gadget: f_rndis: Protect RNDIS options with mutex
  (git-fixes).
- usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
  (git-fixes).
- usb: dwc2: gadget: Fix spin_lock/unlock mismatch in
  dwc2_hsotg_udc_stop() (git-fixes).
- usb: ehci-brcm: fix sleep during atomic (git-fixes).
- USB: dummy-hcd: Fix interrupt synchronization error (git-fixes).
- USB: dummy-hcd: Fix locking/synchronization error (git-fixes).
- usb: usbtmc: Flush anchored URBs in usbtmc_release (git-fixes).
- usb: gadget: u_ether: Fix race between gether_disconnect and
  eth_stop (git-fixes).
- thunderbolt: Fix property read in nhi_wake_supported()
  (git-fixes).
- commit 4e3d5c2

- Input: synaptics-rmi4 - fix a locking bug in an error path
  (git-fixes).
- hwmon: (occ) Fix missing newline in occ_show_extended()
  (git-fixes).
- hwmon: (occ) Fix division by zero in occ_show_power_1()
  (git-fixes).
- hwmon: (tps53679) Fix device ID comparison and printing in
  tps53676_identify() (git-fixes).
- hwmon: (pxe1610) Check return value of page-select write in
  probe (git-fixes).
- commit 08cee84

- gpio: mxc: map Both Edge pad wakeup to Rising Edge (git-fixes).
- drm/ioc32: stop speculation on the drm_compat_ioctl path
  (git-fixes).
- drm/ast: dp501: Fix initialization of SCU2C (git-fixes).
- accel/qaic: Handle DBC deactivation if the owner went away
  (git-fixes).
- drm/i915/dp: Use crtc_state->enhanced_framing properly on
  ivb/hsw CPU eDP (git-fixes).
- crypto: af-alg - fix NULL pointer dereference in scatterwalk
  (git-fixes).
- crypto: caam - fix overflow on long hmac keys (git-fixes).
- crypto: caam - fix DMA corruption on long hmac keys (git-fixes).
- commit 376a907

- mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D
  mode (stable-fixes).
- commit 2d1bac8

- net/x25: Fix overflow when accumulating packets (git-fixes).
- net/x25: Fix potential double free of skb (git-fixes).
- Bluetooth: SMP: derive legacy responder STK authentication
  from MITM state (git-fixes).
- Bluetooth: SMP: force responder MITM requirements before
  building the pairing response (git-fixes).
- Bluetooth: MGMT: validate mesh send advertising payload length
  (git-fixes).
- Bluetooth: hci_event: fix potential UAF in
  hci_le_remote_conn_param_req_evt (git-fixes).
- Bluetooth: MGMT: validate LTK enc_size on load (git-fixes).
- Bluetooth: SCO: fix race conditions in sco_sock_connect()
  (git-fixes).
- Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if
  immediate (git-fixes).
- NFC: pn533: bound the UART receive buffer (git-fixes).
- wifi: iwlwifi: mvm: fix potential out-of-bounds read in
  iwl_mvm_nd_match_info_handler() (git-fixes).
- wifi: wilc1000: fix u8 overflow in SSID scan buffer size
  calculation (git-fixes).
- ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add
  rollback on failure (git-fixes).
- ALSA: caiaq: fix stack out-of-bounds read in init_card
  (git-fixes).
- dmaengine: idxd: Fix freeing the allocated ida too late
  (git-fixes).
- Bluetooth: btintel: serialize btintel_hw_error() with
  hci_req_sync_lock (git-fixes).
- hwmon: axi-fan: don't use driver_override as IRQ name
  (git-fixes).
- ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
  (stable-fixes).
- ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
  (stable-fixes).
- ASoC: fsl_easrc: Fix event generation in
  fsl_easrc_iec958_set_reg() (stable-fixes).
- ASoC: fsl_easrc: Fix event generation in
  fsl_easrc_iec958_put_bits() (stable-fixes).
- HID: mcp2221: cancel last I2C command on read error
  (stable-fixes).
- HID: asus: avoid memory leak in asus_report_fixup()
  (stable-fixes).
- HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
  (stable-fixes).
- HID: apple: avoid memory leak in apple_report_fixup()
  (stable-fixes).
- platform/x86: intel-hid: Enable 5-button array on ThinkPad X1
  Fold 16 Gen 1 (stable-fixes).
- platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to
  dmi_vgbs_allow_list (stable-fixes).
- platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix
  touchscreen on SUPI S10 (stable-fixes).
- mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D
  mode (stable-fixes).
- Bluetooth: hci_sync: Remove remaining dependencies of
  hci_request (stable-fixes).
- Bluetooth: Remove 3 repeated macro definitions (stable-fixes).
- hwmon: (axi-fan-control) Make use of dev_err_probe()
  (stable-fixes).
- hwmon: (axi-fan-control) Use device firmware agnostic API
  (stable-fixes).
- dmaengine: idxd: Remove usage of the deprecated ida_simple_xx()
  API (stable-fixes).
- commit a6c10e6

- net: add proper RCU protection to /proc/net/ptype
  (CVE-2026-23255 bsc#1259891).
- commit 970622a

- netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  (CVE-2026-23274 bsc#1260005).
- commit b61cf0b

- netfilter: nf_tables: always walk all pending catchall elements
  (CVE-2026-23278 bsc#1259998).
- commit bde2f22

- netfilter: nf_tables: unconditionally bump set->nelems before
  insertion (CVE-2026-23272 bsc#1260009).
- commit 4898783

- btrfs: fix zero size inode with non-zero size after log replay
  (git-fixes).
- commit f810098

- btrfs: log new dentries when logging parent dir of a conflicting
  inode (git-fixes).
- commit 2a2fe4a

- bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
  (CVE-2026-23319 bsc#1260735).
- commit afdc54a

- bpf: export bpf_link_inc_not_zero (CVE-2026-23319 bsc#1260735).
- commit 3c0dee1

- net: mana: Trigger VF reset/recovery on health check failure due to HWC timeout (bsc#1259580).
- net: mana: fix use-after-free in add_adev() error path (git-fixes).
- commit dd3433a

- btrfs: fix reservation leak in some error paths when inserting
  inline extent (CVE-2025-71268 bsc#1259865).
- commit f586cfb

- btrfs: do not free data reservation in fallback from inline
  due to -ENOSPC (CVE-2025-71269 bsc#1259889).
- commit 2f2ec59

- kABI fix for ipvlan: Make the addrs_lock be per port
  (CVE-2026-23103 bsc#1257773).
- ipvlan: Make the addrs_lock be per port (CVE-2026-23103
  bsc#1257773).
- commit 546f802

- btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (bsc#1257777).
- commit 5f963b7

- rename Hyper-v patch files to simplify further SP6-SP7 merges
- commit aa72668

- net/mlx5: Fix crash when moving to switchdev mode (git-fixes).
- bonding: do not set usable_slaves for broadcast mode
  (git-fixes).
- idpf: nullify pointers after they are freed (git-fixes).
- gve: fix incorrect buffer cleanup in
  gve_tx_clean_pending_packets for QPL (CVE-2026-23386
  bsc#1260799).
- commit 1051a48

- xen/privcmd: unregister xenstore notifier on module exit
  (git-fixes).
- commit 0c94fec

- xen/privcmd: restrict usage in unprivileged domU (bsc#1259707
  CVE-2026-31788).
- commit 0c51260

- phy: ti: j721e-wiz: Fix device node reference leak in
  wiz_get_lane_phy_types() (git-fixes).
- dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
  (git-fixes).
- dmaengine: xilinx: xilinx_dma: Fix residue calculation for
  cyclic DMA (git-fixes).
- dmaengine: xilinx: xilinx_dma: Fix dma_device directions
  (git-fixes).
- dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
  (git-fixes).
- dmaengine: sh: rz-dmac: Protect the driver specific lists
  (git-fixes).
- dmaengine: idxd: fix possible wrong descriptor completion in
  llist_abort_desc() (git-fixes).
- dmaengine: xilinx: xdma: Fix regmap init error handling
  (git-fixes).
- dmaengine: idxd: Fix leaking event log memory (git-fixes).
- dmaengine: idxd: Fix memory leak when a wq is reset (git-fixes).
- dmaengine: idxd: Fix not releasing workqueue on .release()
  (git-fixes).
- commit f22ea44

- drm/vmwgfx: Return the correct value in vmw_translate_ptr
  functions (CVE-2026-23317 bsc#1260562).
- commit 62d1ba3

- PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
  (CVE-2026-23361 bsc#1260732).
- commit e28de60

- Delete
  patches.suse/scsi-Fix-sas_user_scan-to-handle-wildcard-and-multi-channe.patch.
  See bsc#1257506.
  The git-fix being removed had issues and needs to be redesigned.
  In the mean time, reverting this addresses the problem.
  See:
  > https://bugzilla.suse.com/show_bug.cgi?id=1257506#c47
- commit 14d63c6

- hwmon: (adm1177) fix sysfs ABI violation and current unit
  conversion (git-fixes).
- hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
  (git-fixes).
- hwmon: (peci/cputemp) Fix crit_hyst returning delta instead
  of absolute temperature (git-fixes).
- hwmon: (pmbus/isl68137) Add mutex protection for AVS enable
  sysfs attributes (git-fixes).
- drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
  (git-fixes).
- drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
  (git-fixes).
- spi: spi-fsl-lpspi: fix teardown order issue (UAF) (git-fixes).
- regmap: Synchronize cache for the page selector (git-fixes).
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial
  payload (git-fixes).
- ASoC: adau1372: Fix clock leak on PLL lock failure (git-fixes).
- ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
  (git-fixes).
- ASoC: Intel: catpt: Fix the device initialization (git-fixes).
- ALSA: firewire-lib: fix uninitialized local variable
  (git-fixes).
- commit a2172e0

- libceph: reset sparse-read state in osd_fault() (CVE-2026-23136 bsc#1258303).
- commit 7606f01

- wifi: libertas: fix use-after-free in lbs_free_adapter()
  (CVE-2026-23281 bsc#1260464).
- commit 43b8c42

- serial: 8250: Add late synchronize_irq() to shutdown to handle
  DW UART BUSY (git-fixes).
- serial: 8250_pci: add support for the AX99100 (stable-fixes).
- serial: uartlite: fix PM runtime usage count underflow on probe
  (git-fixes).
- serial: 8250: Fix TX deadlock when using DMA (git-fixes).
- spi: fix statistics allocation (git-fixes).
- spi: fix use-after-free on controller registration failure
  (git-fixes).
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is
  not enough headroom (git-fixes).
- wifi: mac80211: fix NULL deref in mesh_matches_local()
  (git-fixes).
- wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
  (git-fixes).
- wifi: mac80211: Fix static_branch_dec() underflow for
  aql_disable (git-fixes).
- soc: fsl: qbman: fix race condition in qman_destroy_fq
  (git-fixes).
- USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb
  speed (stable-fixes).
- usb: dwc3: pci: add support for the Intel Nova Lake -H
  (stable-fixes).
- usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
  (stable-fixes).
- usb: xhci: Prevent interrupt storm on host controller error
  (HCE) (stable-fixes).
- usb: cdc-acm: Restore CAP_BRK functionnality to CH343
  (git-fixes).
- usb: misc: uss720: properly clean up reference in uss720_probe()
  (stable-fixes).
- usb: image: mdc800: kill download URB on timeout (stable-fixes).
- usb: mdc800: handle signal and read racing (stable-fixes).
- usb: yurex: fix race in probe (stable-fixes).
- staging: rtl8723bs: properly validate the data in
  rtw_get_ie_ex() (stable-fixes).
- wifi: mac80211: set default WMM parameters on all links
  (stable-fixes).
- usb: cdns3: fix role switching during resume (git-fixes).
- USB: serial: f81232: fix incomplete serial port generation
  (stable-fixes).
- usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
  (stable-fixes).
- usb: cdns3: remove redundant if branch (stable-fixes).
- commit 9cd434e

- nfc: nci: fix circular locking dependency in nci_close_device
  (git-fixes).
- pinctrl: mediatek: common: Fix probe failure for devices
  without EINT (git-fixes).
- pinctrl: qcom: spmi-gpio: implement .get_direction()
  (git-fixes).
- platform/x86: ISST: Correct locked bit width (git-fixes).
- platform/olpc: olpc-xo175-ec: Fix overflow error message to
  print inlen (git-fixes).
- mmc: sdhci: fix timing selection for 1-bit bus width
  (git-fixes).
- mmc: sdhci-pci-gli: fix GL9750 DMA write corruption (git-fixes).
- mtd: rawnand: pl353: make sure optimal timings are applied
  (git-fixes).
- mtd: rawnand: brcmnand: skip DMA during panic write (git-fixes).
- mtd: rawnand: serialize lock/unlock against other NAND
  operations (git-fixes).
- mtd: rawnand: cadence: Fix error check for dma_alloc_coherent()
  in cadence_nand_init() (git-fixes).
- mtd: Avoid boot crash in RedBoot partition table parser
  (git-fixes).
- NFC: nxp-nci: allow GPIOs to sleep (git-fixes).
- net: usb: aqc111: Do not perform PM inside suspend callback
  (git-fixes).
- net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
  (git-fixes).
- net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
  (git-fixes).
- net/rose: fix NULL pointer dereference in rose_transmit_link
  on reconnect (git-fixes).
- PM: runtime: Fix a race condition related to device removal
  (git-fixes).
- regulator: pca9450: Correct interrupt type (git-fixes).
- platform/x86: dell-wmi: Add audio/mic mute key codes
  (stable-fixes).
- pinctrl: equilibrium: fix warning trace on load (git-fixes).
- pinctrl: equilibrium: rename irq_chip function callbacks
  (stable-fixes).
- net: usb: pegasus: validate USB endpoints (stable-fixes).
- mfd: omap-usb-host: Fix OF populate on driver rebind
  (git-fixes).
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (git-fixes).
- regulator: pca9450: Make IRQ optional (stable-fixes).
- PCI: Update BAR # and window messages (stable-fixes).
- mfd: qcom-pm8xxx: Convert to platform remove callback returning
  void (stable-fixes).
- commit ec2548e

- can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
  (git-fixes).
- can: gw: fix OOB heap access in cgw_csum_crc8_rel() (git-fixes).
- media: mc, v4l2: serialize REINIT and REQBUFS with
  req_queue_mutex (git-fixes).
- i2c: pxa: defer reset on Armada 3700 when recovery is used
  (git-fixes).
- i2c: fsi: Fix a potential leak in fsi_i2c_probe() (git-fixes).
- i2c: cp2615: fix serial string NULL-deref at probe (git-fixes).
- hwmon: (pmbus/isl68137) Fix unchecked return value and use
  sysfs_emit() (git-fixes).
- drm/radeon: apply state adjust rules to some additional HAINAN
  vairants (stable-fixes).
- drm/amdgpu: apply state adjust rules to some additional HAINAN
  vairants (stable-fixes).
- drm/amdgpu/gmc9.0: add bounds checking for cid (stable-fixes).
- drm/amdgpu/mmhub3.0: add bounds checking for cid (stable-fixes).
- drm/amdgpu/mmhub3.0.2: add bounds checking for cid
  (stable-fixes).
- drm/amdgpu/mmhub3.0.1: add bounds checking for cid
  (stable-fixes).
- drm/amdgpu/mmhub2.3: add bounds checking for cid (stable-fixes).
- drm/amdgpu/mmhub2.0: add bounds checking for cid (stable-fixes).
- drm/amd/display: Fix DisplayID not-found handling in
  parse_edid_displayid_vrr() (git-fixes).
- drm/i915/gt: Check set_default_submission() before deferencing
  (git-fixes).
- firmware: arm_scpi: Fix device_node reference leak in probe path
  (git-fixes).
- drm/amd: Set num IP blocks to 0 if discovery fails
  (stable-fixes).
- drm/msm/dsi: fix pclk rate calculation for bonded dsi
  (git-fixes).
- drm/msm/dsi: fix hdisplay calculation when programming dsi
  registers (git-fixes).
- drm/amdgpu: Fix use-after-free race in VM acquire
  (stable-fixes).
- HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks
  missing them (stable-fixes).
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics
  (stable-fixes).
- drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode
  with HPD (stable-fixes).
- drm/amd/display: Add pixel_clock to amd_pp_display_configuration
  (stable-fixes).
- drm/msm/dsi: Document DSC related pclk_rate and hdisplay
  calculations (stable-fixes).
- mfd: omap-usb-host: Convert to platform remove callback
  returning void (stable-fixes).
- media: tegra-video: Use accessors for pad config 'try_*' fields
  (stable-fixes).
- i2c: cp2615: replace deprecated strncpy with strscpy
  (stable-fixes).
- commit 19fcdc7

- Bluetooth: btusb: clamp SCO altsetting table indices
  (git-fixes).
- Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite
  loop (git-fixes).
- Bluetooth: L2CAP: Fix send LE flow credits in ACL link
  (git-fixes).
- Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
  (git-fixes).
- Bluetooth: hci_ll: Fix firmware leak on error path (git-fixes).
- Bluetooth: MGMT: Fix dangling pointer on
  mgmt_add_adv_patterns_monitor_complete (git-fixes).
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to
  missing sock_hold (git-fixes).
- Bluetooth: L2CAP: Validate PDU length before reading SDU length
  in l2cap_ecred_data_rcv() (git-fixes).
- commit d4b4294

- ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
  (git-fixes).
- Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before
  access (git-fixes).
- Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
  (git-fixes).
- Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
  (git-fixes).
- Bluetooth: HIDP: Fix possible UAF (git-fixes).
- Bluetooth: hci_sync: Fix hci_le_create_conn_sync (git-fixes).
- Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy (git-fixes).
- Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed
  SDU (git-fixes).
- Bluetooth: LE L2CAP: Disconnect if received packet's SDU
  exceeds IMTU (git-fixes).
- ACPI: processor: Fix previous acpi_processor_errata_piix4()
  fix (git-fixes).
- ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2
  mixer interfaces (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
  (stable-fixes).
- ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
  (stable-fixes).
- ALSA: hda: cs35l56: Fix signedness error in
  cs35l56_hda_posture_put() (git-fixes).
- ACPI: PM: Save NVS memory on Lenovo G70-35 (stable-fixes).
- ACPI: OSI: Add DMI quirk for Acer Aspire One D255
  (stable-fixes).
- ALSA: hda/conexant: Fix headphone jack handling on Acer Swift
  SF314 (stable-fixes).
- ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
  (stable-fixes).
- ALSA: pci: hda: use snd_kcontrol_chip() (stable-fixes).
- commit d930c45

- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337 CVE-2026-23201).
- commit c1d531a

- libceph: make calc_target() set t->paused, not just clear it (bsc#1257682 CVE-2026-23047).
- commit 9134bbf

- x86/platform/uv: Handle deconfigured sockets (bsc#1260347).
- commit f09c977

- RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243 bsc#1259797)
- commit b964f1d

- RDMA/siw: Fix potential NULL pointer dereference in header processing (CVE-2026-23242 bsc#1259795)
- commit b14d408

- bpf, test_run: Subtract size of xdp_frame from allowed metadata
  size (CVE-2026-23140 bsc#1258305).
- commit 2fff83a

- netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
  (CVE-2026-23231 bsc#1259188).
- netfilter: nf_tables: register hooks last when adding new
  chain/flowtable (CVE-2026-23231 bsc#1259188).
- commit fd540e6

- scsi: target: target_core_configfs: Add length check to avoid
  buffer overflow (CVE-2025-39998 bsc#1252073).
- commit dff8745

- l2tp: avoid one data-race in l2tp_tunnel_del_work() (CVE-2026-23120 bsc#1258280)
- commit 975023c

- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (CVE-2026-23187 bsc#1258330)
- commit 4b333af

- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (CVE-2026-23030 bsc#1257561)
- commit 4c335f0

- Use unified maintainers' email address
- commit a7ec874

- Use unified maintainers' email address
- commit e7955e0

- Use unified maintainers' email address
- commit 3c803fb

- net/mana: Null service_wq on setup error to prevent double
  destroy (git-fix).
- commit 4b21ba9

- iomap: adjust read range correctly for non-block-aligned positions (CVE-2025-68794 bsc#1256647)
- commit bad6b8a

- usb: roles: get usb role switch from parent only for
  usb-b-connector (git-fixes).
- usb: xhci: Fix memory leak in xhci_disable_slot() (git-fixes).
- usb: class: cdc-wdm: fix reordering issue in read code path
  (git-fixes).
- usb: renesas_usbhs: fix use-after-free in ISR during device
  removal (git-fixes).
- usb: gadget: f_mass_storage: Fix potential integer overflow
  in check_command_size_in_blocks() (git-fixes).
- USB: core: Limit the length of unkillable synchronous timeouts
  (git-fixes).
- USB: usbtmc: Use usb_bulk_msg_killable() with user-specified
  timeouts (git-fixes).
- USB: usbcore: Introduce usb_bulk_msg_killable() (git-fixes).
- usb: core: don't power off roothub PHYs if phy_set_mode()
  fails (git-fixes).
- iio: gyro: mpu3050-core: fix pm_runtime error handling
  (git-fixes).
- iio: gyro: mpu3050-i2c: fix pm_runtime error handling
  (git-fixes).
- iio: chemical: sps30_serial: fix buffer size in
  sps30_serial_read_meas() (git-fixes).
- iio: chemical: sps30_i2c: fix buffer size in
  sps30_i2c_read_meas() (git-fixes).
- iio: chemical: bme680: Fix measurement wait duration calculation
  (git-fixes).
- iio: dac: ds4424: reject -128 RAW value (git-fixes).
- iio: potentiometer: mcp4131: fix double application of wiper
  shift (git-fixes).
- iio: frequency: adf4377: Fix duplicated soft reset mask
  (git-fixes).
- iio: imu: inv_icm42600: fix odr switch to the same value
  (git-fixes).
- commit 4702653

- drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
  (git-fixes).
- ASoC: amd: acp-mach-common: Add missing error check for clock
  acquisition (git-fixes).
- ASoC: detect empty DMI strings (git-fixes).
- ASoC: amd: acp3x-rt5682-max9836: Add missing error check for
  clock acquisition (git-fixes).
- ASoC: soc-core: flush delayed work before removing DAIs and
  widgets (git-fixes).
- ASoC: soc-core: drop delayed_work_pending() check before flush
  (git-fixes).
- ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop
  and start (git-fixes).
- ALSA: pcm: fix use-after-free on linked stream runtime in
  snd_pcm_drain() (git-fixes).
- commit 1a186d1

- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (CVE-2025-71231 bsc#1258424).
- commit f8a95c7

- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
  (CVE-2026-23125 bsc#1258293).
- commit 6e65546

- KVM: x86/mmu: Drop/zap existing present SPTE even when creating
  an MMIO SPTE (bsc#1259461).
- commit 042631f

- ACPI: OSL: fix __iomem type on return from
  acpi_os_map_generic_address() (git-fixes).
- can: hi311x: hi3110_open(): add check for hi3110_power_enable()
  return value (git-fixes).
- net: usb: lan78xx: fix TX byte statistics for small packets
  (git-fixes).
- net: usb: lan78xx: fix silent drop of packets with checksum
  errors (git-fixes).
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
  (git-fixes).
- remoteproc: sysmon: Correct subsys_name_len type in QMI request
  (git-fixes).
- commit 5d32ac9

- apparmor: fix race between freeing data and fs accessing it
  (bsc#1258849).
- apparmor: fix race on rawdata dereference (bsc#1258849).
- apparmor: fix differential encoding verification (bsc#1258849).
- apparmor: fix unprivileged local user can do privileged policy
  management (bsc#1258849).
- apparmor: Fix double free of ns_name in aa_replace_profiles()
  (bsc#1258849).
- apparmor: fix missing bounds check on DEFAULT table in
  verify_dfa() (bsc#1258849).
- apparmor: fix side-effect bug in match_char() macro usage
  (bsc#1258849).
- apparmor: fix: limit the number of levels of policy namespaces
  (bsc#1258849).
- apparmor: replace recursive profile removal with iterative
  approach (bsc#1258849).
- apparmor: fix memory leak in verify_header (bsc#1258849).
- apparmor: validate DFA start states are in bounds in unpack_pdb
  (bsc#1258849).
- commit 9f31a2e

- scsi: mpi3mr: Event processing debug improvement (bsc#1251186,
  bsc#1258832).
- commit 4fde182

- net: mana: Ring doorbell at 4 CQ wraparounds (git-fixes).
- net: mana: Fix double destroy_workqueue on service rescan PCI path (git-fixes).
- PCI: hv: remove unnecessary module_init/exit functions (git-fixes).
- PCI: hv: Remove unused field pci_bus in struct hv_pcibus_device (git-fixes).
- RDMA/mana_ib: Add device-memory support (git-fixes).
- RDMA/mana_ib: Take CQ type from the device type (git-fixes).
- net: mana: Implement ndo_tx_timeout and serialize queue resets per port (bsc#1257472).
- RDMA/mana_ib: check cqe length for kernel CQs (git-fixes).
- net: mana: Fix use-after-free in reset service rescan path (git-fixes).
- Drivers: hv: fix missing kernel-doc description for 'size' in request_arr_init() (git-fixes).
- Drivers: hv: remove stale comment (git-fixes).
- net: mana: Handle hardware recovery events when probing the device (bsc#1257466).
- net: mana: Drop TX skb on post_work_request failure and unmap resources (git-fixes).
- net: mana: Handle SKB if TX SGEs exceed hardware limit (git-fixes).
- net: mana: Add standard counter rx_missed_errors (git-fixes).
- net: mana: Move hardware counter stats from per-port to per-VF context (git-fixes).
- net: mana: Support HW link state events (bsc#1253049).
- Drivers: hv: vmbus: Fix typos in vmbus_drv.c (git-fixes).
- Drivers: hv: vmbus: Fix sysfs output format for ring buffer index (git-fixes).
- Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() (git-fixes).
- scsi: storvsc: Remove redundant ternary operators (git-fixes).
- RDMA/mana_ib: Extend modify QP (git-fixes).
- RDMA/mana_ib: Drain send wrs of GSI QP (git-fixes).
- net: mana: Reduce waiting time if HWC not responding (bsc#1252266).
- RDMA/mana_ib: add support of multiple ports (bsc#1251135).
- RDMA/mana_ib: add additional port counters (bsc#1251135).
- RDMA/mana_ib: Fix DSCP value in modify QP (git-fixes).
- RDMA/mana_ib: Add device statistics support (git-fixes).
- net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes).
- net: mana: Handle Reset Request from MANA NIC (bsc#1245728 bsc#1251971).
- net: mana: Handle unsupported HWC commands (git-fixes).
- net: mana: Fix warnings for missing export.h header inclusion (git-fixes).
- PCI: hv: Remove unnecessary flex array in struct pci_packet (git-fixes).
- tools: hv: Enable debug logs for hv_kvp_daemon (git-fixes).
- net: mana: Add support for auxiliary device servicing events (bsc#1251971).
- RDMA/mana_ib: unify mana_ib functions to support any gdma device (git-fixes).
- RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic (git-fixes).
- net: mana: Probe rdma device in mana driver (git-fixes).
- RDMA/mana_ib: Add support of 4M, 1G, and 2G pages (git-fixes).
- RDMA/mana_ib: support of the zero based MRs (bsc#1251135).
- RDMA/mana_ib: Access remote atomic for MRs (bsc#1251135).
- RDMA/mana_ib: Fix integer overflow during queue creation (bsc#1251135).
- RDMA/mana_ib: Handle net event for pointing to the current netdev (bsc#1256690).
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (bsc#1256690).
- RDMA/mana_ib: Use safer allocation function() (bsc#1251135).
- RDMA/mana_ib: Implement DMABUF MR support (git-fixes).
- RDMA/mana_ib: Fix error code in probe() (git-fixes).
- RDMA/mana_ib: Add port statistics support (git-fixes).
- RDMA/mana_ib: request error CQEs when supported (git-fixes).
- RDMA/mana_ib: Query feature_flags bitmask from FW (git-fixes).
- RDMA/mana_ib: indicate CM support (git-fixes).
- RDMA/mana_ib: polling of CQs for GSI/UD (git-fixes).
- RDMA/mana_ib: extend mana QP table (git-fixes).
- RDMA/mana_ib: implement req_notify_cq (git-fixes).
- RDMA/mana_ib: UD/GSI work requests (git-fixes).
- RDMA/mana_ib: create/destroy AH (git-fixes).
- RDMA/mana_ib: UD/GSI QP creation for kernel (git-fixes).
- RDMA/mana_ib: Create and destroy UD/GSI QP (git-fixes).
- RDMA/mana_ib: create kernel-level CQs (git-fixes).
- RDMA/mana_ib: helpers to allocate kernel queues (git-fixes).
- RDMA/mana_ib: implement get_dma_mr (git-fixes).
- RDMA/mana_ib: Allow registration of DMA-mapped memory in PDs (git-fixes).
- PCI: hv: Correct a comment (git-fixes).
- net: mana: Add metadata support for xdp mode (git-fixes).
- tools/hv: reduce resource usage in hv_kvp_daemon (git-fixes).
- tools/hv: add a .gitignore file (git-fixes).
- tools/hv: reduce resouce usage in hv_get_dns_info helper (git-fixes).
- hv/hv_kvp_daemon: Pass NIC name to hv_get_dns_info as well (git-fixes).
- net: mana: use ethtool string helpers (git-fixes).
- tools: hv: lsvmbus: change shebang to use python3 (git-fixes).
- RDMA/mana_ib: Set correct device into ib (git-fixes).
- RDMA/mana_ib: Process QP error events in mana_ib (git-fixes).
- RDMA/mana_ib: extend query device (git-fixes).
- RDMA/mana_ib: set node_guid (git-fixes).
- RDMA/mana_ib: Modify QP state (git-fixes).
- RDMA/mana_ib: Implement uapi to create and destroy RC QP (git-fixes).
- RDMA/mana_ib: Create and destroy RC QP (git-fixes).
- net: mana: Use mana_cleanup_port_context() for rxq cleanup (git-fixes).
- RDMA/mana_ib: implement uapi for creation of rnic cq (git-fixes).
- RDMA/mana_ib: boundary check before installing cq callbacks (git-fixes CVE-2024-38542 bsc#1226591).
- RDMA/mana_ib: introduce a helper to remove cq callbacks (git-fixes).
- RDMA/mana_ib: create and destroy RNIC cqs (git-fixes).
- RDMA/mana_ib: create EQs for RNIC CQs (git-fixes).
- RDMA/mana_ib: Fix missing ret value (git-fixes).
- RDMA/mana_ib: Configure mac address in RNIC (git-fixes).
- RDMA/mana_ib: Adding and deleting GIDs (git-fixes).
- RDMA/mana_ib: Enable RoCE on port 1 (git-fixes).
- RDMA/mana_ib: Implement port parameters (git-fixes).
- RDMA/mana_ib: Create and destroy rnic adapter (git-fixes).
- RDMA/mana_ib: Add EQ creation for rnic adapter (git-fixes).
- RDMA/mana_ib: Use num_comp_vectors of ib_device (git-fixes).
- RDMA/mana_ib: remove useless return values from dbg prints (git-fixes).
- RDMA/mana_ib: Use struct mana_ib_queue for RAW QPs (git-fixes).
- RDMA/mana_ib: Use struct mana_ib_queue for WQs (git-fixes).
- RDMA/mana_ib: Use struct mana_ib_queue for CQs (git-fixes).
- RDMA/mana_ib: Introduce helpers to create and destroy mana queues (git-fixes).
- hv/hv_kvp_daemon: Handle IPv4 and Ipv6 combination for keyfile format (git-fixes).
- RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function (git-fixes).
- RDMA/mana_ib: Introduce mana_ib_get_netdev helper function (git-fixes).
- RDMA/mana_ib: Introduce mdev_to_gc helper function (git-fixes).
- commit 8690084

- s390/ctcm: Fix double-kfree (CVE-2025-40253 bsc#1255084).
- commit a33e581

- Update config files (bsc#1254306).
- commit 3c7bab7

- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (bsc#1254306).
- commit 165c4b3

- hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
  (git-fixes).
- hwmon: (it87) Check the it87_lock() return value (git-fixes).
- commit 29de358

- nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
  (git-fixes).
- drm/sched: Fix kernel-doc warning for drm_sched_job_done()
  (git-fixes).
- drm/solomon: Fix page start when updating rectangle in page
  addressing mode (git-fixes).
- platform/x86: dell-wmi-sysman: Don't hex dump plaintext password
  data (git-fixes).
- commit 76161b1

- tracing: Fix crash on synthetic stacktrace field usage
  (CVE-2026-23088 bsc#1257814).
- commit 5950c9c

- tracing: Do not register unsupported perf events (CVE-2025-71125
  bsc#1256784).
- commit 83b1b69

- nfc: rawsock: cancel tx_work before socket teardown (git-fixes).
- nfc: nci: clear NCI_DATA_EXCHANGE before calling completion
  callback (git-fixes).
- nfc: nci: free skb on nci_transceive early error paths
  (git-fixes).
- net: nfc: nci: Fix zero-length proprietary notifications
  (git-fixes).
- can: usb: etas_es58x: correctly anchor the urb in the read
  bulk callback (git-fixes).
- can: ucan: Fix infinite loop from zero-length messages
  (git-fixes).
- can: ems_usb: ems_usb_read_bulk_callback(): check the proper
  length of a message (git-fixes).
- can: mcp251x: fix deadlock in error path of mcp251x_open
  (git-fixes).
- can: bcm: fix locking for bcm_op runtime updates (git-fixes).
- wifi: mt76: Fix possible oob access in
  mt76_connac2_mac_write_txwi_80211() (git-fixes).
- wifi: mt76: mt7925: Fix possible oob access in
  mt7925_mac_write_txwi_80211() (git-fixes).
- wifi: mt76: mt7996: Fix possible oob access in
  mt7996_mac_write_txwi_80211() (git-fixes).
- wifi: wlcore: Fix a locking bug (git-fixes).
- wifi: cw1200: Fix locking in error paths (git-fixes).
- wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
  (git-fixes).
- batman-adv: Avoid double-rtnl_lock ELP metric worker
  (git-fixes).
- commit 502e268

- ASoC: nau8821: Cancel pending work before suspend (git-fixes).
- ASoC: nau8821: Cancel delayed work on component remove
  (git-fixes).
- commit b862c94

- spi: wpcm-fiu: Fix potential NULL pointer dereference in
  wpcm_fiu_probe() (git-fixes).
- thermal: int340x: Fix sysfs group leak on DLVR registration
  failure (stable-fixes).
- watchdog: imx7ulp_wdt: handle the nowayout option
  (stable-fixes).
- wifi: ath10k: fix lock protection in
  ath10k_wmi_event_peer_sta_ps_state_chg() (stable-fixes).
- wifi: rtw89: pci: restore LDO setting after device resume
  (stable-fixes).
- wifi: iwlwifi: mvm: check the validity of noa_len
  (stable-fixes).
- wifi: ath12k: fix preferred hardware mode calculation
  (stable-fixes).
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
  (stable-fixes).
- wifi: iwlegacy: add missing mutex protection in
  il4965_store_tx_power() (stable-fixes).
- wifi: iwlegacy: add missing mutex protection in
  il3945_store_measurement() (stable-fixes).
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN
  mode (stable-fixes).
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (stable-fixes).
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
  (stable-fixes).
- wifi: rtw88: fix DTIM period handling when conf->dtim_period
  is zero (stable-fixes).
- wifi: libertas: fix WARNING in usb_tx_block (stable-fixes).
- spi: spi-mem: Protect dirmap_create() with
  spi_mem_access_start/end (stable-fixes).
- spi: spi-mem: Limit octal DTR constraints to octal DTR
  situations (stable-fixes).
- spi: stm32: fix Overrun issue at < 8bpw (stable-fixes).
- spi-geni-qcom: initialize mode related registers to 0
  (stable-fixes).
- spi-geni-qcom: use xfer->bits_per_word for can_dma()
  (stable-fixes).
- tools/power cpupower: Reset errno before strtoull()
  (stable-fixes).
- spi: wpcm-fiu: Simplify with dev_err_probe() (stable-fixes).
- commit 9ae9cd6

- PCI: Add defines for bridge window indexing (stable-fixes).
- Refresh
  patches.suse/PCI-ACPI-Restrict-program_hpx_type2-to-AER-bits.patch.
- commit 7f99d8e

- PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros
  (stable-fixes).
- Refresh
  patches.suse/PCI-ACPI-Restrict-program_hpx_type2-to-AER-bits.patch.
- commit 8b1fafb

- media: dvb-net: fix OOB access in ULE extension header tables
  (git-fixes).
- rtc: zynqmp: correct frequency value (stable-fixes).
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
  (stable-fixes).
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
  (stable-fixes).
- net: usb: catc: enable basic endpoint checking (git-fixes).
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts
  (stable-fixes).
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
  (stable-fixes).
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded
  of NUC15) (stable-fixes).
- serial: 8250: 8250_omap.c: Clear DMA RX running status only
  after DMA termination is done (stable-fixes).
- serial: 8250_dw: handle clock enable errors in runtime_resume
  (stable-fixes).
- staging: rtl8723bs: fix memory leak on failure path
  (stable-fixes).
- staging: rtl8723bs: fix missing status update on
  sdio_alloc_irq() failure (stable-fixes).
- iio: magnetometer: Remove IRQF_ONESHOT (stable-fixes).
- iio: Use IRQF_NO_THREAD (stable-fixes).
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay
  to 5ms" (git-fixes).
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
  (git-fixes).
- misc: bcm_vk: Fix possible null-pointer dereferences in
  bcm_vk_read() (stable-fixes).
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
  (stable-fixes).
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in
  uhdlc_memclean() (git-fixes).
- nfc: nxp-nci: remove interrupt trigger type (stable-fixes).
- myri10ge: avoid uninitialized variable use (stable-fixes).
- net: usb: sr9700: remove code to drive nonexistent multicast
  filter (stable-fixes).
- net: usb: r8152: fix transmit queue timeout (stable-fixes).
- PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port
  (stable-fixes).
- PCI: Enable ACS after configuring IOMMU for OF platforms
  (stable-fixes).
- PCI: Add ACS quirk for Qualcomm Hamoa & Glymur (stable-fixes).
- PCI: Fix pci_slot_lock () device locking (stable-fixes).
- PCI: Mark Nvidia GB10 to avoid bus reset (stable-fixes).
- PCI: Mark ASM1164 SATA controller to avoid bus reset
  (stable-fixes).
- media: rkisp1: Fix filter mode register configuration
  (stable-fixes).
- media: cx25821: Fix a resource leak in cx25821_dev_setup()
  (stable-fixes).
- media: pvrusb2: fix URB leak in pvr2_send_request_ex
  (stable-fixes).
- media: solo6x10: Check for out of bounds chip_id (stable-fixes).
- media: adv7180: fix frame interval in progressive mode
  (stable-fixes).
- media: amphion: Clear last_buffer_dequeued flag for
  DEC_CMD_START (stable-fixes).
- media: omap3isp: isppreview: always clamp in
  preview_try_format() (stable-fixes).
- media: omap3isp: set initial format (stable-fixes).
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
  (stable-fixes).
- media: dvb-core: dmxdevfilter must always flush bufs
  (stable-fixes).
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
  (stable-fixes).
- HID: multitouch: add eGalaxTouch EXC3188 support (stable-fixes).
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
  (stable-fixes).
- HID: prodikeys: Check presence of pm->input_ep82 (stable-fixes).
- HID: magicmouse: Do not crash on missing msc->input
  (stable-fixes).
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple
  keyboards (stable-fixes).
- hwmon: (f71882fg) Add F81968 support (stable-fixes).
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (stable-fixes).
- gpio: aspeed-sgpio: Change the macro to support deferred probe
  (stable-fixes).
- PCI/MSI: Unmap MSI-X region on error (stable-fixes).
- i3c: master: svc: Initialize 'dev' to NULL in
  svc_i3c_master_ibi_isr() (stable-fixes).
- spi: wpcm-fiu: Fix uninitialized res (git-fixes).
- spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname()
  (stable-fixes).
- PCI: Log bridge info when first enumerating bridge
  (stable-fixes).
- PCI: Log bridge windows conditionally (stable-fixes).
- PCI: Supply bridge device, not secondary bus, to read window
  details (stable-fixes).
- PCI: Move pci_read_bridge_windows() below individual window
  accessors (stable-fixes).
- commit 291a680

- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
  (stable-fixes).
- drm/amdgpu: Add HAINAN clock adjustment (stable-fixes).
- drm/radeon: Add HAINAN clock adjustment (stable-fixes).
- drm/amdgpu: Adjust usleep_range in fence wait (stable-fixes).
- drm/amdkfd: Fix watch_id bounds checking in debug address
  watch v2 (git-fixes).
- drm/amd/display: Avoid updating surface with the same surface
  under MPO (stable-fixes).
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
  (stable-fixes).
- dma: dma-axi-dmac: fix SW cyclic transfers (git-fixes).
- dmaengine: sun6i: Choose appropriate burst length under maxburst
  (stable-fixes).
- fpga: of-fpga-region: Fail if any bridge is missing
  (stable-fixes).
- fix it87_wdt early reboot by reporting running timer
  (stable-fixes).
- fbdev: ffb: fix corrupted video output on Sun FFB1
  (stable-fixes).
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS
  (stable-fixes).
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU
  (stable-fixes).
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (stable-fixes).
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections
  (stable-fixes).
- Bluetooth: hci_conn: use mod_delayed_work for active mode
  timeout (stable-fixes).
- drm/atmel-hlcdc: don't reject the commit if the src rect has
  fractional parts (stable-fixes).
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after
  release (stable-fixes).
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state
  callback (stable-fixes).
- drm: Account property blob allocations to memcg (stable-fixes).
- drm/amdkfd: Fix GART PTE for non-4K pagesize in
  svm_migrate_gart_map() (stable-fixes).
- drm/amdgpu: avoid a warning in timedout job handler
  (stable-fixes).
- drm/amdgpu: add support for HDP IP version 6.1.1 (stable-fixes).
- drm/v3d: Set DMA segment size to avoid debug warnings
  (stable-fixes).
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
  (stable-fixes).
- drm/display/dp_mst: Add protection against 0 vcpi
  (stable-fixes).
- ASoC: codecs: max98390: Check return value of
  devm_gpiod_get_optional() in max98390_i2c_probe()
  (stable-fixes).
- ASoC: sunxi: sun50i-dmic: Add missing check for
  devm_regmap_init_mmio (stable-fixes).
- ASoC: wm8962: Don't report a microphone if it's shorted to
  ground on plug (stable-fixes).
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
  (stable-fixes).
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (git-fixes).
- char: tpm: cr50: Remove IRQF_ONESHOT (stable-fixes).
- docs: fix WARNING document not included in any toctree
  (stable-fixes).
- drm/amdkfd: fix debug watchpoints for logical devices
  (stable-fixes).
- commit 0c8127e

- ASoC: nau8821: Consistently clear interrupts before unmasking
  (git-fixes).
- Refresh
  patches.suse/ASoC-nau8821-Add-DMI-quirk-to-bypass-jack-debounce-c.patch.
- commit abf4286

- ALSA: usb-audio: Add sanity check for OOB writes at silencing
  (stable-fixes).
- ALSA: usb-audio: Update the number of packets properly at
  receiving (stable-fixes).
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X
  USB Audio (stable-fixes).
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie
  15X Pro (stable-fixes).
- APEI/GHES: ensure that won't go past CPER allocated record
  (stable-fixes).
- ACPI: processor: Fix NULL-pointer dereference in
  acpi_processor_errata_piix4() (stable-fixes).
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
  (stable-fixes).
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
  (stable-fixes).
- commit d3af28a

- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  (CVE-2026-23169 bsc#1258389).
- commit fdf82e1

- net: fix segmentation of forwarding fraglist GRO (CVE-2026-23154
  bsc#1258286).
- commit fa03082

- net/sched: ets: Always remove class from active list before
  deleting in ets_qdisc_change (CVE-2025-71066 bsc#1256645).
- commit bd83957

- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755, CVE-2026-23069).
- Refresh
  patches.suse/vsock-virtio-cap-TX-credit-to-local-buffer-size.patch.
- commit aab63d9

- net/sched: cls_u32: use skb_header_pointer_careful()
  (CVE-2026-23204 bsc#1258340).
  In addition backport 13e00fdc9236b which introduces
  skb_header_pointer_careful() helper which is required.
- commit 926e136

- cifs: add xid to query server interface call (git-fixes).
- Refresh
  patches.suse/cifs-handle-when-server-starts-supporting-multichannel.patch.
- Refresh
  patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch
  (bsc#1258928,bsc#1259070).
- Refresh
  patches.suse/cifs-do-not-disable-interface-polling-on-failure.patch.
- Refresh
  patches.suse/cifs-add-xid-to-query-server-interface-call.patch.
- commit e67e831

- iommu/mediatek: fix use-after-free on probe deferral
  (CVE-2025-71071 bsc#1256802).
- commit 0b777d9

- bpf: Forget ranges when refining tnum after JSET (CVE-2025-39748
  bsc#1249587).
- commit 9bb0920

- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
  (bsc#1249998 CVE-2025-39817).
- commit ccf2d31

- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  (CVE-2026-23113 bsc#1258278).
- commit 2e91927

- libceph: replace BUG_ON with bounds check for map->max_osd (CVE-2025-68283 bsc#1255379).
- commit 1c35b41

- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  (CVE-2026-23179 bsc#1258394).
- commit 63de389

- btrfs: don't log conflicting inode if it's a dir moved in the
  current transaction (bsc#1256683 CVE-2025-68778).
- commit 0cd8ff8

- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  (CVE-2026-23112 bsc#1258184).
- commit e38d2c3

- landlock: Fix handling of disconnected directories (CVE-2025-68736 bsc#1255698).
- commit cdf3815

- landlock: Optimize file path walks and prepare for audit support (bsc#1255698).
- commit 5db1b51

- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask
  for 8mq vpu (CVE-2026-23116 bsc#1258277).
- commit 1905ad8

- Add bugnumber to existing mana change (bsc#1251971).
- scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (git-fixes).
- commit 425b20d

- bonding: fix use-after-free due to enslave fail after slave
  array update (CVE-2026-23171 bsc#1258349).
- bonding: provide a net pointer to __skb_flow_dissect()
  (CVE-2026-23119 bsc#1258273).
- fou: Don't allow 0 for FOU_ATTR_IPPROTO (CVE-2026-23083
  bsc#1257745).
- bonding: limit BOND_MODE_8023AD to Ethernet devices
  (CVE-2026-23099 bsc#1257816).
- net: bonding: update the slave array for broadcast mode
  (CVE-2026-23171 bsc#1258349).
- commit d461cd4

- Update
  patches.suse/btrfs-do-not-strictly-require-dirty-metadata-thresho.patch
  (stable-fixes CVE-2026-23157 bsc#1258376).
- Update
  patches.suse/msft-hv-3440-net-hv_netvsc-reject-RSS-hash-key-programming-withou.patch
  (bsc#1257473 CVE-2026-23054 bsc#1257732).
- Update
  patches.suse/spi-tegra210-quad-Protect-curr_xfer-check-in-IRQ-handler.patch
  (bsc#1257952 CVE-2026-23207 bsc#1258524).
- Update
  patches.suse/spi-tegra210-quad-Protect-curr_xfer-in-tegra_qspi_combined.patch
  (bsc#1257952 CVE-2026-23202 bsc#1258338).
- commit 9f4fee7

- Update
  patches.suse/ALSA-ac97-fix-a-double-free-in-snd_ac97_controller_r.patch
  (git-fixes CVE-2025-71192 bsc#1257679).
- Update
  patches.suse/ALSA-ctxfi-Fix-potential-OOB-access-in-audio-mixer-h.patch
  (stable-fixes CVE-2026-23076 bsc#1257788).
- Update
  patches.suse/ALSA-scarlett2-Fix-buffer-overflow-in-config-retriev.patch
  (git-fixes CVE-2026-23078 bsc#1257789).
- Update
  patches.suse/ASoC-amd-fix-memory-leak-in-acp3x-pdm-dma-ops.patch
  (git-fixes CVE-2026-23190 bsc#1258397).
- Update
  patches.suse/Bluetooth-MGMT-Fix-memory-leak-in-set_ssp_complete.patch
  (git-fixes CVE-2026-23151 bsc#1258237).
- Update
  patches.suse/Bluetooth-hci_uart-fix-null-ptr-deref-in-hci_uart_wr.patch
  (git-fixes CVE-2026-23146 bsc#1258234).
- Update
  patches.suse/HID-i2c-hid-fix-potential-buffer-overflow-in-i2c_hid.patch
  (stable-fixes CVE-2026-23178 bsc#1258358).
- Update
  patches.suse/bus-fsl-mc-fix-use-after-free-in-driver_override_sho.patch
  (git-fixes CVE-2026-23221 bsc#1258660).
- Update
  patches.suse/can-ems_usb-ems_usb_read_bulk_callback-fix-URB-memor.patch
  (git-fixes CVE-2026-23058 bsc#1257739).
- Update
  patches.suse/can-etas_es58x-allow-partial-RX-URB-allocation-to-su.patch
  (git-fixes CVE-2026-23037 bsc#1257554).
- Update
  patches.suse/can-gs_usb-gs_usb_receive_bulk_callback-fix-error-me.patch
  (git-fixes CVE-2026-23155 bsc#1258313).
- Update
  patches.suse/can-gs_usb-gs_usb_receive_bulk_callback-unanchor-URL.patch
  (git-fixes CVE-2026-23082 bsc#1257715).
- Update
  patches.suse/can-j1939-make-j1939_session_activate-fail-if-device.patch
  (stable-fixes CVE-2025-71182 bsc#1257586).
- Update
  patches.suse/can-kvaser_usb-kvaser_usb_read_bulk_callback-fix-URB.patch
  (git-fixes CVE-2026-23061 bsc#1257776).
- Update
  patches.suse/can-mcba_usb-mcba_usb_read_bulk_callback-fix-URB-mem.patch
  (git-fixes CVE-2026-23080 bsc#1257714).
- Update
  patches.suse/can-usb_8dev-usb_8dev_read_bulk_callback-fix-URB-mem.patch
  (git-fixes CVE-2026-23108 bsc#1257770).
- Update
  patches.suse/crypto-iaa-Fix-out-of-bounds-index-in-find_empty_iaa.patch
  (git-fixes CVE-2025-71231 bsc#1258424).
- Update
  patches.suse/crypto-omap-Allocate-OMAP_CRYPTO_FORCE_COPY-scatterl.patch
  (git-fixes CVE-2026-23222 bsc#1258484).
- Update
  patches.suse/crypto-virtio-Add-spinlock-protection-with-virtqueue.patch
  (git-fixes CVE-2026-23229 bsc#1258429).
- Update
  patches.suse/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch
  (git-fixes CVE-2025-71191 bsc#1257579).
- Update
  patches.suse/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch
  (git-fixes CVE-2025-71190 bsc#1257580).
- Update
  patches.suse/dmaengine-dw-dmamux-fix-OF-node-leak-on-route-alloca.patch
  (git-fixes CVE-2025-71189 bsc#1257573).
- Update
  patches.suse/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-al.patch
  (git-fixes CVE-2025-71188 bsc#1257576).
- Update
  patches.suse/dmaengine-omap-dma-fix-dma_pool-resource-leak-in-err.patch
  (git-fixes CVE-2026-23033 bsc#1257570).
- Update
  patches.suse/dmaengine-qcom-gpi-Fix-memory-leak-in-gpi_peripheral.patch
  (git-fixes CVE-2026-23026 bsc#1257562).
- Update
  patches.suse/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-.patch
  (git-fixes CVE-2025-71185 bsc#1257560).
- Update
  patches.suse/dmaengine-xilinx-xdma-Fix-regmap-max_register.patch
  (git-fixes CVE-2025-71195 bsc#1257704).
- Update patches.suse/dpll-Prevent-duplicate-registrations.patch
  (git-fixes CVE-2026-23129 bsc#1258299).
- Update
  patches.suse/drm-amdgpu-fix-NULL-pointer-dereference-in-amdgpu_gm.patch
  (git-fixes CVE-2026-23163 bsc#1258544).
- Update patches.suse/drm-imx-tve-fix-probe-device-leak.patch
  (git-fixes CVE-2026-23170 bsc#1258379).
- Update
  patches.suse/drm-panel-simple-fix-connector-type-for-DataImage-SC.patch
  (git-fixes CVE-2026-23049 bsc#1257723).
- Update
  patches.suse/efivarfs-fix-error-propagation-in-efivar_entry_get.patch
  (git-fixes CVE-2026-23156 bsc#1258317).
- Update
  patches.suse/ext4-fix-iloc.bh-leak-in-ext4_xattr_inode_update_ref.patch
  (git-fixes CVE-2026-23145 bsc#1258326).
- Update
  patches.suse/iio-adc-at91-sama5d2_adc-Fix-potential-use-after-fre.patch
  (git-fixes CVE-2025-71199 bsc#1257750).
- Update
  patches.suse/iio-imu-st_lsm6dsx-fix-iio_chan_spec-for-sensors-wit.patch
  (git-fixes CVE-2025-71198 bsc#1257741).
- Update
  patches.suse/intel_th-fix-device-leak-on-output-open.patch
  (git-fixes CVE-2026-23091 bsc#1257813).
- Update
  patches.suse/leds-led-class-Only-Add-LED-to-leds_list-when-it-is-.patch
  (git-fixes CVE-2026-23101 bsc#1257768).
- Update
  patches.suse/mISDN-annotate-data-race-around-dev-work.patch
  (git-fixes CVE-2026-23121 bsc#1258309).
- Update
  patches.suse/mmc-sdhci-of-dwcmshc-Prevent-illegal-clock-reduction.patch
  (git-fixes CVE-2025-71200 bsc#1258222).
- Update
  patches.suse/net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch
  (git-fixes CVE-2026-23021 bsc#1257557).
- Update
  patches.suse/net-wwan-t7xx-fix-potential-skb-frags-overflow-in-RX.patch
  (git-fixes CVE-2026-23172 bsc#1258519).
- Update
  patches.suse/nfc-llcp-Fix-memleak-in-nfc_llcp_send_ui_frame.patch
  (git-fixes CVE-2026-23150 bsc#1258354).
- Update
  patches.suse/nfc-nci-Fix-race-between-rfkill-and-nci_unregister_d.patch
  (git-fixes CVE-2026-23167 bsc#1258374).
- Update
  patches.suse/phy-stm32-usphyc-Fix-off-by-one-in-probe.patch
  (git-fixes CVE-2025-71196 bsc#1257716).
- Update
  patches.suse/platform-x86-toshiba_haps-Fix-memory-leaks-in-add-re.patch
  (git-fixes CVE-2026-23176 bsc#1258256).
- Update
  patches.suse/regmap-Fix-race-condition-in-hwspinlock-irqsave-rout.patch
  (git-fixes CVE-2026-23071 bsc#1257706).
- Update
  patches.suse/scsi-qla2xxx-Delay-module-unload-while-fabric-scan-i.patch
  (bsc#1256863 CVE-2025-71235 bsc#1258469).
- Update
  patches.suse/scsi-qla2xxx-Free-sp-in-error-path-to-fix-system-cra.patch
  (bsc#1256863 CVE-2025-71232 bsc#1258422).
- Update
  patches.suse/scsi-qla2xxx-Validate-sp-before-freeing-associated-m.patch
  (bsc#1256863 CVE-2025-71236 bsc#1258442).
- Update
  patches.suse/slimbus-core-fix-device-reference-leak-on-report-pre.patch
  (git-fixes CVE-2026-23090 bsc#1257759).
- Update
  patches.suse/spi-spi-sprd-adi-Fix-double-free-in-probe-error-path.patch
  (git-fixes CVE-2026-23068 bsc#1257805).
- Update
  patches.suse/spi-tegra-Fix-a-memory-leak-in-tegra_slink_probe.patch
  (git-fixes CVE-2026-23182 bsc#1258259).
- Update
  patches.suse/spi-tegra210-quad-Protect-curr_xfer-check-in-IRQ-han.patch
  (git-fixes bsc#1257952 CVE-2026-23207 bsc#1258524).
- Update
  patches.suse/spi-tegra210-quad-Protect-curr_xfer-in-tegra_qspi_co.patch
  (git-fixes bsc#1257952 CVE-2026-23202 bsc#1258338).
- Update
  patches.suse/uacce-ensure-safe-queue-release-with-state-managemen.patch
  (git-fixes CVE-2026-23063 bsc#1257722).
- Update
  patches.suse/uacce-fix-cdev-handling-in-the-cleanup-path.patch
  (git-fixes CVE-2026-23096 bsc#1257809).
- Update
  patches.suse/uacce-fix-isolate-sysfs-check-condition.patch
  (git-fixes CVE-2026-23094 bsc#1257811).
- Update
  patches.suse/uacce-implement-mremap-in-uacce_vm_ops-to-return-EPE.patch
  (git-fixes CVE-2026-23056 bsc#1257729).
- Update
  patches.suse/w1-therm-Fix-off-by-one-buffer-overflow-in-alarms_st.patch
  (git-fixes CVE-2025-71197 bsc#1257743).
- Update
  patches.suse/wifi-ath10k-fix-dma_free_coherent-pointer.patch
  (git-fixes CVE-2026-23133 bsc#1258249).
- Update
  patches.suse/wifi-ath12k-fix-dma_free_coherent-pointer.patch
  (git-fixes CVE-2026-23135 bsc#1258245).
- Update
  patches.suse/wifi-mac80211-correctly-decode-TTLM-with-default-lin.patch
  (git-fixes CVE-2026-23152 bsc#1258252).
- Update
  patches.suse/wifi-mac80211-ocb-skip-rx_no_sta-when-interface-is-n.patch
  (stable-fixes CVE-2025-71224 bsc#1258824).
- Update
  patches.suse/wifi-rsi-Fix-memory-corruption-due-to-not-set-vif-dr.patch
  (git-fixes CVE-2026-23073 bsc#1257707).
- Update
  patches.suse/wifi-rtl8xxxu-fix-slab-out-of-bounds-in-rtl8xxxu_sta.patch
  (git-fixes CVE-2025-71234 bsc#1258419).
- Update
  patches.suse/wifi-rtw88-Fix-alignment-fault-in-rtw_core_enable_be.patch
  (git-fixes CVE-2025-71229 bsc#1258415).
- Update
  patches.suse/wifi-wlcore-ensure-skb-headroom-before-skb_push.patch
  (stable-fixes CVE-2025-71222 bsc#1258279).
- commit 30080c1

- smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924,
  CVE-2025-40103).
- commit 2028384

- cifs: parse_dfs_referrals: prevent oob on malformed input
  (bsc#1252911, CVE-2025-40099).
- commit 821259f

- Refresh
  patches.suse/smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-RMW-rac.patch.
- commit 1325cd1

- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
  (CVE-2026-23166 bsc#1258272).
- net/mlx5e: TC, delete flows only for existing peers
  (CVE-2026-23173 bsc#1258520).
- commit 1315a36

- device property: Allow secondary lookup in
  fwnode_get_next_child_node() (git-fixes).
- commit 13b0bcb

- ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB
  Audio 2.0 (stable-fixes).
- ALSA: usb-audio: Check max frame size for implicit feedback
  mode, too (stable-fixes).
- commit 94dd673

- PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value (git-fixes).
- mmc: mmci: Fix device_node reference leak in
  of_get_dml_pipe_index() (git-fixes).
- ALSA: usb-audio: Use correct version for UAC3 header validation
  (git-fixes).
- ALSA: usb-audio: Use inclusive terms (git-fixes).
- ALSA: usb-audio: Cap the packet size pre-calculations
  (git-fixes).
- ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite
  devices (git-fixes).
- drm/bridge: samsung-dsim: Fix memory leak in error path
  (git-fixes).
- drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
  (git-fixes).
- drm/logicvc: Fix device node reference leak in
  logicvc_drm_config_parse() (git-fixes).
- drm/vmwgfx: Return the correct value in vmw_translate_ptr
  functions (git-fixes).
- drm/vmwgfx: Fix invalid kref_put callback in
  vmw_bo_dirty_release (git-fixes).
- commit b1fa310

- scsi: core: Wake up the error handler when final completions
  race against each other (CVE-2026-23110 bsc#1257761).
- commit 59f5efa

- dst: fix races in rt6_uncached_list_del() and
  rt_del_uncached_list() (CVE-2026-23004 bsc#1257231).
- commit 3cd007f

- btrfs: fix NULL dereference on root when tracing inode eviction
  (bsc#1257635 CVE-2025-71184).
- commit 5bf422c

- netfilter: nf_conncount: update last_gc only when GC has been
  performed (CVE-2026-23139 bsc#1258304).
- commit 9a70b26

- netfilter: nf_tables: fix inverted genmask check in
  nft_map_catchall_activate() (CVE-2026-23111 bsc#1258181).
- commit 56db8af

- ipmi: ipmb: initialise event handler read bytes (git-fixes).
- wifi: mac80211: fix NULL pointer dereference in
  mesh_rx_csa_frame() (git-fixes).
- wifi: mac80211: bounds-check link_id in
  ieee80211_ml_reconfiguration (git-fixes).
- wifi: radiotap: reject radiotap with unknown bits (git-fixes).
- wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
  (git-fixes).
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (git-fixes).
- net: usb: kaweth: validate USB endpoints (git-fixes).
- net: usb: kalmia: validate USB endpoints (git-fixes).
- nfc: pn533: properly drop the usb interface reference on
  disconnect (git-fixes).
- Bluetooth: L2CAP: Fix missing key size check for
  L2CAP_LE_CONN_REQ (git-fixes).
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable
  on L2CAP_ECRED_CONN_REQ (git-fixes).
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
  (git-fixes).
- Bluetooth: hci_qca: Cleanup on all setup failures (git-fixes).
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
  (git-fixes).
- net: usb: pegasus: enable basic endpoint checking (git-fixes).
- net: wan: farsync: Fix use-after-free bugs caused by unfinished
  tasklets (git-fixes).
- net: usb: lan78xx: scan all MDIO addresses on LAN7801
  (git-fixes).
- net: usb: kaweth: remove TX queue manipulation in
  kaweth_set_rx_mode (git-fixes).
- commit d2c7de0

- btrfs: fix deadlock in wait_current_trans() due to ignored
  transaction type (bsc#1257687 CVE-2025-71194).
- commit 2e0cb69

- drm/amdgpu: ensure no_hw_access is visible before MMIO
  (CVE-2026-23213 bsc#1258465).
- commit bec3979

- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
  (CVE-2026-23213 bsc#1258465).
- commit 3b81ead

- media: dvb-core: fix wrong reinitialization of ringbuffer on
  reopen (git-fixes).
- commit ba51966

- NFS: Fix a deadlock involving nfs_release_folio()
  (CVE-2026-23053 bsc#1257718).
- commit 492ba43

- KVM: Don't clobber irqfd routing type when deassigning irqfd
  (CVE-2026-23198 bsc#1258321).
- commit e973f50

- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing
  memslot (CVE-2025-68810 bsc#1256679).
- commit a9c2c12

- md: suspend array while updating raid_disks via sysfs
  (CVE-2025-71225, bsc#1258411).
- commit 22f1953

- smb: client: fix memory leak in cifs_construct_tcon()
  (bsc#1255129, CVE-2025-68295).
- commit 069aa1f

- Refresh
  patches.suse/smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-RMW-rac.patch.
- commit f42de87

- Move upstreamed mm and SCSI patches into sorted section
- commit 2b576e9

- btrfs: send: check for inline extents in
  range_is_hole_in_parent() (bsc#1258377 CVE-2026-23141).
- commit b93c18b

- btrfs: reject new transactions if the fs is fully read-only
  (bsc#1258464 CVE-2026-23214).
- commit c375a48

- net: fix memory leak in skb_segment_list for GRO packets
  (CVE-2026-22979 bsc#1257228).
- commit 59160d7

- rpm/check-for-config-changes: add OPENSSL_SUPPORTS_ to IGNORED_CONFIGS_RE
  Config option OPENSSL_SUPPORTS_ML_DSA was introduced by mainline commit
  0ad9a71933e7 ("modsign: Enable ML-DSA module signing") in 7.0-rc1
- commit 21b4616

- macvlan: observe an RCU grace period in macvlan_common_newlink()
  error path (CVE-2026-23209 bsc#1258518).
- macvlan: fix error recovery in macvlan_common_newlink()
  (CVE-2026-23209 bsc#1258518).
- commit eaf1535

- bonding: only set speed/duplex to unknown, if getting speed
  failed (bsc#1253691).
- commit 0b66a07

- rtc: interface: Alarm race handling should not discard preceding
  error (git-fixes).
- commit f96272c

- NTB: ntb_transport: Fix too small buffer for debugfs_name
  (git-fixes).
- commit 269c576

- ALSA: usb-audio: Use the right limit for PCM OOB check
  (CVE-2026-23208 bsc#1258468).
- ALSA: usb-audio: Prevent excessive number of frames
  (CVE-2026-23208 bsc#1258468).
- commit 895c473

- ASoC: rockchip: i2s-tdm: Use param rate if not provided by
  set_sysclk (git-fixes).
- drm/amd/display: Use same max plane scaling limits for all 64
  bpp formats (git-fixes).
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
  (git-fixes).
- drm/i915/acpi: free _DSM package when no connectors (git-fixes).
- drm/amd: Fix hang on amdgpu unload by using
  pci_dev_is_disconnected() (git-fixes).
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (git-fixes).
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
  (git-fixes).
- efi: Fix reservation of unaccepted memory table (git-fixes).
- commit 2183b13

- scsi: mpi3mr: Synchronous access b/w reset and tm thread for
  reply queue (CVE-2025-37861 bsc#1243055).
- commit 807000c

- net: nfc: nci: Fix parameter validation for packet data
  (git-fixes).
- atm: fore200e: fix use-after-free in tasklets during device
  removal (git-fixes).
- USB: serial: option: add Telit FN920C04 RNDIS compositions
  (stable-fixes).
- fbdev: smscufx: properly copy ioctl memory to kernelspace
  (stable-fixes).
- bus: fsl-mc: fix use-after-free in driver_override_show()
  (git-fixes).
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (stable-fixes).
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
  (stable-fixes).
- platform/x86: classmate-laptop: Add missing NULL pointer checks
  (stable-fixes).
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro
  (stable-fixes).
- platform/x86: panasonic-laptop: Fix sysfs group leak in error
  path (stable-fixes).
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock
  (stable-fixes).
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not
  used (stable-fixes).
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in
  sysfs show functions (stable-fixes).
- commit 436dcdb

- config.conf: Drop armv7hl builds
  commit 09ee386c4ae dropped support for armv7hl
  in SLE15-SP7, SUSE-2024 never supported it,
  therefore, no branch downstream of fixes/linux-6.4
  supports this arch (bsc#1255265).
- commit 5dc5aaf

- ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191
  bsc#1258395).
- commit 114f0d2

- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online
  CPUs (git-fixes).
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
  (git-fixes).
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version
  check (git-fixes).
- PM: sleep: wakeirq: Update outdated documentation comments
  (git-fixes).
- commit 700df2d

- crypto: authencesn - reject too-short AAD (assoclen<8) to
  match ESP/ESN spec (bsc#1257735 CVE-2026-23060).
- commit 9347d8b

- crypto: af_alg - zero initialize memory allocated via
  sock_kmalloc (bsc#1256716 CVE-2025-71113).
- commit 449e0ae

- crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
  (bsc#1254992 CVE-2023-53817).
- commit f8259ad

- gue: Fix skb memleak with inner IP protocol 0 (CVE-2026-23095
  bsc#1257808).
- commit e8190a1

- vsock/virtio: cap TX credit to local buffer size (CVE-2026-23086
  bsc#1257757).
- commit 2a01723

- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
  (bsc#1251966 CVE-2025-39964).
- commit 2a9a19a

- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
  (bsc#1251966 CVE-2025-39964).
  Refresh patches.suse/crypto-add-suse_kabi_padding.patch.
- commit a6b1063

- Workaround for hybrid git workflow in SLFO 1.0/1.1
- commit 7ab5a74

- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
  (git-fixes).
- usb: dwc2: fix resume failure if dr_mode is host (git-fixes).
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
  (git-fixes).
- usb: bdc: fix sleep during atomic (git-fixes).
- serial: SH_SCI: improve "DMA support" prompt (git-fixes).
- serial: imx: change SERIAL_IMX_CONSOLE to bool (git-fixes).
- staging: rtl8723bs: fix null dereference in find_network
  (git-fixes).
- iio: sca3000: Fix a resource leak in sca3000_probe()
  (git-fixes).
- iio: gyro: itg3200: Fix unchecked return value in read_raw
  (git-fixes).
- drivers: iio: mpu3050: use dev_err_probe for regulator request
  (git-fixes).
- fpga: dfl: use subsys_initcall to allow built-in drivers to
  be added (git-fixes).
- commit e89b2ea

- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
  (CVE-2026-23084 bsc#1257830).
- commit 27fe347

- leds: qcom-lpg: Check the return value of regmap_bulk_write()
  (git-fixes).
- backlight: qcom-wled: Change PM8950 WLED configurations
  (git-fixes).
- backlight: qcom-wled: Support ovp values for PMI8994
  (git-fixes).
- mfd: arizona: Fix regulator resource leak on
  wm5102_clear_write_sequencer() failure (git-fixes).
- mfd: core: Add locking around 'mfd_of_node_list' (git-fixes).
- mfd: tps6105x: Fix kernel-doc warnings relating to the core
  struct and tps6105x_mode (git-fixes).
- Revert "mfd: da9052-spi: Change read-mask to write-mask"
  (stable-fixes).
- pinctrl: single: fix refcount leak in pcs_add_gpio_func()
  (git-fixes).
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
  (git-fixes).
- pinctrl: equilibrium: Fix device node reference leak in
  pinbank_init() (git-fixes).
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
  (stable-fixes).
- commit 516fe60

- Input: stmfts - make comments correct (git-fixes).
- Input: stmfts - correct wording for the warning message
  (git-fixes).
- clk: qcom: gfx3d: add parent to parent request map (git-fixes).
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
  (git-fixes).
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
  (git-fixes).
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
  (git-fixes).
- clk: qcom: rcg2: compute 2d using duty fraction directly
  (git-fixes).
- clk: mediatek: Fix error handling in runtime PM setup
  (git-fixes).
- clk: meson: g12a: Limit the HDMI PLL OD to /4 (git-fixes).
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
  (git-fixes).
- clk: tegra: tegra124-emc: Fix potential memory leak in
  tegra124_clk_register_emc() (git-fixes).
- clk: tegra: tegra124-emc: fix device leak on set_rate()
  (git-fixes).
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible
  (git-fixes).
- clk: renesas: rzg2l: Select correct div round macro (git-fixes).
- clk: renesas: rzg2l: Fix intin variable size (git-fixes).
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
  (git-fixes).
- fbdev: of: display_timing: fix refcount leak in
  of_get_display_timings() (git-fixes).
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (git-fixes).
- fbcon: check return value of con2fb_acquire_newinfo()
  (git-fixes).
- fbdev: rivafb: fix divide error in nv3_arb() (git-fixes).
- rpmsg: core: fix race in driver_override_show() and use core
  helper (git-fixes).
- commit b135afb

- Update "drm/mgag200: fix mgag200_bmc_stop_scanout()" bug number (bsc#1258153)
- commit 2fe2c66

- crypto: ccp - Add an S4 restore flow (git-fixes).
- tools/power/x86/intel-speed-select: Fix file descriptor leak
  in isolate_cpus() (git-fixes).
- mtd: rawnand: pl353: Fix software ECC support (git-fixes).
- mtd: spinand: Fix kernel doc (git-fixes).
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait
  helper (git-fixes).
- mtd: parsers: ofpart: fix OF node refcount leak in
  parse_fixed_partitions() (git-fixes).
- mtd: parsers: Fix memory leak in
  mtd_parser_tplink_safeloader_parse() (git-fixes).
- commit 766aa67

- ice: fix devlink reload call trace (CVE-2026-23104 bsc#1257763).
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
  (CVE-2026-23035 bsc#1257559).
- idpf: fix error handling in the init_task on load
  (CVE-2026-23017 bsc#1257552).
- commit fb93c36

- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer
  (git-fixes).
- power: supply: wm97xx: Fix NULL pointer dereference in
  power_supply_changed() (git-fixes).
- power: supply: bq27xxx: fix wrong errno when bus ops are
  unsupported (git-fixes).
- power: reset: nvmem-reboot-mode: respect cell size for
  nvmem_cell_write (git-fixes).
- power: supply: sbs-battery: Fix use-after-free in
  power_supply_changed() (git-fixes).
- power: supply: rt9455: Fix use-after-free in
  power_supply_changed() (git-fixes).
- power: supply: goldfish: Fix use-after-free in
  power_supply_changed() (git-fixes).
- power: supply: cpcap-battery: Fix use-after-free in
  power_supply_changed() (git-fixes).
- power: supply: bq25980: Fix use-after-free in
  power_supply_changed() (git-fixes).
- power: supply: bq256xx: Fix use-after-free in
  power_supply_changed() (git-fixes).
- power: supply: act8945a: Fix use-after-free in
  power_supply_changed() (git-fixes).
- power: supply: ab8500: Fix use-after-free in
  power_supply_changed() (git-fixes).
- ata: pata_ftide010: Fix some DMA timings (git-fixes).
- rapidio: replace rio_free_net() with kfree() in
  rio_scan_alloc_net() (git-fixes).
- commit 46137a2

- dst: fix races in rt6_uncached_list_del() and
  rt_del_uncached_list() (CVE-2026-23004 bsc#1257231).
- commit 75a3dd5

- net/sched: act_ife: avoid possible NULL deref (CVE-2026-23064
  bsc#1257765).
- net/sched: qfq: Use cl_is_active to determine whether class
  is active in qfq_rm_from_ag (CVE-2026-23105 bsc#1257775).
- commit a17643b

- Update upstreamed net and powerpc patch references and sorting
- commit 638a424

- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708, CVE-2025-71104).
- commit 1d88ad6

- vsock/virtio: Coalesce only linear skb (bsc#1257740, CVE-2026-23057).
- commit 09262b6

- nvme-tcp: fix NULL pointer dereferences in
  nvmet_tcp_build_pdu_iovec (CVE-2026-22998 bsc#1257209).
- commit f5cd5c5

- wifi: ath10k: sdio: add missing lock protection in
  ath10k_sdio_fw_crashed_dump() (git-fixes).
- wifi: ath9k: fix kernel-doc warnings in common-debug.h
  (git-fixes).
- wifi: ath9k: debug.h: fix kernel-doc bad lines and struct
  ath_tx_stats (git-fixes).
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (git-fixes).
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
  (git-fixes).
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
  (git-fixes).
- wifi: cfg80211: Fix use_for flag update on BSS refresh
  (git-fixes).
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
  (git-fixes).
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
  cmd_db_dev_probe (git-fixes).
- soc: qcom: smem: handle ENOMEM error during probe (git-fixes).
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt
  twice (stable-fixes).
- wifi: mac80211: correctly check if CSA is active (stable-fixes).
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates
  (stable-fixes).
- wifi: mac80211: collect station statistics earlier when
  disconnect (stable-fixes).
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
  (stable-fixes).
- wifi: wlcore: ensure skb headroom before skb_push
  (stable-fixes).
- commit 7dd6fbf

- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
  (git-fixes).
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
  (git-fixes).
- PCI: Fix pci_slot_trylock() error handling (git-fixes).
- PCI/portdrv: Fix potential resource leak (git-fixes).
- PCI/PM: Avoid redundant delays on D3hot->D3cold (git-fixes).
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page()
  fails (git-fixes).
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
  (git-fixes).
- Revert "PCI/IOV: Add PCI rescan-remove locking when
  enabling/disabling SR-IOV" (git-fixes).
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (git-fixes).
- PCI: Initialize RCB from pci_configure_device() (git-fixes).
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
  (git-fixes).
- regulator: core: move supply check earlier in
  set_machine_constraints() (git-fixes).
- regulator: core: fix locking in regulator_resolve_supply()
  error path (git-fixes).
- platform/chrome: cros_ec_lightbar: Fix response size
  initialization (git-fixes).
- platform/chrome: cros_typec_switch: Don't touch struct
  fwnode_handle::dev (git-fixes).
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
  (git-fixes).
- soc: ti: k3-socinfo: Fix regmap leak on probe failure
  (git-fixes).
- regmap: maple: free entry on mas_store_gfp() failure
  (stable-fixes).
- commit 5d29d16

- nfc: hci: shdlc: Stop timers and work before freeing context
  (git-fixes).
- PCI: Do not attempt to set ExtTag for VFs (git-fixes).
- PCI: endpoint: Fix swapped parameters in
  pci_{primary/secondary}_epc_epf_unlink() functions (git-fixes).
- media: uvcvideo: Fix allocation for small frame sizes
  (git-fixes).
- media: venus: vdec: fix error state assignment for zero
  bytesused (git-fixes).
- media: ccs: Accommodate C-PHY into the calculation (git-fixes).
- media: i2c: ov5647: use our own mutex for the ctrl lock
  (git-fixes).
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
  (git-fixes).
- media: i2c: ov5647: Sensor should report RAW color space
  (git-fixes).
- media: i2c: ov5647: Correct minimum VBLANK value (git-fixes).
- media: i2c: ov5647: Correct pixel array offset (git-fixes).
- media: i2c: ov5647: Initialize subdev before controls
  (git-fixes).
- media: ccs: Avoid possible division by zero (git-fixes).
- media: qcom: camss: vfe: Fix out-of-bounds access in
  vfe_isr_reg_update() (git-fixes).
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
  (git-fixes).
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
  (git-fixes).
- media: cx25821: Add missing unmap in snd_cx25821_hw_params()
  (git-fixes).
- media: cx23885: Add missing unmap in snd_cx23885_hw_params()
  (git-fixes).
- media: cx88: Add missing unmap in snd_cx88_hw_params()
  (git-fixes).
- net: usb: sr9700: support devices with virtual driver CD
  (stable-fixes).
- commit b9e0ae7

- drm/msm/a2xx: fix pixel shader start on A225 (git-fixes).
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (git-fixes).
- drm/buddy: Prevent BUG_ON by validating rounded allocation
  (git-fixes).
- drm/tegra: dsi: fix device leak on probe (git-fixes).
- media: radio-keene: fix memory leak in error path (git-fixes).
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
  (git-fixes).
- media: mtk-mdp: Fix error handling in probe function
  (git-fixes).
- HID: hid-pl: handle probe errors (git-fixes).
- HID: playstation: Add missing check for input_ff_create_memless
  (git-fixes).
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
  (git-fixes).
- hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler
  optimization induced race (git-fixes).
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30
  (2d99:a101) (stable-fixes).
- HID: i2c-hid: fix potential buffer overflow in
  i2c_hid_get_report() (stable-fixes).
- HID: quirks: Add another Chicony HP 5MP Cameras to
  hid_ignore_list (stable-fixes).
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
  (stable-fixes).
- HID: intel-ish-hid: Reset enum_devices_done before enumeration
  (stable-fixes).
- HID: intel-ish-hid: Update ishtp bus match to support device
  ID table (stable-fixes).
- HID: playstation: Center initial joystick axes to prevent
  spurious events (stable-fixes).
- commit a4d4518

- Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
  (git-fixes).
- ASoC: amd: drop unused Kconfig symbols (git-fixes).
- ASoC: pxa: drop unused Kconfig symbol (git-fixes).
- ASoC: SOF: ipc4-control: Keep the payload size up to date
  (git-fixes).
- ASoC: SOF: ipc4-control: Use the correct size for
  scontrol->ipc_control_data (git-fixes).
- ASoC: SOF: ipc4-topology: Correct the allocation size for
  bytes controls (git-fixes).
- ASoC: SOF: ipc4-control: If there is no data do not send bytes
  update (git-fixes).
- bus: fsl-mc: fix an error handling in fsl_mc_device_add()
  (git-fixes).
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU
  (git-fixes).
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
  (stable-fixes).
- ASoC: tlv320adcx140: Propagate error codes during probe
  (stable-fixes).
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (stable-fixes).
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe
  (stable-fixes).
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
  (stable-fixes).
- commit cd7803f

- net/sched: Enforce that teql can only be used as root qdisc
  (CVE-2026-23074 bsc#1257749).
- commit 476e9b8

- mfd: wm8350-core: Use IRQF_ONESHOT (git-fixes).
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists
  correctly (git-fixes).
- crypto: virtio - Remove duplicated virtqueue_kick in
  virtio_crypto_skcipher_crypt_req (git-fixes).
- crypto: virtio - Add spinlock protection with virtqueue
  notification (git-fixes).
- crypto: hisilicon/sec2 - support skcipher/aead fallback for
  hardware queue unavailable (git-fixes).
- crypto: octeontx - fix dma_free_coherent() size (git-fixes).
- crypto: cavium - fix dma_free_coherent() size (git-fixes).
- crypto: iaa - Fix out-of-bounds index in
  find_empty_iaa_compression_mode (git-fixes).
- crypto: octeontx - Fix length check to avoid truncation in
  ucode_load_store (git-fixes).
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (git-fixes).
- crypto: qat - fix parameter order used in
  ICP_QAT_FW_COMN_FLAGS_BUILD (git-fixes).
- Documentation: mailbox: mbox_chan_ops.flush() is optional
  (git-fixes).
- commit ef8920f

- irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758 CVE-2026-23085)
- commit e3370c0

- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762 CVE-2026-23107)
- commit c430300

- arm64/fpsimd: signal: Fix restoration of SVE context (bsc#1257772 CVE-2026-23102)
- commit 6759c0c

- arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772 CVE-2026-23102)
- commit 1baf93e

- net: tunnel: make skb_vlan_inet_prepare() return drop reasons
  (bsc#1257942 bsc#1257246 CVE-2026-23003).
- commit 3935902

- vxlan: Pull inner IP header in vxlan_xmit_one() (bsc#1257942
  bsc#1257246 CVE-2026-23003).
- commit 8097957

- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (bsc#1257952)
- commit 54f273c

- spi: tegra210-quad: Protect curr_xfer clearing in (bsc#1257952)
- commit 1da9508

- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (bsc#1257952)
- commit 25ff6b8

- spi: tegra210-quad: Protect curr_xfer assignment in (bsc#1257952)
- commit e3d34f8

- spi: tegra210-quad: Move curr_xfer read inside spinlock (bsc#1257952)
- commit 4658841

- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed (bsc#1257952)
- commit 997844c

- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
  (git-fixes).
- PM: wakeup: Handle empty list in wakeup_sources_walk_start()
  (git-fixes).
- ACPICA: Fix NULL pointer dereference in
  acpi_ev_address_space_dispatch() (git-fixes).
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error
  (git-fixes).
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount()
  failure (git-fixes).
- i3c: dw: Initialize spinlock to avoid upsetting lockdep
  (git-fixes).
- i3c: Move device name assignment after i3c_bus_init (git-fixes).
- auxdisplay: arm-charlcd: fix release_mem_region() size
  (git-fixes).
- commit b423671

- workqueue: mark power efficient workqueue as unbounded if (bsc#1257891)
- commit a0e31fb

- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
  (CVE-2026-23089 bsc#1257790).
- commit c09ea34

- spi: tegra114: Preserve SPI mode bits in def_command1_reg
  (git-fixes).
- spi: tegra: Fix a memory leak in tegra_slink_probe()
  (git-fixes).
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler
  (git-fixes).
- spi: tegra210-quad: Protect curr_xfer clearing in
  tegra_qspi_non_combined_seq_xfer (git-fixes).
- spi: tegra210-quad: Protect curr_xfer in
  tegra_qspi_combined_seq_xfer (git-fixes).
- spi: tegra210-quad: Protect curr_xfer assignment in
  tegra_qspi_setup_transfer_one (git-fixes).
- spi: tegra210-quad: Move curr_xfer read inside spinlock
  (git-fixes).
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already
  processed transfer (git-fixes).
- commit 95b4070

- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (stable-fixes).
- ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for
  HP machine (stable-fixes).
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
  (stable-fixes).
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel
  (stable-fixes).
- ALSA: hda/realtek - fixed speaker no sound (stable-fixes).
- commit e53fbb8

- ASoC: amd: fix memory leak in acp3x pdm dma ops (git-fixes).
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update()
  (git-fixes).
- hwmon: (occ) Mark occ_init_attribute() as __printf (git-fixes).
- drm/amd/display: fix wrong color value mapping on MCM shaper
  LUT (git-fixes).
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
  (git-fixes).
- drm/mgag200: fix mgag200_bmc_stop_scanout() (git-fixes).
- efivarfs: fix error propagation in efivar_entry_get()
  (git-fixes).
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
  (stable-fixes).
- gpio: pca953x: mask interrupts in irq shutdown (stable-fixes).
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (stable-fixes).
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (stable-fixes).
- drm/amdgpu/soc21: fix xclk for APUs (stable-fixes).
- pinctrl: meson: mark the GPIO controller as sleeping
  (git-fixes).
- drm/radeon: delete radeon_fence_process in is_signaled, no
  deadlock (stable-fixes).
- commit 1cabea4

- net: openvswitch: fix middle attribute validation in push_nsh()
  action (CVE-2025-68785 bsc#1256640).
- commit 3dbef50

- clocksource: Reduce watchdog readout delay limit to prevent
  false positives (bsc#1241345).
- commit 6736e91

- clocksource: Print durations for sync check unconditionally
  (bsc#1241345).
- commit 79738b2

- iomap: account for unaligned end offsets when truncating read
  range (git-fixes).
- blacklist.conf: Blacklist 40a71b53d5a6 and 524c3853831c
- commit 6f0c964

- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  (git-fixes).
- commit c2e8303

- mptcp: avoid deadlock on fallback while reinjecting
  (CVE-2025-71126 bsc#1256755).
- mptcp: reset fallback status gracefully at disconnect() time
  (CVE-2025-71126 bsc#1256755).
- commit 3b7ecc1

- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  (CVE-2026-23003 bsc#1257246).
- commit 2b67457

- geneve: Fix incorrect inner network header offset when
  innerprotoinherit is set (CVE-2026-23003 bsc#1257246).
- commit 167d4d3

- platform/x86: intel_telemetry: Fix PSS event register mask
  (git-fixes).
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output
  (git-fixes).
- platform/x86: toshiba_haps: Fix memory leaks in add/remove
  routines (git-fixes).
- commit 41b7ff7

- btrfs: scrub: always update btrfs_scrub_progress::last_physical
  (git-fixes).
- commit b2c29ef

- Recognize fuse "portal" as a virtual file system (boo#1234736,
  util-linux-libmount-fuse-portal.patch).

- fdisk: Fix possible partition overlay and data corruption if EBR
  gap is missing (boo#1222465,
  util-linux-libfdisk-ebr-missing-gap-1.patch,
  util-linux-tests-fdisk-ebr-missing-gap-1.patch,
  util-linux-tests-fdisk-ebr-missing-gap-2.patch,
  util-linux-libfdisk-ebr-missing-gap-2.patch,
  util-linux-tests-fdisk-ebr-missing-gap-3.patch).

- CVE-2026-4878: Fixed a a potential TOCTOU race condition in cap_set_file() (bsc#1261809)
  0001-Address-a-potential-TOCTOU-race-condition-in-cap_set.patch:

- Security fixes:
  * CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631)
  * CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632)
  * CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635)
  * CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636)
  * CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638)
  * sws: prevent "connection monitor" to say disconnect twice (bsc#1259362)
  * Add patches:
  - curl-CVE-2026-4873.patch
  - curl-CVE-2026-5545.patch
  - curl-CVE-2026-6253.patch
  - curl-CVE-2026-6276.patch
  - curl-CVE-2026-6429.patch
  - curl-CVE-2026-1965-disable-ntlm-fix.patch

- Security fixes:
  * CVE-2026-1965: Bad reuse of HTTP Negotiate connection (bsc#1259362)
  * CVE-2026-3783: Token leak with redirect and netrc (bsc#1259363)
  * CVE-2026-3784: Wrong proxy connection reuse with credentials (bsc#1259364)
  * CVE-2026-3805: Use after free in SMB connection reuse (bsc#1259365)
  * Add patches:
  - curl-CVE-2026-1965.patch
  - curl-CVE-2026-3783.patch
  - curl-CVE-2026-3784.patch
  - curl-CVE-2026-3805.patch

- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch

- update to NSS 3.112.5
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping ss->vrange.max.
  * bmo#2034185 - update to version 2.84 of builtins module.

- Added "Suggests: p11-kit-nss-trust" to favor over mozilla-nss-certs
    (Jira: PED-15633)

- update to NSS 3.112.4
  * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
  * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
  * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
  * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
  * bmo#2029323 - Improve size calculations in CMS content buffering.
  * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
  * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
  * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
  * bmo#2027345 - Improve input validation in DSAU signature decoding.
  * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
  * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
  * bmo#2026156 - Add a maximum cert uncompressed len and tests.
  * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
  * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
  * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
  * bmo#2019224 - Remove invalid PORT_Free().
  * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
  * bmo#1935995 - make ss->ssl3.hs.cookie an owned-copy of the cookie.

- update to NSS 3.112.3
  * bmo#2009552 - avoid integer overflow in platform-independent ghash

- update to 2.14.2
- Important changes
  * Several changes related to LCD filtering are implemented to
    achieve better performance and encourage sound practices.
    + Instead of blanket LCD filtering over the entire bitmap, it
    is now applied only to non-zero spans using direct rendering.
    This speeds up the ClearType-like rendering by more than 40%
    at sizes above 32 ppem.
    + Setting the filter weights with FT_Face_Properties is no
    longer supported. The default and light filters are optimized
    to work with any face.
    + The legacy libXft LCD filter algorithm is no longer provided.
- Important bug fixes
  * A bunch of potential security problems have been found
    (bsc#1259118, CVE-2026-23865). All users should update.
  * The italic angle in `PS_FontInfo` is now stored as a fixed-point
    value in degrees for all Type 1 fonts and their derivatives,
    consistent with CFF fonts and common practices. The broken
    underline position and thickness values are fixed for CFF fonts.
- Miscellaneous
  * The `x` field in the `FT_Span` structure is now unsigned.
  * Demo program `ftgrid` got an option `-m` to select a start
    character to display.
  * Similarly, demo program `ftmulti` got an option `-m` to select a
    text string for rendering.
  * Option `-d` in the demo program `ttdebug` is now called `-a`,
    expecting a comma-separated list of axis values.  The user
    interface is also slightly improved.
  * The `ftinspect` demo program can now be compiled with Qt6, too.

- update to 2.14.1:
  * The auto-hinter got new abilities. It can now better separate
    diacritic glyphs from base glyphs at small sizes  by
    artificially moving  diacritics up (or  down) if necessary
  * Tilde accent  glyphs get vertically stretched at small sizes so
    that they don't degenerate to horizontal lines.
  * Diacritics directly attached to a base glyph (like the ogonek in
    character 'ę') no longer distort the shape of the base glyph
  * The TrueType  instruction interpreter  was optimized to
    produce a 15% gain in the glyph loading speed.
  * Handling of Variation Fonts is now considerably faster
  * TrueType and CFF glyph loading speed has been improved by 5-10%
    on modern 64-bit platforms  as  a result of better handling of
    fixed-point multiplication.
  * The BDF driver now loads fonts 75% faster.

- package FTL.TXT and GPLv2.TXT [bsc#1252148]

- Add patch fix-bsc1259924.patch (bsc#1259924, CVE-2025-69720)
  * Backport from ncurses-6.5-20251213.patch

- added patches
  CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845)
  * nghttp2-CVE-2026-27135.patch

- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch

- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch

- added patches
  CVE-2026-34757: Information disclosure and data corruption via use-after-free vulnerability [bsc#1261957]
  * libpng16-CVE-2026-34757.patch

- added patches
  CVE-2026-33416: use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` can lead to arbitrary code execution (bsc#1260754)
  * libpng16-CVE-2026-33416-1.patch
  * libpng16-CVE-2026-33416-2.patch
  * libpng16-CVE-2026-33416-3.patch
  * libpng16-CVE-2026-33416-4.patch
  CVE-2026-33636: out-of-bounds read/write in the palette expansion on ARM Neon can lead to information leak and crashes (bsc#1260755)
  * libpng16-CVE-2026-33636.patch

- avoid reading endless amounts of memory (CVE-2026-4897 bsc#1260859)
  0001-CVE-2026-4897-getline-string-overflow.patch

- Add CVE-2026-3446-base64-padding.patch preventing ignoring
  excess Base64 data after the first padded quad (bsc#1261970,
  CVE-2026-3446, gh#python/cpython#145264).

- Add CVE-2026-3479-pkgutil_get_data.patch pkgutil.get_data() has
  the same security model as open(). The documented limitations
  ensure compatibility with non-filesystem loaders; Python
  doesn't check that. (bsc#1259989, CVE-2026-3479,
  gh#python/cpython#146121).

- Add CVE-2026-4519-webbrowser-open-dashes.patch to reject
  leading dashes in webbrowser URLs (bsc#1260026, CVE-2026-4519,
  gh#python/cpython#143930).

- Add CVE-2025-13462-tarinfo-header-parse.patch which skips
  TarInfo DIRTYPE normalization during GNU long name handling
  (bsc#1259611, CVE-2025-13462).

- Add CVE-2026-4224-expat-unbound-C-recursion.patch avoiding
  unbound C recursion in conv_content_model in pyexpat.c
  (bsc#1259735, CVE-2026-4224).

- Add CVE-2026-3644-cookies-Morsel-update-II.patch to reject
  control characters in http.cookies.Morsel.update() and
  http.cookies.BaseCookie.js_output (bsc#1259734, CVE-2026-3644).

- Fix changelog

- Add CVE-2026-2297-SourcelessFileLoader-io_open_code.patch
  ensuring that `SourcelessFileLoader` uses `io.open_code` when
  opening `.pyc` files (bsc#1259240, CVE-2026-2297).

- Update to 3.11.15:
  - Security
  - gh-144125: BytesGenerator will now refuse to serialize
    (write) headers that are unsafely folded or delimited; see
    verify_generated_headers. (Contributed by Bas Bloemsaat and
    Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
  - gh-143935: Fixed a bug in the folding of comments when
    flattening an email message using a modern email policy.
    Comments consisting of a very long sequence of non-foldable
    characters could trigger a forced line wrap that omitted
    the required leading space on the continuation line,
    causing the remainder of the comment to be interpreted as
    a new header field. This enabled header injection with
    carefully crafted inputs (bsc#1257029 CVE-2025-11468).
  - gh-143925: Reject control characters in data: URL media
    types (bsc#1257046, CVE-2025-15282).
  - gh-143919: Reject control characters in http.cookies.Morsel
    fields and values (bsc#1257031, CVE-2026-0672).
  - gh-143916: Reject C0 control characters within
    wsgiref.headers.Headers fields, values, and parameters
    (bsc#1257042, CVE-2026-0865).
  - gh-142145: Remove quadratic behavior in xml.minidom node ID
    cache clearing. In order to do this without breaking
    existing users, we also add the ownerDocument attribute to
    xml.dom.minidom elements and attributes created by directly
    instantiating the Element or Attr class. Note that this way
    of creating nodes is not supported; creator functions like
    xml.dom.Document.documentElement() should be used instead
    (bsc#1254997, CVE-2025-12084).
  - gh-137836: Add support of the “plaintext” element, RAWTEXT
    elements “xmp”, “iframe”, “noembed” and “noframes”, and
    optionally RAWTEXT element “noscript” in
    html.parser.HTMLParser.
  - gh-136063: email.message: ensure linear complexity for
    legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  - gh-136065: Fix quadratic complexity in
    os.path.expandvars() (bsc#1252974, CVE-2025-6075).
  - gh-119451: Fix a potential memory denial of service in the
    http.client module. When connecting to a malicious server,
    it could cause an arbitrary amount of memory to be
    allocated. This could have led to symptoms including
    a MemoryError, swapping, out of memory (OOM) killed
    processes or containers, or even system crashes
    (CVE-2025-13836, bsc#1254400).
  - gh-119452: Fix a potential memory denial of service in the
    http.server module. When a malicious user is connected to
    the CGI server on Windows, it could cause an arbitrary
    amount of memory to be allocated. This could have led to
    symptoms including a MemoryError, swapping, out of memory
    (OOM) killed processes or containers, or even system
    crashes.
  - gh-119342: Fix a potential memory denial of service in the
    plistlib module. When reading a Plist file received from
    untrusted source, it could cause an arbitrary amount of
    memory to be allocated. This could have led to symptoms
    including a MemoryError, swapping, out of memory (OOM)
    killed processes or containers, or even system crashes
    (bsc#1254401, CVE-2025-13837).
  - Library
  - gh-144833: Fixed a use-after-free in ssl when SSL_new()
    returns NULL in newPySSLSocket(). The error was reported
    via a dangling pointer after the object had already been
    freed.
  - gh-144363: Update bundled libexpat to 2.7.4
  - gh-90949: Add SetAllocTrackerActivationThreshold() and
    SetAllocTrackerMaximumAmplification() to xmlparser objects
    to prevent use of disproportional amounts of dynamic memory
    from within an Expat parser. Patch by Bénédikt Tran.
  - Core and Builtins
  - gh-120384: Fix an array out of bounds crash in
    list_ass_subscript, which could be invoked via some
    specificly tailored input: including concurrent
    modification of a list object, where one thread assigns
    a slice and another clears it.
  - gh-120298: Fix use-after free in list_richcompare_impl
    which can be invoked via some specificly tailored evil
    input.
  Remove upstreamed patches:
  - CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2025-12084-minidom-quad-search.patch
  - CVE-2025-13836-http-resp-cont-len.patch
  - CVE-2025-13837-plistlib-mailicious-length.patch
  - CVE-2025-6075-expandvars-perf-degrad.patch
  - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15282-urllib-ctrl-chars.patch

- respect the "default" attribute in environment optionlist in
  the comps parser
- support suse namespace deps in boolean dependencies [bsc#1258193]
- support for the Elbrus2000 (e2k) architecture
- support language() suse namespace rewriting
- bump version to 0.7.36

- Update to version 3.51.3:
  * Fix the WAL-reset database corruption bug:
    https://sqlite.org/wal.html#walresetbug
  * Other minor bug fixes.

- Update to version 3.51.2:
  * bsc#1259619, CVE-2025-70873: zipfile extension may disclose
    uninitialized heap memory during inflation.
  * Fix an obscure deadlock in the new broken-posix-lock detection
    logic.
  * Fix multiple problems in the EXISTS-to-JOIN optimization.
  * Other minor bug fixes.

- Update to version 3.51.1:
  * Fix incorrect results from nested EXISTS queries caused by the
    optimization in item 6b in the 3.51.0 release.
  * Fix a latent bug in fts5vocab virtual table, exposed by new
    optimizations in the 3.51.0 release
- Changes in version 3.51.0:
  * New macros in sqlite3.h:
  - SQLITE_SCM_BRANCH → the name of the branch from which the
    source code is taken.
  - SQLITE_SCM_TAGS → space-separated list of tags on the source
    code check-in.
  - SQLITE_SCM_DATETIME → ISO-8601 date and time of the source
    code check-in.
  * Two new JSON functions, jsonb_each() and jsonb_tree() work the
    same as the existing json_each() and json_tree() functions
    except that they return JSONB for the "value" column when the
    "type" is 'array' or 'object'.
  * The carray and percentile extensions are now built into the
    amalgamation, though they are disabled by default and must be
    activated at compile-time using the -DSQLITE_ENABLE_CARRAY
    and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.
  * Enhancements to TCL Interface:
  - Add the -asdict flag to the eval command to have it set the
    row data as a dict instead of an array.
  - User-defined functions may now break to return an SQL NULL.
  * CLI enhancements:
  - Increase the precision of ".timer" to microseconds.
  - Enhance the "box" and "column" formatting modes to deal with
    double-wide characters.
  - The ".imposter" command provides read-only imposter tables
    that work with VACUUM and do not require the --unsafe-testing
    option.
  - Add the --ifexists option to the CLI command-line option and
    to the .open command.
  - Limit columns widths set by the ".width" command to 30,000 or
    less, as there is not good reason to have wider columns, but
    supporting wider columns provides opportunity to malefactors.
  * Performance enhancements:
  - Use fewer CPU cycles to commit a read transaction.
  - Early detection of joins that return no rows due to one or
    more of the tables containing no rows.
  - Avoid evaluation of scalar subqueries if the result of the
    subquery does not change the result of the overall expression.
  - Faster window function queries when using
    "BETWEEN :x FOLLOWING AND :y FOLLOWING" with a large :y.
  * Add the PRAGMA wal_checkpoint=NOOP; command and the
    SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().
  * Add the sqlite3_set_errmsg() API for use by extensions.
  * Add the sqlite3_db_status64() API, which works just like the
    existing sqlite3_db_status() API except that it returns 64-bit
    results.
  * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the
    sqlite3_db_status() and sqlite3_db_status64() interfaces.
  * In the session extension add the sqlite3changeset_apply_v3()
    interface.
  * For the built-in printf() and the format() SQL function, omit
    the leading '-' from negative floating point numbers if the '+'
    flag is omitted and the "#" flag is present and all displayed
    digits are '0'. Use '%#f' or similar to avoid outputs like
    '-0.00' and instead show just '0.00'.
  * Improved error messages generated by FTS5.
  * Enforce STRICT typing on computed columns.
  * Improved support for VxWorks
  * JavaScript/WASM now supports 64-bit WASM. The canonical builds
    continue to be 32-bit but creating one's own 64-bit build is
    now as simple as running "make".
  * Improved resistance to database corruption caused by an
    application breaking Posix advisory locks using close().

- Import commit a943e3ce2f655b8509038e31f03f5ded18f24683
  a943e3ce2f machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
  71593f77db udev: fix review mixup
  73a89810b4 udev-builtin-net-id: print cescaped bad attributes
  0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
  40905232e2 udev: ensure tag parsing stays within bounds
  7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
  d018ac1ea3 udev: check for invalid chars in various fields received from the kernel (bsc#1259697)

- Import commit aef6e11921f8c46a2b7ee8cfab024c9c641d74d8
  aef6e11921 core/cgroup: avoid one unnecessary strjoina()
  cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
  26a748f727 core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
  99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs

- Name libsystemd-{shared,core} based on the major version of systemd and the
  package release number (bsc#1228081 bsc#1256427)
  This way, both the old and new versions of the shared libraries will be
  present during the update. This should prevent issues during package updates
  when incompatible changes are introduced in the new versions of the shared
  libraries.

- Import commit 8bbac1d508acb8aa4e7262f47c7f4076b8350f72
  8bbac1d508 detect-virt: bare-metal GCE only for x86 and i386 (bsc#1254293)

- Fix preloader not caching packages from arch specific subrepos
  (bsc#1253740)
- Deprioritize invalid mirrors (fixes openSUSE/zypper#636)
- version 17.38.5 (35)

- Fix Product::referencePackage lookup (bsc#1259311)
  Use a provided autoproduct() as hint to the package name of the
  release package. It might be that not just multiple versions of
  the same release package provide the same product version, but
  also different release packages.
- version 17.38.4 (35)

- specfile: on fedora use %{_prefix}/share as zyppconfdir if
  %{_distconfdir} is undefined (fixes #693)
  This will set '-DZYPPCONFDIR=%{zyppconfdir}' for cmake.
- Fall back to a writable location when precaching packages
  without root (bsc#1247948)
- version 17.38.3 (35)

- Build fix for SLE 16 and later (bsc#1250110)
  + Switch SLE 15 SP4 - SP7 to Python 3.11 (jsc#PED-8945)

- Add CVE-2026-32597_crit-header.patch to validate the crit
  (Critical) Header Parameter defined in RFC 7515 (bsc#1259616,
  CVE-2026-32597).

- CVE-2026-34073: X.509 bypass of name constraints on wildcard SANs with matching peer names (bsc#1260876)
  Add patch CVE-2026-34073.patch

- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808)
  Add patch CVE-2026-27459.patch

- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804)
  Add patch CVE-2026-27448.patch

- CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589)
  Add patch CVE-2026-25645.patch

- Add CVE-2026-3446-base64-padding.patch preventing ignoring
  excess Base64 data after the first padded quad (bsc#1261970,
  CVE-2026-3446, gh#python/cpython#145264).

- Add CVE-2026-3479-pkgutil_get_data.patch pkgutil.get_data() has
  the same security model as open(). The documented limitations
  ensure compatibility with non-filesystem loaders; Python
  doesn't check that. (bsc#1259989, CVE-2026-3479,
  gh#python/cpython#146121).

- Add CVE-2026-4519-webbrowser-open-dashes.patch to reject
  leading dashes in webbrowser URLs (bsc#1260026, CVE-2026-4519,
  gh#python/cpython#143930).

- Add CVE-2025-13462-tarinfo-header-parse.patch which skips
  TarInfo DIRTYPE normalization during GNU long name handling
  (bsc#1259611, CVE-2025-13462).

- Add CVE-2026-4224-expat-unbound-C-recursion.patch avoiding
  unbound C recursion in conv_content_model in pyexpat.c
  (bsc#1259735, CVE-2026-4224).

- Add CVE-2026-3644-cookies-Morsel-update-II.patch to reject
  control characters in http.cookies.Morsel.update() and
  http.cookies.BaseCookie.js_output (bsc#1259734, CVE-2026-3644).

- Fix changelog

- Add CVE-2026-2297-SourcelessFileLoader-io_open_code.patch
  ensuring that `SourcelessFileLoader` uses `io.open_code` when
  opening `.pyc` files (bsc#1259240, CVE-2026-2297).

- Update to 3.11.15:
  - Security
  - gh-144125: BytesGenerator will now refuse to serialize
    (write) headers that are unsafely folded or delimited; see
    verify_generated_headers. (Contributed by Bas Bloemsaat and
    Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
  - gh-143935: Fixed a bug in the folding of comments when
    flattening an email message using a modern email policy.
    Comments consisting of a very long sequence of non-foldable
    characters could trigger a forced line wrap that omitted
    the required leading space on the continuation line,
    causing the remainder of the comment to be interpreted as
    a new header field. This enabled header injection with
    carefully crafted inputs (bsc#1257029 CVE-2025-11468).
  - gh-143925: Reject control characters in data: URL media
    types (bsc#1257046, CVE-2025-15282).
  - gh-143919: Reject control characters in http.cookies.Morsel
    fields and values (bsc#1257031, CVE-2026-0672).
  - gh-143916: Reject C0 control characters within
    wsgiref.headers.Headers fields, values, and parameters
    (bsc#1257042, CVE-2026-0865).
  - gh-142145: Remove quadratic behavior in xml.minidom node ID
    cache clearing. In order to do this without breaking
    existing users, we also add the ownerDocument attribute to
    xml.dom.minidom elements and attributes created by directly
    instantiating the Element or Attr class. Note that this way
    of creating nodes is not supported; creator functions like
    xml.dom.Document.documentElement() should be used instead
    (bsc#1254997, CVE-2025-12084).
  - gh-137836: Add support of the “plaintext” element, RAWTEXT
    elements “xmp”, “iframe”, “noembed” and “noframes”, and
    optionally RAWTEXT element “noscript” in
    html.parser.HTMLParser.
  - gh-136063: email.message: ensure linear complexity for
    legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  - gh-136065: Fix quadratic complexity in
    os.path.expandvars() (bsc#1252974, CVE-2025-6075).
  - gh-119451: Fix a potential memory denial of service in the
    http.client module. When connecting to a malicious server,
    it could cause an arbitrary amount of memory to be
    allocated. This could have led to symptoms including
    a MemoryError, swapping, out of memory (OOM) killed
    processes or containers, or even system crashes
    (CVE-2025-13836, bsc#1254400).
  - gh-119452: Fix a potential memory denial of service in the
    http.server module. When a malicious user is connected to
    the CGI server on Windows, it could cause an arbitrary
    amount of memory to be allocated. This could have led to
    symptoms including a MemoryError, swapping, out of memory
    (OOM) killed processes or containers, or even system
    crashes.
  - gh-119342: Fix a potential memory denial of service in the
    plistlib module. When reading a Plist file received from
    untrusted source, it could cause an arbitrary amount of
    memory to be allocated. This could have led to symptoms
    including a MemoryError, swapping, out of memory (OOM)
    killed processes or containers, or even system crashes
    (bsc#1254401, CVE-2025-13837).
  - Library
  - gh-144833: Fixed a use-after-free in ssl when SSL_new()
    returns NULL in newPySSLSocket(). The error was reported
    via a dangling pointer after the object had already been
    freed.
  - gh-144363: Update bundled libexpat to 2.7.4
  - gh-90949: Add SetAllocTrackerActivationThreshold() and
    SetAllocTrackerMaximumAmplification() to xmlparser objects
    to prevent use of disproportional amounts of dynamic memory
    from within an Expat parser. Patch by Bénédikt Tran.
  - Core and Builtins
  - gh-120384: Fix an array out of bounds crash in
    list_ass_subscript, which could be invoked via some
    specificly tailored input: including concurrent
    modification of a list object, where one thread assigns
    a slice and another clears it.
  - gh-120298: Fix use-after free in list_richcompare_impl
    which can be invoked via some specificly tailored evil
    input.
  Remove upstreamed patches:
  - CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2025-12084-minidom-quad-search.patch
  - CVE-2025-13836-http-resp-cont-len.patch
  - CVE-2025-13837-plistlib-mailicious-length.patch
  - CVE-2025-6075-expandvars-perf-degrad.patch
  - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15282-urllib-ctrl-chars.patch

- Add CVE-2026-5958.patch
  * Fix CVE-2026-5958 (bsc#1262144):
    A TOCTOU race can allow to read attacker-controlled content and write
    it to an unintended file

- CVE-2026-35535: potential privilege escalation when running
  the mailer (bsc#1261420)
  * fix-CVE-2026-35535.patch

- add the auto import framework

- Added post quantum cryptographic keys for SLES 15 and SLES 16.
  - build-pqc-15.pem
  - build-pqc-16.pem

- Update version to 1.21.1:
  - Fix nil token handling (bsc#1261155)
  - Switch to using go1.24-openssl as the default Go version to
    install to support building the package (jsc#SCC-585).

- Update version to 1.21:
  - Add expanded metric collection for kernel modules and hardware
    detection (jsc#TEL-226).
  - Support new profile based metric collection
  - Fix ignored --root parameter hanbling when reading and
    writing configuration (bsc#1257667)
  - Add expanded metric collection for system vendor/manfacturer
    (jsc#TEL-260).
  - Removed backport patch: fix-libsuseconnect-and-pci.patch
  - Add missing product id to allow yast2-registration to not break (bsc#1257825)
  - Fix libsuseconnect APIError detection logic (bsc#1257825)

- Regressions found during QA test runs:
  - Ignore product in announce call (bsc#1257490)
  - Registration to SMT server with failed (bsc#1257625)
  - Backported by PATCH: fix-libsuseconnect-and-pci.patch

- Fix bsc#1246399 / CVE-2025-45582.
- Add patch:
  * CVE-2025-45582.patch

- Add tar-fix-deletion-from-archive.patch
  * Fixes tar creating invalid tarballs when used with --delete (bsc#1246607)
  * Add makeinfo build requirement, needed after the addition of the patch

- Recognize fuse "portal" as a virtual file system (boo#1234736,
  util-linux-libmount-fuse-portal.patch).

- fdisk: Fix possible partition overlay and data corruption if EBR
  gap is missing (boo#1222465,
  util-linux-libfdisk-ebr-missing-gap-1.patch,
  util-linux-tests-fdisk-ebr-missing-gap-1.patch,
  util-linux-tests-fdisk-ebr-missing-gap-2.patch,
  util-linux-libfdisk-ebr-missing-gap-2.patch,
  util-linux-tests-fdisk-ebr-missing-gap-3.patch).

- Fix bsc#1261833 / CVE-2026-39881.
- Update to 9.2.0398.
- Changes:
  * 9.2.0398: MS-Windows: missing strptime() support
  * 9.2.0397: tabpanel: double-click opens a new tab
  * 9.2.0396: tests: Test_error_callback_terminal is flaky on macOS
  * 9.2.0395: tests: Test_backupskip() may read from $HOME
  * 9.2.0394: xxd: offsets greater than LONG_MAX print as negative
  * 9.2.0393: MS-Windows: link error with XPM support on UCRT64
  * 9.2.0392: tests: Some tests are flaky
  * 9.2.0391: tests: Comment in test_vim9_cmd breaks syntax highlighting
  * 9.2.0390: filetype: some Beancount files are not recognized
  * 9.2.0389: DECRQM still leaves stray "pp" on Apple Terminal.app
  * 9.2.0388: strange indent in update_topline()
  * 9.2.0387: DECRQM request may leave stray chars in terminal
  * 9.2.0386: No scroll/scrollbar support in the tabpanel
  * 9.2.0385: Integer overflow with "ze" and large 'sidescrolloff'
  * 9.2.0384: stale Insstart after <Cmd> cursor move breaks undo
  * 9.2.0383: [security]: runtime(netrw): shell-injection via sftp: and file: URLs
  * 9.2.0382: Wayland: focus-stealing is non-working
  * 9.2.0381: Vim9: Missing check_secure() in exec_instructions()
  * 9.2.0380: completion: a few issues in completion code
  * 9.2.0379: gui.color_approx is never used
  * 9.2.0378: Using int as bool type in win_T struct
  * 9.2.0377: Using int as bool type in gui_T struct
  * 9.2.0376: Vim9: elseif condition compiled in dead branch
  * 9.2.0375: prop_find() does not find a virt text in starting line
  * 9.2.0374: c_CTRL-{G,T} does not handle offset
  * 9.2.0373: Ctrl-R mapping not triggered during completion
  * 9.2.0372: pum: rendering issues with multibyte text and opacity
  * 9.2.0371: filetype: ghostty config files are not recognized
  * 9.2.0370: duplicate code with literal string_T assignment
  * 9.2.0369: multiple definitions of STRING_INIT macro
  * 9.2.0368: too many strlen() calls when adding strings to dicts
  * 9.2.0367: runtime(netrw): ~ note expanded on MS Windows
  * 9.2.0366: pum: flicker when updating pum in place
  * 9.2.0365: using int as bool
  * 9.2.0364: tests: test_smoothscroll_textoff_showbreak() fails
  * 9.2.0363: Vim9: variable shadowed by script-local function
  * 9.2.0362: division by zero with smoothscroll and small windows
  * 9.2.0361: tests: no tests for ch_listen() with IPs
  * 9.2.0360: Cannot handle mouse-clicks in the tabpanel
  * 9.2.0359: wrong VertSplitNC highlighting on winbar
  * 9.2.0358: runtime(vimball): still path traversal attacks possible
  * 9.2.0357: [security]: command injection via backticks in tag files
  * 9.2.0356: Cannot apply 'scrolloff' context lines at end of file
  * 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract()
  * 9.2.0354: filetype: not all Bitbake include files are recognized
  * 9.2.0353: Missing out-of-memory check in register.c
  * 9.2.0352: 'winhighlight' of left window blends into right window
  * 9.2.0351: repeat_string() can be improved
  * 9.2.0350: Enabling modelines poses a risk
  * 9.2.0349: cannot style non-current window separator
  * 9.2.0348: potential buffer underrun when setting statusline like option
  * 9.2.0347: Vim9: script-local variable not found
  * 9.2.0346: Wrong cursor position when entering command line window
  * 9.2.0345: Wrong autoformatting with 'autocomplete'
  * 9.2.0344: channel: ch_listen() can bind to network interface
  * 9.2.0343: tests: test_clientserver may fail on slower systems
  * 9.2.0342: tests: test_excmd.vim leaves swapfiles behind
  * 9.2.0341: some functions can be run from the sandbox
  * 9.2.0340: pum_redraw() may cause flicker
  * 9.2.0339: regexp: nfa_regmatch() allocates and frees too often
  * 9.2.0338: Cannot handle mouseclicks in the tabline
  * 9.2.0337: list indexing broken on big-endian 32-bit platforms
  * 9.2.0336: libvterm: no terminal reflow support
  * 9.2.0335: json_encode() uses recursive algorithm
  * 9.2.0334: GTK: window geometry shrinks with with client-side decorations
  * 9.2.0333: filetype: PklProject files are not recognized
  * 9.2.0332: popup: still opacity rendering issues
  * 9.2.0331: spellfile: stack buffer overflows in spell file generation
  * 9.2.0330: tests: some patterns in tar and zip plugin tests not strict enough
  * 9.2.0329: tests: test_indent.vim leaves swapfiles behind
  * 9.2.0328: Cannot handle mouseclicks in the statusline
  * 9.2.0327: filetype: uv scripts are not detected
  * 9.2.0326: runtime(tar): but with dotted path
  * 9.2.0325: runtime(tar): bug in zstd handling
  * 9.2.0324: 0x9b byte not unescaped in <Cmd> mapping
  * 9.2.0323: filetype: buf.lock files are not recognized
  * 9.2.0322: tests: test_popupwin fails
  * 9.2.0321: MS-Windows: No OpenType font support
  * 9.2.0320: several bugs with text properties
  * 9.2.0319: popup: rendering issues with partially transparent popups
  * 9.2.0318: cannot configure opacity for popup menu
  * 9.2.0317: listener functions do not check secure flag
  * 9.2.0316: [security]: command injection in netbeans interface via defineAnnoType
  * 9.2.0315: missing bound-checks
  * 9.2.0314: channel: can bind to all network interfaces
  * 9.2.0313: Callback channel not registered in GUI
  * 9.2.0312: C-type names are marked as translatable
  * 9.2.0311: redrawing logic with text properties can be improved
  * 9.2.0310: unnecessary work in vim_strchr() and find_term_bykeys()
  * 9.2.0309: Missing out-of-memory check to may_get_cmd_block()
  * 9.2.0308: Error message E1547 is wrong
  * 9.2.0307: more mismatches between return types and documentation
  * 9.2.0306: runtime(tar): some issues with lz4 support
  * 9.2.0305: mismatch between return types and documentation
  * 9.2.0304: tests: test for 9.2.0285 doesn't always fail without the fix
  * 9.2.0303: tests: zip plugin tests don't check for warning message properly
  * 9.2.0302: runtime(netrw): RFC2396 decoding double escaping spaces
  * 9.2.0301: Vim9: void function return value inconsistent
  * 9.2.0300: The vimball plugin needs some love
  * 9.2.0299: runtime(zip): may write using absolute paths
  * 9.2.0298: Some internal variables are not modified
  * 9.2.0297: libvterm: can improve CSI overflow code
  * 9.2.0296: Redundant and incorrect integer pointer casts in drawline.c
  * 9.2.0295: 'showcmd' shows wrong Visual block size with 'linebreak'
  * 9.2.0294: if_lua: lua interface does not work with lua 5.5
  * 9.2.0293: :packadd may lead to heap-buffer-overflow
  * 9.2.0292: E340 internal error when using method call on void value
  * 9.2.0291: too many strlen() calls
  * 9.2.0290: Amiga: no support for AmigaOS 3.x
  * 9.2.0289: 'linebreak' may lead to wrong Visual block highlighting
  * 9.2.0288: libvterm: signed integer overflow parsing long CSI args
  * 9.2.0287: filetype: not all ObjectScript routines are recognized
  * 9.2.0286: still some unnecessary (int) casts in alloc()
  * 9.2.0285: :syn sync grouphere may go beyond end of line
  * 9.2.0284: tabpanel: crash when tabpanel expression returns variable line count
  * 9.2.0283: unnecessary (int) casts before alloc() calls
  * 9.2.0282: tests: Test_viminfo_len_overflow() fails
  * 9.2.0281: tests: Test_netrw_FileUrlEdit.. fails on Windows

- Fix bsc#1261191 / CVE-2026-34714.
- Fix bsc#1261271 / CVE-2026-34982.
- Fix bsc#1259985 / CVE-2026-33412.
- Update to 9.2.0280:
  * patch 9.2.0280: [security]: path traversal issue in zip.vim
  * patch 9.2.0279: terminal: out-of-bounds write with overlong CSI argument list
  * patch 9.2.0278: viminfo: heap buffer overflow when reading viminfo file
  * patch 9.2.0277: tests: test_modeline.vim fails
  * patch 9.2.0276: [security]: modeline security bypass
  * patch 9.2.0275: tests: test_options.vim fails
  * patch 9.2.0274: BSU/ESU are output directly to the terminal
  * patch 9.2.0273: tabpanel: undefined behaviour with large tabpanelop columns
  * patch 9.2.0272: [security]: 'tabpanel' can be set in a modeline
  * patch 9.2.0271: buffer underflow in vim_fgets()
  * patch 9.2.0270: test: trailing spaces used in tests
  * patch 9.2.0269: configure: Link error on Solaris
  * patch 9.2.0268: memory leak in call_oc_method()
  * patch 9.2.0267: 'autowrite' not triggered for :term
  * patch 9.2.0266: typeahead buffer overflow during mouse drag event
  * patch 9.2.0265: unnecessary restrictions for defining dictionary function names
  * patch 9.2.0264: Cannot disable kitty keyboard protocol in vim :terminal
  * patch 9.2.0263: hlset() cannot handle attributes with spaces
  * patch 9.2.0262: invalid lnum when pasting text copied blockwise
  * patch 9.2.0261: terminal: redraws are slow
  * patch 9.2.0260: statusline not redrawn after closing a popup window
  * patch 9.2.0259: tabpanel: corrupted display during scrolling causing flicker
  * patch 9.2.0258: memory leak in add_mark()
  * patch 9.2.0257: unnecessary memory allocation in set_callback()
  * patch 9.2.0256: visual selection size not shown in showcmd during test
  * patch 9.2.0255: tests: Test_popup_opacity_vsplit() fails in a wide terminal
  * patch 9.2.0254: w_locked can be bypassed when setting recursively
  * patch 9.2.0253: various issues with wrong b_nwindows after closing buffers
  * patch 9.2.0252: Crash when ending Visual mode after curbuf was unloaded
  * patch 9.2.0251: Link error when building without channel feature
  * patch 9.2.0250: system() does not support bypassing the shell
  * patch 9.2.0249: clipboard: provider reacts to autoselect feature
  * patch 9.2.0248: json_decode() is not strict enough
  * patch 9.2.0247: popup: popups may not wrap as expected
  * patch 9.2.0246: memory leak in globpath()
  * patch 9.2.0245: xxd: color output detection is broken
  * patch 9.2.0244: memory leak in eval8()
  * patch 9.2.0243: memory leak in change_indent()
  * patch 9.2.0242: memory leak in check_for_cryptkey()
  * patch 9.2.0241: tests: Test_visual_block_hl_with_autosel() is flaky
  * patch 9.2.0240: syn_name2id() is slow due to linear search
  * patch 9.2.0239: signcolumn may cause flicker
  * patch 9.2.0238: showmode message may not be displayed
  * patch 9.2.0237: filetype: ObjectScript routines are not recognized
  * patch 9.2.0236: stack-overflow with deeply nested data in json_encode/decode()
  * patch 9.2.0235: filetype: wks files are not recognized.
  * patch 9.2.0234: test: Test_close_handle() is flaky
  * patch 9.2.0233: Compiler warning in strings.c
  * patch 9.2.0232: fileinfo not shown after :bd of last listed buffer
  * patch 9.2.0231: Amiga: Link error for missing HAVE_LOCALE_H
  * patch 9.2.0230: popup: opacity not working accross vert splits
  * patch 9.2.0229: keypad keys may overwrite keycode for another key
  * patch 9.2.0228: still possible flicker
  * patch 9.2.0227: MS-Windows: CSI sequences may be written to screen
  * patch 9.2.0226: No 'incsearch' highlighting support for :uniq
  * patch 9.2.0225: runtime(compiler): No compiler plugin for just
  * patch 9.2.0224: channel: 2 issues with out/err callbacks
  * patch 9.2.0223: Option handling for key:value suboptions is limited
  * patch 9.2.0222: "zb" scrolls incorrectly with cursor on fold
  * patch 9.2.0221: Visual selection drawn incorrectly with "autoselect"
  * patch 9.2.0220: MS-Windows: some defined cannot be set on Cygwin/Mingw
  * patch 9.2.0219: call stack can be corrupted
  * patch 9.2.0218: visual selection highlighting in X11 GUI is wrong.
  * patch 9.2.0217: filetype: cto files are not recognized
  * patch 9.2.0216: MS-Windows: Rendering artifacts with DirectX
  * patch 9.2.0215: MS-Windows: several tests fail in the Windows CUI.
  * patch 9.2.0214: tests: Test_gui_system_term_scroll() is flaky
  * patch 9.2.0213: Crash when using a partial or lambda as a clipboard provider
  * patch 9.2.0212: MS-Windows: version packing may overflow
  * patch 9.2.0211: possible crash when setting 'winhighlight'
  * patch 9.2.0210: tests: Test_xxd tests are failing
  * patch 9.2.0209: freeze during wildmenu completion
  * patch 9.2.0208: MS-Windows: excessive scroll-behaviour with go+=!
  * patch 9.2.0207: MS-Windows: freeze on second :hardcopy
  * patch 9.2.0206: MS-Window: stripping all CSI sequences
  * patch 9.2.0205: xxd: Cannot NUL terminate the C include file style
  * patch 9.2.0204: filetype: cps files are not recognized
  * patch 9.2.0203: Patch v9.2.0185 was wrong
  * patch 9.2.0202: [security]: command injection via newline in glob()
  * patch 9.2.0201: filetype: Wireguard config files not recognized
  * patch 9.2.0200: term: DECRQM codes are sent too early
  * patch 9.2.0199: tests: test_startup.vim fails
  * patch 9.2.0198: cscope: can escape from restricted mode
  * patch 9.2.0197: tabpanel: frame width not updated for existing tab pages
  * patch 9.2.0196: textprop: negative IDs and can cause a crash
  * patch 9.2.0195: CI: test-suite gets killed for taking too long
  * patch 9.2.0194: tests: test_startup.vim leaves temp.txt around
  * patch 9.2.0193: using copy_option_part() can be improved
  * patch 9.2.0192: not correctly recognizing raw key codes
  * patch 9.2.0191: Not possible to know if Vim was compiled with Android support
  * patch 9.2.0190: Status line height mismatch in vertical splits
  * patch 9.2.0189: MS-Windows: opacity popups flicker during redraw in the console
  * patch 9.2.0188: Can set environment variables in restricted mode
  * patch 9.2.0187: MS-Windows: rendering artifacts with DirectX renderer
  * patch 9.2.0186: heap buffer overflow with long generic function name
  * patch 9.2.0185: buffer overflow when redrawing custom tabline
  * patch 9.2.0184: MS-Windows: screen flicker with termguicolors and visualbell
  * patch 9.2.0183: channel: using deprecated networking APIs
  * patch 9.2.0182: autocmds may leave windows with w_locked set
  * patch 9.2.0181: line('w0') moves cursor in terminal-normal mode
  * patch 9.2.0180: possible crash with winminheight=0
  * patch 9.2.0179: MS-Windows: Compiler warning for converting from size_t to int
  * patch 9.2.0178: DEC mode requests are sent even when not in raw mode
  * patch 9.2.0177: Vim9: Can set environment variables in restricted mode
  * patch 9.2.0176: external diff is allowed in restricted mode
  * patch 9.2.0175: No tests for what v9.2.0141 and v9.2.0156 fixes
  * patch 9.2.0174: diff: inline word-diffs can be fragmented
  * patch 9.2.0173: tests: Test_balloon_eval_term_visual is flaky
  * patch 9.2.0172: Missing semicolon in os_mac_conv.c
  * patch 9.2.0171: MS-Windows: version detection is deprecated
  * patch 9.2.0170: channel: some issues in ch_listen()
  * patch 9.2.0169: assertion failure in syn_id2attr()
  * patch 9.2.0168: invalid pointer casting in string_convert() arguments
  * patch 9.2.0167: terminal: setting buftype=terminal may cause a crash
  * patch 9.2.0166: Coverity warning for potential NULL dereference
  * patch 9.2.0165: tests: perleval fails in the sandbox
  * patch 9.2.0164: build error when XCLIPBOARD is not defined
  * patch 9.2.0163: MS-Windows: Compile warning for unused variable
  * patch 9.2.0162: tests: unnecessary CheckRunVimInTerminal in test_quickfix
  * patch 9.2.0161: intro message disappears on startup in some terminals
  * patch 9.2.0160: terminal DEC mode handling is overly complex
  * patch 9.2.0159: Crash when reading quickfix line
  * patch 9.2.0158: Visual highlighting might be incorrect
  * patch 9.2.0157: Vim9: concatenation can be improved
  * patch 9.2.0156: perleval() and rubyeval() ignore security settings
  * patch 9.2.0155: filetype: ObjectScript are not recognized
  * patch 9.2.0154: if_lua: runtime error with lua 5.5
  * patch 9.2.0153: No support to act as a channel server
  * patch 9.2.0152: concatenating strings is slow
  * patch 9.2.0151: blob_from_string() is slow for long strings
  * patch 9.2.0150: synchronized terminal update may cause display artifacts
  * patch 9.2.0149: Vim9: segfault when unletting an imported variable
  * patch 9.2.0148: Compile error when FEAT_DIFF is not defined
  * patch 9.2.0147: blob: concatenation can be improved
  * patch 9.2.0146: dictionary lookups can be improved
  * patch 9.2.0145: UTF-8 decoding and length calculation can be improved
  * patch 9.2.0144: 'statuslineopt' is a global only option
  * patch 9.2.0143: termdebug: no support for thread and condition in :Break
  * patch 9.2.0142: Coverity: Dead code warning
  * patch 9.2.0141: :perl ex commands allowed in restricted mode
  * patch 9.2.0140: file reading performance can be improved
  * patch 9.2.0139: Cannot configure terminal resize event
  * patch 9.2.0138: winhighlight option handling can be improved
  * patch 9.2.0137: [security]: crash with composing char in collection range
  * patch 9.2.0136: memory leak in add_interface_from_super_class()
  * patch 9.2.0135: memory leak in eval_tuple()
  * patch 9.2.0134: memory leak in socket_server_send_reply()
  * patch 9.2.0133: memory leak in netbeans_file_activated()
  * patch 9.2.0132: tests: Test_recover_corrupted_swap_file1 fails on be systems
  * patch 9.2.0131: potential buffer overflow in regdump()
  * patch 9.2.0130: missing range flags for the :tab command
  * patch 9.2.0129: popup: wrong handling of wide-chars and opacity:0
  * patch 9.2.0128: Wayland: using _Boolean instead of bool type
  * patch 9.2.0127: line('w0') and line('w$') return wrong values in a terminal
  * patch 9.2.0126: String handling can be improved
  * patch 9.2.0125: tests: test_textformat.vim leaves swapfiles behind
  * patch 9.2.0124: auto-format may swallow white space
  * patch 9.2.0123: GTK: using deprecated gdk_pixbuf_new_from_xpm_data()
  * patch 9.2.0122: Vim still supports compiling on NeXTSTEP
  * patch 9.2.0120: tests: test_normal fails
  * patch 9.2.0119: incorrect highlight initialization in win_init()
  * patch 9.2.0118: memory leak in w_hl when reusing a popup window
  * patch 9.2.0117: tests: test_wayland.vim fails
  * patch 9.2.0116: terminal: synchronized output sequences are buffered
  * patch 9.2.0115: popup: screen flickering possible during async callbacks
  * patch 9.2.0114: MS-Windows: terminal output may go to wrong terminal
  * patch 9.2.0113: winhighlight pointer may be used uninitialized
  * patch 9.2.0112: popup: windows flicker when updating text
  * patch 9.2.0111: 'winhighlight' option not always applied

* Update Vim to version 9.2.0110 (from 9.2.0045).
  * Specifically, this fixes bsc#1259051 / CVE-2026-28417.

* Update Vim to version 9.2.0045 (from 9.1.1629).
  * Fix bsc#1258229 CVE-2026-26269 as 9.2.0045 is not impacted (fixed
  upstream).
  * Fix bsc#1246602 CVE-2025-53906 as 9.2.0045 is not impacted (fixed
  upstream).
  * Drop obsolete or upstreamed patches:
  - vim-7.3-filetype_spec.patch
  - vim-7.4-filetype_apparmor.patch
  - vim-8.2.2411-globalvimrc.patch
  * Refresh the following patches:
  - vim-7.3-filetype_changes.patch
  - vim-7.3-filetype_ftl.patch
  - vim-7.3-sh_is_bash.patch
  - vim-9.1.1134-revert-putty-terminal-colors.patch
  * Remove autoconf from BuildRequires and drop the autoconf call in %build.
  * Package new Swedish (sv) man pages and clean up duplicate encodings
  (sv.ISO8859-1 and sv.UTF-8) during %install.

- Report download progress for command line rpms (fixes #613)
- Hint to '-vv ref' to see the mirrors used to download the
  metadata (bsc#1257882)
- Service: Allow "zypper ls SERVICE ..." to test whether a
  service with this alias is defined (bsc#1252744)
  The command prints an abstract of all services passed on the
  command line. It returns 3-ZYPPER_EXIT_ERR_INVALID_ARGS if some
  argument does not name an existing service.
- Keep repo data when updating the service settings (bsc#1252744)
- info: Enhance pattern content table (bsc#1158038)
  Alternatives (multiple packages providing the same requirement)
  are now listed as a single entry in the content table. The entry
  shows either the installed package which satisfies the
  requirement or the requirement itself as type 'Provides'.
  Listing all potential alternatives was miss leading, especially
  if the alternatives were mutual exclusive. It looked like an
  installed pattern had not-installed requirements and it was not
  possible to install all requirements at the same time.
- version 1.14.95