- crypto: authencesn - Fix src offset when decrypting in-place
  (bsc#1262573 CVE-2026-31431).
- commit 4921c60

- crypto: authencesn - Do not place hiseq at end of dst for
  out-of-place decryption (bsc#1262573 CVE-2026-31431).
- commit 2c8047b

- crypto: authenc - use memcpy_sglist() instead of null skcipher
  (bsc#1262573 CVE-2026-31431).
- Refresh
  patches.suse/crypto-authencesn-reject-too-short-AAD-assoclen-8-to.patch
- commit 24731ba

- kABI: Restore af_alg_{count,pull}_tsgl() signatures (bsc#1262573
  CVE-2026-31431).
- commit b418ef6

- crypto: algif_aead - Revert to operating out-of-place
  (bsc#1262573 CVE-2026-31431).
- commit eb1a8c9

- crypto: algif_aead - use memcpy_sglist() instead of null skcipher
  (bsc#1262573 CVE-2026-31431).
- commit 8a67d67

- crypto: scatterwalk - Fix memcpy_sglist() to always succeed
  (bsc#1262573 CVE-2026-31431).
- commit c2ad254

- crypto: scatterwalk - Add memcpy_sglist (bsc#1262573
  CVE-2026-31431).
- commit 28aed48

- soc: aspeed: socinfo: Mask table entries for accurate SoC ID
  matching (git-fixes).
- commit df6cd61

- net/sched: teql: fix NULL pointer dereference in iptunnel_xmit
  on TEQL slave xmit (CVE-2026-23277 bsc#1259997).
- commit 852cc2c

- scsi: target: Fix recursive locking in __configfs_open_file()
  (CVE-2026-23292 bsc#1260500).
- scsi: target: iscsi: Fix use-after-free in
  iscsit_dec_session_usage_count() (CVE-2026-23193 bsc#1258414).
- scsi: target: iscsi: Fix use-after-free in
  iscsit_dec_conn_usage_count() (CVE-2026-23216 bsc#1258447).
- commit e7b5dcd

- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs
  and shared blocks (CVE-2026-23270 bsc#1259886).
- commit 00821f1

- watchdog/perf: properly initialize the turbo mode timestamp and rearm  counter (bsc#1256504).
- commit c8a645c

- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
  (CVE-2026-23381 bsc#1260471).
- commit 21aa5bd

- clsact: Fix use-after-free in init/destroy rollback asymmetry
  (CVE-2026-23413 bsc#1261498).
- commit eaf3b22

- icmp: fix NULL pointer dereference in icmp_tag_validation()
  (CVE-2026-23398 bsc#1260730).
- net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
  (CVE-2026-23293 bsc#1260486).
- commit 05f5f64

- net/sched: ets: fix divide by zero in the offload path
  (CVE-2026-23379 bsc#1260481).
- commit 3672900

- tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414
  bsc#1261496).
- commit 1058925

- usb: core: phy: avoid double use of 'usb3-phy' (git-fixes).
- commit 4e8787e

- usb: gadget: uvc: fix NULL pointer dereference during unbind
  race (git-fixes).
- commit 4a9ee96

- misc: fastrpc: possible double-free of cctx->remote_heap
  (git-fixes).
- comedi: Reinit dev->spinlock between attachments to low-level
  drivers (git-fixes).
- comedi: me_daq: Fix potential overrun of firmware buffer
  (git-fixes).
- comedi: me4000: Fix potential overrun of firmware buffer
  (git-fixes).
- comedi: ni_atmio16d: Fix invalid clean-up after failed attach
  (git-fixes).
- iio: dac: ad5770r: fix error return in ad5770r_read_raw()
  (git-fixes).
- iio: accel: fix ADXL355 temperature signature value (git-fixes).
- iio: light: vcnl4035: fix scan buffer on big-endian (git-fixes).
- iio: adc: ti-adc161s626: fix buffer read on big-endian
  (git-fixes).
- iio: imu: bmi160: Remove potential undefined behavior in
  bmi160_config_pin() (git-fixes).
- iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
  (git-fixes).
- iio: gyro: mpu3050: Fix out-of-sequence free_irq() (git-fixes).
- iio: gyro: mpu3050: Move iio_device_register() to correct
  location (git-fixes).
- iio: gyro: mpu3050: Fix irq resource leak (git-fixes).
- iio: gyro: mpu3050: Fix incorrect free_irq() variable
  (git-fixes).
- iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and
  gyroscope only (git-fixes).
- usb: cdns3: gadget: fix state inconsistency on gadget init
  failure (git-fixes).
- usb: ulpi: fix double free in ulpi_register_interface() error
  path (git-fixes).
- usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
  (git-fixes).
- usb: gadget: f_rndis: Protect RNDIS options with mutex
  (git-fixes).
- usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
  (git-fixes).
- usb: dwc2: gadget: Fix spin_lock/unlock mismatch in
  dwc2_hsotg_udc_stop() (git-fixes).
- usb: ehci-brcm: fix sleep during atomic (git-fixes).
- USB: dummy-hcd: Fix interrupt synchronization error (git-fixes).
- USB: dummy-hcd: Fix locking/synchronization error (git-fixes).
- usb: usbtmc: Flush anchored URBs in usbtmc_release (git-fixes).
- usb: gadget: u_ether: Fix race between gether_disconnect and
  eth_stop (git-fixes).
- thunderbolt: Fix property read in nhi_wake_supported()
  (git-fixes).
- commit 4e3d5c2

- Input: synaptics-rmi4 - fix a locking bug in an error path
  (git-fixes).
- hwmon: (occ) Fix missing newline in occ_show_extended()
  (git-fixes).
- hwmon: (occ) Fix division by zero in occ_show_power_1()
  (git-fixes).
- hwmon: (tps53679) Fix device ID comparison and printing in
  tps53676_identify() (git-fixes).
- hwmon: (pxe1610) Check return value of page-select write in
  probe (git-fixes).
- commit 08cee84

- Revert "drm: Fix use-after-free on framebuffers and property
  blobs when calling drm_dev_unplug" (git-fixes).
- drm/i915/dsi: Don't do DSC horizontal timing adjustments in
  command mode (git-fixes).
- drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
  (git-fixes).
- commit 79130c8

- gpio: mxc: map Both Edge pad wakeup to Rising Edge (git-fixes).
- drm/ioc32: stop speculation on the drm_compat_ioctl path
  (git-fixes).
- drm/ast: dp501: Fix initialization of SCU2C (git-fixes).
- accel/qaic: Handle DBC deactivation if the owner went away
  (git-fixes).
- drm/i915/dp: Use crtc_state->enhanced_framing properly on
  ivb/hsw CPU eDP (git-fixes).
- crypto: af-alg - fix NULL pointer dereference in scatterwalk
  (git-fixes).
- crypto: caam - fix overflow on long hmac keys (git-fixes).
- crypto: caam - fix DMA corruption on long hmac keys (git-fixes).
- commit 376a907

- mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D
  mode (stable-fixes).
- commit 2d1bac8

- Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
  (git-fixes).
- wifi: ath11k: Pass the correct value of each TID during a stop
  AMPDU session (git-fixes).
- ASoC: Intel: boards: fix unmet dependency on PINCTRL
  (git-fixes).
- drm/amdgpu: prevent immediate PASID reuse case (stable-fixes).
- usb: core: new quirk to handle devices with zero configurations
  (stable-fixes).
- drm/amdgpu: fix gpu idle power consumption issue for gfx v12
  (stable-fixes).
- drm/ttm/tests: Fix build failure on PREEMPT_RT (stable-fixes).
- commit 7612e81

- net/x25: Fix overflow when accumulating packets (git-fixes).
- net/x25: Fix potential double free of skb (git-fixes).
- Bluetooth: SMP: derive legacy responder STK authentication
  from MITM state (git-fixes).
- Bluetooth: SMP: force responder MITM requirements before
  building the pairing response (git-fixes).
- Bluetooth: MGMT: validate mesh send advertising payload length
  (git-fixes).
- Bluetooth: hci_event: fix potential UAF in
  hci_le_remote_conn_param_req_evt (git-fixes).
- Bluetooth: MGMT: validate LTK enc_size on load (git-fixes).
- Bluetooth: SCO: fix race conditions in sco_sock_connect()
  (git-fixes).
- Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if
  immediate (git-fixes).
- NFC: pn533: bound the UART receive buffer (git-fixes).
- wifi: iwlwifi: mvm: fix potential out-of-bounds read in
  iwl_mvm_nd_match_info_handler() (git-fixes).
- wifi: wilc1000: fix u8 overflow in SSID scan buffer size
  calculation (git-fixes).
- ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add
  rollback on failure (git-fixes).
- ALSA: caiaq: fix stack out-of-bounds read in init_card
  (git-fixes).
- dmaengine: idxd: Fix freeing the allocated ida too late
  (git-fixes).
- Bluetooth: btintel: serialize btintel_hw_error() with
  hci_req_sync_lock (git-fixes).
- hwmon: axi-fan: don't use driver_override as IRQ name
  (git-fixes).
- ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
  (stable-fixes).
- ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
  (stable-fixes).
- ASoC: fsl_easrc: Fix event generation in
  fsl_easrc_iec958_set_reg() (stable-fixes).
- ASoC: fsl_easrc: Fix event generation in
  fsl_easrc_iec958_put_bits() (stable-fixes).
- HID: mcp2221: cancel last I2C command on read error
  (stable-fixes).
- HID: asus: avoid memory leak in asus_report_fixup()
  (stable-fixes).
- HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
  (stable-fixes).
- HID: apple: avoid memory leak in apple_report_fixup()
  (stable-fixes).
- platform/x86: intel-hid: Enable 5-button array on ThinkPad X1
  Fold 16 Gen 1 (stable-fixes).
- platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to
  dmi_vgbs_allow_list (stable-fixes).
- platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix
  touchscreen on SUPI S10 (stable-fixes).
- mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D
  mode (stable-fixes).
- Bluetooth: hci_sync: Remove remaining dependencies of
  hci_request (stable-fixes).
- Bluetooth: Remove 3 repeated macro definitions (stable-fixes).
- hwmon: (axi-fan-control) Make use of dev_err_probe()
  (stable-fixes).
- hwmon: (axi-fan-control) Use device firmware agnostic API
  (stable-fixes).
- dmaengine: idxd: Remove usage of the deprecated ida_simple_xx()
  API (stable-fixes).
- commit a6c10e6

- smb: client: fix krb5 mount with username option (git-fixes).
- commit 0e79d63

- cifs: make default value of retrans as zero (git-fixes).
- commit 5d4b8c7

- smb: client: fix in-place encryption corruption in SMB2_write()
  (git-fixes).
- commit e7144ea

- smb: client: fix broken multichannel with krb5+signing
  (git-fixes).
- commit c4e64ff

- smb: client: fix cifs_pick_channel when channels are equally
  loaded (git-fixes).
- commit dfa0ecd

- cifs: some missing initializations on replay (git-fixes).
- commit d98e800

- smb: client: prevent races in ->query_interfaces() (git-fixes).
- commit 78bd9b1

- smb: client: add proper locking around ses->iface_last_update
  (git-fixes).
- commit 2b9d663

- cifs: force interface update before a fresh session setup
  (git-fixes).
- commit 99b8edb

- cifs: Fix locking usage for tcon fields (git-fixes).
- commit 2b819dd

- cpufreq/amd-pstate: Set the initial min_freq to
  lowest_nonlinear_freq (bsc#1252803).
- commit 6223a40

- cpufreq/amd-pstate: Remove the redundant verify() function
  (bsc#1252803).
- commit 2b46ac7

- net: add proper RCU protection to /proc/net/ptype
  (CVE-2026-23255 bsc#1259891).
- commit 970622a

- netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  (CVE-2026-23274 bsc#1260005).
- commit b61cf0b

- netfilter: nf_tables: always walk all pending catchall elements
  (CVE-2026-23278 bsc#1259998).
- commit bde2f22

- netfilter: nf_tables: unconditionally bump set->nelems before
  insertion (CVE-2026-23272 bsc#1260009).
- commit 4898783

- io_uring/rw: free potentially allocated iovec on cache put
  failure (CVE-2026-23259 bsc#1259866).
- commit 1144130

- btrfs: fix zero size inode with non-zero size after log replay
  (git-fixes).
- commit f810098

- btrfs: log new dentries when logging parent dir of a conflicting
  inode (git-fixes).
- commit 2a2fe4a

- bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
  (CVE-2026-23319 bsc#1260735).
- commit afdc54a

- bpf: export bpf_link_inc_not_zero (CVE-2026-23319 bsc#1260735).
- commit 3c0dee1

- Refresh patches.suse/nvme-add-partial_nid-quirk.patch.
- commit a0ca140

- net: mana: Trigger VF reset/recovery on health check failure due to HWC timeout (bsc#1259580).
- net: mana: fix use-after-free in add_adev() error path (git-fixes).
- commit dd3433a

- btrfs: fix reservation leak in some error paths when inserting
  inline extent (CVE-2025-71268 bsc#1259865).
- commit f586cfb

- btrfs: do not free data reservation in fallback from inline
  due to -ENOSPC (CVE-2025-71269 bsc#1259889).
- commit 2f2ec59

- kABI fix for ipvlan: Make the addrs_lock be per port
  (CVE-2026-23103 bsc#1257773).
- ipvlan: Make the addrs_lock be per port (CVE-2026-23103
  bsc#1257773).
- commit 546f802

- btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (bsc#1257777).
- commit 5f963b7

- rename Hyper-v patch files to simplify further SP6-SP7 merges
- commit aa72668

- rename Hyper-v patch files to simplify further SP6-SP7 merges
- commit a92902d

- Move upstreamed mana patch into sorted section
- commit 7835c5b

- net/mlx5: Fix crash when moving to switchdev mode (git-fixes).
- bonding: do not set usable_slaves for broadcast mode
  (git-fixes).
- idpf: nullify pointers after they are freed (git-fixes).
- gve: fix incorrect buffer cleanup in
  gve_tx_clean_pending_packets for QPL (CVE-2026-23386
  bsc#1260799).
- commit 1051a48

- xen/privcmd: unregister xenstore notifier on module exit
  (git-fixes).
- commit 0c94fec

- xen/privcmd: restrict usage in unprivileged domU (bsc#1259707
  CVE-2026-31788).
- commit 0c51260

- dmaengine: idxd: Fix freeing the allocated ida too late
  (git-fixes).
- irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
  (git-fixes).
- commit 8028a3b

- phy: ti: j721e-wiz: Fix device node reference leak in
  wiz_get_lane_phy_types() (git-fixes).
- dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
  (git-fixes).
- dmaengine: xilinx: xilinx_dma: Fix residue calculation for
  cyclic DMA (git-fixes).
- dmaengine: xilinx: xilinx_dma: Fix dma_device directions
  (git-fixes).
- dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
  (git-fixes).
- dmaengine: sh: rz-dmac: Protect the driver specific lists
  (git-fixes).
- dmaengine: idxd: fix possible wrong descriptor completion in
  llist_abort_desc() (git-fixes).
- dmaengine: xilinx: xdma: Fix regmap init error handling
  (git-fixes).
- dmaengine: idxd: Fix leaking event log memory (git-fixes).
- dmaengine: idxd: Fix memory leak when a wq is reset (git-fixes).
- dmaengine: idxd: Fix not releasing workqueue on .release()
  (git-fixes).
- commit f22ea44

- drm/vmwgfx: Return the correct value in vmw_translate_ptr
  functions (CVE-2026-23317 bsc#1260562).
- commit 62d1ba3

- PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
  (CVE-2026-23361 bsc#1260732).
- commit e28de60

- Delete
  patches.suse/scsi-Fix-sas_user_scan-to-handle-wildcard-and-multi-channe.patch.
  See bsc#1257506.
  The git-fix being removed had issues and needs to be redesigned.
  In the mean time, reverting this addresses the problem.
  See:
  > https://bugzilla.suse.com/show_bug.cgi?id=1257506#c47
- commit 14d63c6

- drm/i915/dp_tunnel: Fix error handling when clearing stream
  BW in atomic state (git-fixes).
- drm/amd/display: Do not skip unrelated mode changes in DSC
  validation (git-fixes).
- commit 4a5f1c3

- hwmon: (adm1177) fix sysfs ABI violation and current unit
  conversion (git-fixes).
- hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
  (git-fixes).
- hwmon: (peci/cputemp) Fix crit_hyst returning delta instead
  of absolute temperature (git-fixes).
- hwmon: (pmbus/isl68137) Add mutex protection for AVS enable
  sysfs attributes (git-fixes).
- drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
  (git-fixes).
- drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
  (git-fixes).
- spi: spi-fsl-lpspi: fix teardown order issue (UAF) (git-fixes).
- regmap: Synchronize cache for the page selector (git-fixes).
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial
  payload (git-fixes).
- ASoC: adau1372: Fix clock leak on PLL lock failure (git-fixes).
- ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
  (git-fixes).
- ASoC: Intel: catpt: Fix the device initialization (git-fixes).
- ALSA: firewire-lib: fix uninitialized local variable
  (git-fixes).
- commit a2172e0

- libceph: reset sparse-read state in osd_fault() (CVE-2026-23136 bsc#1258303).
- commit 7606f01

- wifi: libertas: fix use-after-free in lbs_free_adapter()
  (CVE-2026-23281 bsc#1260464).
- commit 43b8c42

- Bluetooth: btintel: serialize btintel_hw_error() with
  hci_req_sync_lock (git-fixes).
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in
  l2cap_ecred_conn_req (git-fixes).
- drm/xe: Open-code GGTT MMIO access protection (git-fixes).
- drm/xe/oa: Allow reading after disabling OA stream (git-fixes).
- drm/amdgpu/mmhub4.1.0: add bounds checking for cid
  (stable-fixes).
- drm/amd: fix dcn 2.01 check (git-fixes).
- drm/amd/display: Wrap dcn32_override_min_req_memclk() in
  DC_FP_{START, END} (git-fixes).
- drm: Fix use-after-free on framebuffers and property blobs
  when calling drm_dev_unplug (git-fixes).
- drm/imagination: Fix deadlock in soft reset sequence
  (git-fixes).
- mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN
  stations (stable-fixes).
- Bluetooth: qca: fix ROM version reading on WCN3998 chips
  (git-fixes).
- Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
  (git-fixes).
- Bluetooth: MGMT: Fix list corruption and UAF in command complete
  handlers (git-fixes).
- Bluetooth: ISO: Fix defer tests being unstable (git-fixes).
- USB: add QUIRK_NO_BOS for video capture several devices
  (stable-fixes).
- drm/i915/dsc: Add helper for writing DSC Selective Update ET
  parameters (stable-fixes).
- drm/i915/dsc: Add Selective Update register definitions
  (stable-fixes).
- drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on
  smu v13.0.x (stable-fixes).
- drm/amd/display: Fallback to boot snapshot for dispclk
  (stable-fixes).
- ASoC: cs42l43: Report insert for exotic peripherals
  (stable-fixes).
- drm/amdgpu/vcn5: Add SMU dpm interface type (stable-fixes).
- commit 11a085d

- serial: 8250: Add late synchronize_irq() to shutdown to handle
  DW UART BUSY (git-fixes).
- serial: 8250_pci: add support for the AX99100 (stable-fixes).
- serial: uartlite: fix PM runtime usage count underflow on probe
  (git-fixes).
- serial: 8250: Fix TX deadlock when using DMA (git-fixes).
- spi: fix statistics allocation (git-fixes).
- spi: fix use-after-free on controller registration failure
  (git-fixes).
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is
  not enough headroom (git-fixes).
- wifi: mac80211: fix NULL deref in mesh_matches_local()
  (git-fixes).
- wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
  (git-fixes).
- wifi: mac80211: Fix static_branch_dec() underflow for
  aql_disable (git-fixes).
- soc: fsl: qbman: fix race condition in qman_destroy_fq
  (git-fixes).
- USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb
  speed (stable-fixes).
- usb: dwc3: pci: add support for the Intel Nova Lake -H
  (stable-fixes).
- usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
  (stable-fixes).
- usb: xhci: Prevent interrupt storm on host controller error
  (HCE) (stable-fixes).
- usb: cdc-acm: Restore CAP_BRK functionnality to CH343
  (git-fixes).
- usb: misc: uss720: properly clean up reference in uss720_probe()
  (stable-fixes).
- usb: image: mdc800: kill download URB on timeout (stable-fixes).
- usb: mdc800: handle signal and read racing (stable-fixes).
- usb: yurex: fix race in probe (stable-fixes).
- staging: rtl8723bs: properly validate the data in
  rtw_get_ie_ex() (stable-fixes).
- wifi: mac80211: set default WMM parameters on all links
  (stable-fixes).
- usb: cdns3: fix role switching during resume (git-fixes).
- USB: serial: f81232: fix incomplete serial port generation
  (stable-fixes).
- usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
  (stable-fixes).
- usb: cdns3: remove redundant if branch (stable-fixes).
- commit 9cd434e

- nfc: nci: fix circular locking dependency in nci_close_device
  (git-fixes).
- pinctrl: mediatek: common: Fix probe failure for devices
  without EINT (git-fixes).
- pinctrl: qcom: spmi-gpio: implement .get_direction()
  (git-fixes).
- platform/x86: ISST: Correct locked bit width (git-fixes).
- platform/olpc: olpc-xo175-ec: Fix overflow error message to
  print inlen (git-fixes).
- mmc: sdhci: fix timing selection for 1-bit bus width
  (git-fixes).
- mmc: sdhci-pci-gli: fix GL9750 DMA write corruption (git-fixes).
- mtd: rawnand: pl353: make sure optimal timings are applied
  (git-fixes).
- mtd: rawnand: brcmnand: skip DMA during panic write (git-fixes).
- mtd: rawnand: serialize lock/unlock against other NAND
  operations (git-fixes).
- mtd: rawnand: cadence: Fix error check for dma_alloc_coherent()
  in cadence_nand_init() (git-fixes).
- mtd: Avoid boot crash in RedBoot partition table parser
  (git-fixes).
- NFC: nxp-nci: allow GPIOs to sleep (git-fixes).
- net: usb: aqc111: Do not perform PM inside suspend callback
  (git-fixes).
- net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
  (git-fixes).
- net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
  (git-fixes).
- net/rose: fix NULL pointer dereference in rose_transmit_link
  on reconnect (git-fixes).
- PM: runtime: Fix a race condition related to device removal
  (git-fixes).
- regulator: pca9450: Correct interrupt type (git-fixes).
- platform/x86: dell-wmi: Add audio/mic mute key codes
  (stable-fixes).
- pinctrl: equilibrium: fix warning trace on load (git-fixes).
- pinctrl: equilibrium: rename irq_chip function callbacks
  (stable-fixes).
- net: usb: pegasus: validate USB endpoints (stable-fixes).
- mfd: omap-usb-host: Fix OF populate on driver rebind
  (git-fixes).
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (git-fixes).
- regulator: pca9450: Make IRQ optional (stable-fixes).
- PCI: Update BAR # and window messages (stable-fixes).
- mfd: qcom-pm8xxx: Convert to platform remove callback returning
  void (stable-fixes).
- commit ec2548e

- can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
  (git-fixes).
- can: gw: fix OOB heap access in cgw_csum_crc8_rel() (git-fixes).
- media: mc, v4l2: serialize REINIT and REQBUFS with
  req_queue_mutex (git-fixes).
- i2c: pxa: defer reset on Armada 3700 when recovery is used
  (git-fixes).
- i2c: fsi: Fix a potential leak in fsi_i2c_probe() (git-fixes).
- i2c: cp2615: fix serial string NULL-deref at probe (git-fixes).
- hwmon: (pmbus/isl68137) Fix unchecked return value and use
  sysfs_emit() (git-fixes).
- drm/radeon: apply state adjust rules to some additional HAINAN
  vairants (stable-fixes).
- drm/amdgpu: apply state adjust rules to some additional HAINAN
  vairants (stable-fixes).
- drm/amdgpu/gmc9.0: add bounds checking for cid (stable-fixes).
- drm/amdgpu/mmhub3.0: add bounds checking for cid (stable-fixes).
- drm/amdgpu/mmhub3.0.2: add bounds checking for cid
  (stable-fixes).
- drm/amdgpu/mmhub3.0.1: add bounds checking for cid
  (stable-fixes).
- drm/amdgpu/mmhub2.3: add bounds checking for cid (stable-fixes).
- drm/amdgpu/mmhub2.0: add bounds checking for cid (stable-fixes).
- drm/amd/display: Fix DisplayID not-found handling in
  parse_edid_displayid_vrr() (git-fixes).
- drm/i915/gt: Check set_default_submission() before deferencing
  (git-fixes).
- firmware: arm_scpi: Fix device_node reference leak in probe path
  (git-fixes).
- drm/amd: Set num IP blocks to 0 if discovery fails
  (stable-fixes).
- drm/msm/dsi: fix pclk rate calculation for bonded dsi
  (git-fixes).
- drm/msm/dsi: fix hdisplay calculation when programming dsi
  registers (git-fixes).
- drm/amdgpu: Fix use-after-free race in VM acquire
  (stable-fixes).
- HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks
  missing them (stable-fixes).
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics
  (stable-fixes).
- drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode
  with HPD (stable-fixes).
- drm/amd/display: Add pixel_clock to amd_pp_display_configuration
  (stable-fixes).
- drm/msm/dsi: Document DSC related pclk_rate and hdisplay
  calculations (stable-fixes).
- mfd: omap-usb-host: Convert to platform remove callback
  returning void (stable-fixes).
- media: tegra-video: Use accessors for pad config 'try_*' fields
  (stable-fixes).
- i2c: cp2615: replace deprecated strncpy with strscpy
  (stable-fixes).
- commit 19fcdc7

- Bluetooth: btusb: clamp SCO altsetting table indices
  (git-fixes).
- Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite
  loop (git-fixes).
- Bluetooth: L2CAP: Fix send LE flow credits in ACL link
  (git-fixes).
- Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
  (git-fixes).
- Bluetooth: hci_ll: Fix firmware leak on error path (git-fixes).
- Bluetooth: MGMT: Fix dangling pointer on
  mgmt_add_adv_patterns_monitor_complete (git-fixes).
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to
  missing sock_hold (git-fixes).
- Bluetooth: L2CAP: Validate PDU length before reading SDU length
  in l2cap_ecred_data_rcv() (git-fixes).
- commit d4b4294

- ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
  (git-fixes).
- Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before
  access (git-fixes).
- Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
  (git-fixes).
- Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
  (git-fixes).
- Bluetooth: HIDP: Fix possible UAF (git-fixes).
- Bluetooth: hci_sync: Fix hci_le_create_conn_sync (git-fixes).
- Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy (git-fixes).
- Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed
  SDU (git-fixes).
- Bluetooth: LE L2CAP: Disconnect if received packet's SDU
  exceeds IMTU (git-fixes).
- ACPI: processor: Fix previous acpi_processor_errata_piix4()
  fix (git-fixes).
- ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2
  mixer interfaces (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
  (stable-fixes).
- ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
  (stable-fixes).
- ALSA: hda: cs35l56: Fix signedness error in
  cs35l56_hda_posture_put() (git-fixes).
- ACPI: PM: Save NVS memory on Lenovo G70-35 (stable-fixes).
- ACPI: OSI: Add DMI quirk for Acer Aspire One D255
  (stable-fixes).
- ALSA: hda/conexant: Fix headphone jack handling on Acer Swift
  SF314 (stable-fixes).
- ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
  (stable-fixes).
- ALSA: pci: hda: use snd_kcontrol_chip() (stable-fixes).
- commit d930c45

- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337 CVE-2026-23201).
- commit c1d531a

- libceph: make calc_target() set t->paused, not just clear it (bsc#1257682 CVE-2026-23047).
- commit 9134bbf

- x86/platform/uv: Handle deconfigured sockets (bsc#1260347).
- commit f09c977

- Update config files.
  Pure run_oldconfig -- dismiss removed configs like
  CONFIG_TEST_LIVEPATCH.
- commit 9d0caee

- RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243 bsc#1259797)
- commit b964f1d

- RDMA/siw: Fix potential NULL pointer dereference in header processing (CVE-2026-23242 bsc#1259795)
- commit b14d408

- drm/i915/display: Add module param to skip retraining of dp link (bsc#1253129).
- commit a1c1b16

- Revert "drm/i915/display: Add quirk to skip retraining of dp link (bsc#1253129)."
  This reverts commit 7b00832607c6c999e43cce72e2a7feaf7db3bbfa.
- commit 6e3ca09

- Update kabi files (jsc#PED-15582).
- commit c06e238

- bpf, test_run: Subtract size of xdp_frame from allowed metadata
  size (CVE-2026-23140 bsc#1258305).
- commit 2fff83a

- scsi: scsi_transport_sas: Fix the maximum channel scanning issue
  (bsc#1255687, git-fixes).
- commit 7ef9035

- scsi: hisi_sas: Fix NULL pointer exception during user_scan()
  (bsc#1255687).
- commit 0bea95d

- s390/debug: Pass in and enforce output buffer size for format
  handlers (jsc#PED-15582).
- Refresh
  patches.suse/s390-pci-Add-pci_msg-debug-view-to-PCI-report.patch.
- commit d8dd9c7

- netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
  (CVE-2026-23231 bsc#1259188).
- netfilter: nf_tables: register hooks last when adding new
  chain/flowtable (CVE-2026-23231 bsc#1259188).
- commit fd540e6

- Refresh azure config files, no runtime changes intended.
- commit 5cf84bb

- x86/vmware: Fix hypercall clobbers (CVE-2026-23215 bsc#1258476).
- commit 1c8c139

- nvme: fix memory leak in quirks_param_set() (bsc#1243208).
- nvme: add support for dynamic quirk configuration via module
  parameter (bsc#1243208).
- nvme: expose active quirks in sysfs (bsc#1243208).
  Refresh:
- patches.suse/nvme-add-partial_nid-quirk.patch
- commit c6a41b6

- scsi: target: target_core_configfs: Add length check to avoid
  buffer overflow (CVE-2025-39998 bsc#1252073).
- commit dff8745

- l2tp: avoid one data-race in l2tp_tunnel_del_work() (CVE-2026-23120 bsc#1258280)
- commit 975023c

- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (CVE-2026-23187 bsc#1258330)
- commit 4b333af

- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (CVE-2026-23030 bsc#1257561)
- commit 4c335f0

- Use unified maintainers' email address
- commit d015f19

- Use unified maintainers' email address
- commit e7955e0

- Use unified maintainers' email address
- commit 3c803fb

- vhost: fix caching attributes of MMIO regions by setting them
  explicitly (git-fixes).
- commit 08a5f81

- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
  (git-fixes).
- commit 096a8f1

- xenbus: Use .freeze/.thaw to handle xenbus devices (git-fixes).
- commit da0ad33

- net/mana: Null service_wq on setup error to prevent double
  destroy (git-fix).
- commit 4b21ba9

- iomap: adjust read range correctly for non-block-aligned positions (CVE-2025-68794 bsc#1256647)
- commit bad6b8a

- net: mana: fix use-after-free in mana_hwc_destroy_channel()
  by reordering teardown (git-fixes).
- net/mana: Null service_wq on setup error to prevent double
  destroy (git-fixes).
- commit 679a815

- Refresh
  patches.suse/selftests-bpf-add-verifier-sign-extension-bound-comp.patch.
  Updated expected BPF verifier message to align with those output by
  SLE15-SP7 kernel.
- commit bc643c5

- usb: cdc-acm: Restore CAP_BRK functionnality to CH343
  (git-fixes).
- commit 4484921

- usb: roles: get usb role switch from parent only for
  usb-b-connector (git-fixes).
- usb: xhci: Fix memory leak in xhci_disable_slot() (git-fixes).
- usb: class: cdc-wdm: fix reordering issue in read code path
  (git-fixes).
- usb: renesas_usbhs: fix use-after-free in ISR during device
  removal (git-fixes).
- usb: gadget: f_mass_storage: Fix potential integer overflow
  in check_command_size_in_blocks() (git-fixes).
- USB: core: Limit the length of unkillable synchronous timeouts
  (git-fixes).
- USB: usbtmc: Use usb_bulk_msg_killable() with user-specified
  timeouts (git-fixes).
- USB: usbcore: Introduce usb_bulk_msg_killable() (git-fixes).
- usb: core: don't power off roothub PHYs if phy_set_mode()
  fails (git-fixes).
- iio: gyro: mpu3050-core: fix pm_runtime error handling
  (git-fixes).
- iio: gyro: mpu3050-i2c: fix pm_runtime error handling
  (git-fixes).
- iio: chemical: sps30_serial: fix buffer size in
  sps30_serial_read_meas() (git-fixes).
- iio: chemical: sps30_i2c: fix buffer size in
  sps30_i2c_read_meas() (git-fixes).
- iio: chemical: bme680: Fix measurement wait duration calculation
  (git-fixes).
- iio: dac: ds4424: reject -128 RAW value (git-fixes).
- iio: potentiometer: mcp4131: fix double application of wiper
  shift (git-fixes).
- iio: frequency: adf4377: Fix duplicated soft reset mask
  (git-fixes).
- iio: imu: inv_icm42600: fix odr switch to the same value
  (git-fixes).
- commit 4702653

- drm/amdkfd: Unreserve bo if queue update failed (git-fixes).
- drm/amdgpu: Fix kernel-doc comments for some LUT properties
  (git-fixes).
- drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT
  for smu v14 (git-fixes).
- drm/msm/dsi: fix pclk rate calculation for bonded dsi
  (git-fixes).
- drm/msm: Fix dma_free_attrs() buffer size (git-fixes).
- drm/msm/dsi: fix hdisplay calculation when programming dsi
  registers (git-fixes).
- drm/xe/reg_sr: Fix leak on xa_store failure (git-fixes).
- drm/xe: Do not preempt fence signaling CS instructions
  (git-fixes).
- drm/exynos: vidi: use ctx->lock to protect struct vidi_context
  member variables related to memory alloc/free (stable-fixes).
- drm/exynos: vidi: fix to avoid directly dereferencing user
  pointer (stable-fixes).
- drm/exynos/vidi: Remove redundant error handling in
  vidi_get_modes() (stable-fixes).
- commit 56adb0e

- drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
  (git-fixes).
- ASoC: amd: acp-mach-common: Add missing error check for clock
  acquisition (git-fixes).
- ASoC: detect empty DMI strings (git-fixes).
- ASoC: amd: acp3x-rt5682-max9836: Add missing error check for
  clock acquisition (git-fixes).
- ASoC: soc-core: flush delayed work before removing DAIs and
  widgets (git-fixes).
- ASoC: soc-core: drop delayed_work_pending() check before flush
  (git-fixes).
- ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop
  and start (git-fixes).
- ALSA: pcm: fix use-after-free on linked stream runtime in
  snd_pcm_drain() (git-fixes).
- commit 1a186d1

- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (CVE-2025-71231 bsc#1258424).
- commit f8a95c7

- Add python36-certifi provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-idna provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-packaging provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-pycparser provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-py provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-six provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- fix regression in CVE-2025-66471.patch when downloading large files
  (bsc#1259829)