ELSA-2026-1581

[3.10.0-1160.119.1.0.18]

• e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898} [Orabug: 38904071]
• i40e: fix idx validation in config queues msg {CVE-2025-39971} [Orabug: 38904071]
• vsock: track pkt owner vsock [Orabug: 38904071]
• vhost-vsock: add pkt cancel capability [Orabug: 38904071]
• vsock: cancel packets when failing to connect [Orabug: 38904071]
• vsock: notify server to shutdown when client has pending signal [Orabug: 38904071]
• vsock: remove vsock from connected table when connect is interrupted by a signal [Orabug: 38904071]
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248} [Orabug: 38904071]

[3.10.0-1160.119.1.0.17]

• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675} [Orabug: 38860426]
• ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-53705} [Orabug: 38860426]
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823} [Orabug: 38860426]
• libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285} [Orabug: 38860426]

[3.10.0-1160.119.1.0.16]

• net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356} [Orabug: 38790244]
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367} [Orabug: 38790244]
• iomap: iomap: fix memory corruption when recording {CVE-2022-50406} [Orabug: 38790244]
• mm: fix zswap writeback race condition {CVE-2023-53178} [Orabug: 38790244]
• Bluetooth: L2CAP: fix 'bad unlock balance' in l2cap_disconnect_rsp {CVE-2023-53297} [Orabug: 38790244]
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322} [Orabug: 38790244]
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729} [Orabug: 38790244]
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} [Orabug: 38790244]
• tcp: fix potential double free issue for fastopen_req [Orabug: 38790244]
• tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() {CVE-2025-39955} [Orabug:...