* Bump kernel ABI to 30: ship the ELS kernel as 4.19.0-30-*, distinct from the prior 4.19.0-29. * CVE-2021-3493 - vfs: move cap_convert_nscap() call into vfs_setxattr() {CVE-2021-3493} - ecryptfs: fix uid translation for setxattr on security.capability {CVE-2021-3493} * CVE-2025-23142 - sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142} * CVE-2025-38352 - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352} * CVE-2025-39964 - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964} * CVE-2026-52955 - libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955} * CVE-2026-53091 - net: account for encap headers in qdisc pkt len {CVE-2026-53091} - xfrm: Don't clobber inner headers when already set {CVE-2026-53091} * CVE-2026-53266 - netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266} * CVE-2026-63814 - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814} * CVE-2026-63815 - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes {CVE-2026-63815} * CVE-2026-63922 - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922} * CVE-2026-63962 - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962} * CVE-2026-64001 - ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001} * CVE-2026-64009 - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009} * CVE-2026-64011 - nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011} * CVE-2026-64372 - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372} * CVE-2026-64378 - writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378} - writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378} * CVE-2026-64381 - smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381} * CVE-2026-64471 - Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471} * CVE-2026-64483 - ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483} * CVE-2026-64504 - iio: accel: bmc150: clamp the device-reported FIFO frame count {CVE-2026-64504} * CVE-2026-64505 - usb: gadget: function: rndis: add length check for header {CVE-2026-64505} * CVE-2026-64541 - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket {CVE-2026-64541} * CVE-2026-64543 - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543} * CVE-2026-64546 - drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546} * CVE-2026-64563 - rhashtable: clear stale iter->p on table restart {CVE-2026-64563} * CVE-2026-64564 - sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564} * CVE-2026-72389 - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} * CVE-2026-74444 - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} * CVE-2026-74454 - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size {CVE-2026-74454} * CVE-2026-74469 - sctp: prevent peer transport count overflow {CVE-2026-74469} * CVE-2026-74479 - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} * CVE-2026-74498 - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} * CVE-2026-74499 - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} * CVE-2026-74505 - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} * CVE-2026-74540 - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540} * CVE-2026-74550 - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} * CVE-2026-74556 - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} * CVE-2026-74569 - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} * CVE-2026-80947 - wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop {CVE-2026-80947} * CVE-2026-80948 - wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948} * CVE-2026-80974 - mfd: sm501: Fix potential memory leaks during remove {CVE-2026-80974} * CVE-2026-80976 - seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976} * CVE-2026-81000 - net: tun: bound receive headroom {CVE-2026-81000} * CVE-2026-81001 - slip: fix use-after-free in sl_sync() {CVE-2026-81001} * CVE-2026-81003 - net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003} * CVE-2026-89440 - mmc: via-sdmmc: stop card-detect handling on probe failure {CVE-2026-89440} * CVE-2026-89441 - mmc: via-sdmmc: cancel card-detect work on remove {CVE-2026-89441} * CVE-2026-89477 - sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477} * CVE-2026-89478 - sctp: drop a chunk if its transport was removed {CVE-2026-89478} * CVE-2026-89487 - openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487} * CVE-2026-89494 - ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494} * CVE-2026-89495 - ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495} * CVE-2026-89527 - svcrdma: Use svc_xprt_put to free listener on create failure {CVE-2026-89527} * CVE-2026-89537 - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537} * CVE-2026-89539 - SUNRPC: reject duplicate CREDS_VALUE options {CVE-2026-89539} * CVE-2026-89543 - sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir {CVE-2026-89543} * CVE-2026-89544 - SUNRPC: fix gssx_dec_option_array error path bugs {CVE-2026-89544} * CVE-2026-89548 - SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548} * CVE-2026-89549 - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} * CVE-2026-89550 - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} * CVE-2026-89552 - params: fix charp corruption on allocation failure {CVE-2026-89552} * CVE-2026-89553 - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} * CVE-2026-89555 - mpls: reload header after pskb_may_pull() {CVE-2026-89555} * CVE-2026-89559 - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} * CVE-2026-89575 - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} * CVE-2026-89607 - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet {CVE-2026-89607} * CVE-2026-89633 - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} * CVE-2026-89637 - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637} * CVE-2026-89641 - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() {CVE-2026-89641} * CVE-2026-89655 - ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock {CVE-2026-89655} * CVE-2026-89656 - libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656} * CVE-2026-89671 - nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671} * CVE-2026-89699 - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} * CVE-2026-89733 - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() {CVE-2026-89733} * CVE-2026-89736 - usb: gadget: u_audio: Fix use-after-free on sound card disconnect {CVE-2026-89736} * CVE-2026-89761 - apparmor: fix out-of-bounds write when null terminating a label vec {CVE-2026-89761} * CVE-2026-99999 - ipv4: validate checksum_start before completing checksum {CVE-2026-99999} * Miscellaneous upstream changes - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()