{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [
                "linux-headers-5.15.0-1112-kvm",
                "linux-image-5.15.0-1112-kvm",
                "linux-kvm-headers-5.15.0-1112",
                "linux-modules-5.15.0-1112-kvm"
            ],
            "removed": [
                "linux-headers-5.15.0-1111-kvm",
                "linux-image-5.15.0-1111-kvm",
                "linux-kvm-headers-5.15.0-1111",
                "linux-modules-5.15.0-1111-kvm"
            ],
            "diff": [
                "linux-headers-kvm",
                "linux-image-kvm",
                "linux-kvm"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "linux-headers-kvm",
                "from_version": {
                    "source_package_name": "linux-meta-kvm",
                    "source_package_version": "5.15.0.1111.107",
                    "version": "5.15.0.1111.107"
                },
                "to_version": {
                    "source_package_name": "linux-meta-kvm",
                    "source_package_version": "5.15.0.1112.108",
                    "version": "5.15.0.1112.108"
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Bump ABI 5.15.0-1112",
                            ""
                        ],
                        "package": "linux-meta-kvm",
                        "version": "5.15.0.1112.108",
                        "urgency": "medium",
                        "distributions": "jammy",
                        "launchpad_bugs_fixed": [],
                        "author": "Jia Gapuz <jia.gapuz@canonical.com>",
                        "date": "Tue, 27 Oct 2026 13:42:26 -0500"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-image-kvm",
                "from_version": {
                    "source_package_name": "linux-meta-kvm",
                    "source_package_version": "5.15.0.1111.107",
                    "version": "5.15.0.1111.107"
                },
                "to_version": {
                    "source_package_name": "linux-meta-kvm",
                    "source_package_version": "5.15.0.1112.108",
                    "version": "5.15.0.1112.108"
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Bump ABI 5.15.0-1112",
                            ""
                        ],
                        "package": "linux-meta-kvm",
                        "version": "5.15.0.1112.108",
                        "urgency": "medium",
                        "distributions": "jammy",
                        "launchpad_bugs_fixed": [],
                        "author": "Jia Gapuz <jia.gapuz@canonical.com>",
                        "date": "Tue, 27 Oct 2026 13:42:26 -0500"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-kvm",
                "from_version": {
                    "source_package_name": "linux-meta-kvm",
                    "source_package_version": "5.15.0.1111.107",
                    "version": "5.15.0.1111.107"
                },
                "to_version": {
                    "source_package_name": "linux-meta-kvm",
                    "source_package_version": "5.15.0.1112.108",
                    "version": "5.15.0.1112.108"
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Bump ABI 5.15.0-1112",
                            ""
                        ],
                        "package": "linux-meta-kvm",
                        "version": "5.15.0.1112.108",
                        "urgency": "medium",
                        "distributions": "jammy",
                        "launchpad_bugs_fixed": [],
                        "author": "Jia Gapuz <jia.gapuz@canonical.com>",
                        "date": "Tue, 27 Oct 2026 13:42:26 -0500"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [
            {
                "name": "linux-headers-5.15.0-1112-kvm",
                "from_version": {
                    "source_package_name": "linux-kvm",
                    "source_package_version": "5.15.0-1111.116",
                    "version": null
                },
                "to_version": {
                    "source_package_name": "linux-kvm",
                    "source_package_version": "5.15.0-1112.117",
                    "version": "5.15.0-1112.117"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-63940",
                        "url": "https://ubuntu.com/security/CVE-2026-63940",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: SEV: Ignore Port I/O requests of length '0'  Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-07-19 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-21656",
                        "url": "https://ubuntu.com/security/CVE-2025-21656",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur  scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error codes.  Currently the driver just passes error codes of scsi_execute_cmd() to hwmon core, which is incorrect because hwmon only checks for negative error codes. This leads to hwmon reporting uninitialized data to userspace in case of SCSI errors (for example if the disk drive was disconnected).  This patch checks scsi_execute_cmd() output and returns -EIO if it's error code is positive.  [groeck: Avoid inline variable declaration for portability]",
                        "cve_priority": "low",
                        "cve_public_date": "2025-01-21 13:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-74350",
                        "url": "https://ubuntu.com/security/CVE-2026-74350",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate fast symlink target during inode read  ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem.  Fast symlinks need the same treatment.  A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio().  That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio.  If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer.  Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated.  This keeps malformed fast symlinks from reaching the read path.  Validation reproduced this kernel report: KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace:   dump_stack_lvl+0x66/0xa0 (?:?)   print_report+0xce/0x630 (?:?)   ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?)   srso_alias_return_thunk+0x5/0xfbef5 (?:?)   __virt_addr_valid+0x19f/0x330 (?:?)   kasan_report+0xe0/0x110 (?:?)   kasan_check_range+0x105/0x1b0 (?:?)   __asan_memcpy+0x23/0x60 (?:?)   filemap_read_folio+0x27/0xe0 (?:?)   filemap_read_folio+0x35/0xe0 (?:?)   do_read_cache_folio+0x138/0x230 (?:?)   __page_get_link+0x26/0x110 (?:?)   page_get_link+0x2e/0x70 (?:?)   vfs_readlink+0x15e/0x250 (?:?)   touch_atime+0x4d/0x370 (?:?)   do_readlinkat+0x186/0x200 (?:?)   do_user_addr_fault+0x65a/0x890 (?:?)   __x64_sys_readlink+0x46/0x60 (?:?)   do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)   entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)",
                        "cve_priority": "high",
                        "cve_public_date": "2026-08-15 06:22:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2171787,
                    2171802,
                    2167995,
                    2171521
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-63940",
                                "url": "https://ubuntu.com/security/CVE-2026-63940",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: SEV: Ignore Port I/O requests of length '0'  Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-07-19 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-21656",
                                "url": "https://ubuntu.com/security/CVE-2025-21656",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur  scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error codes.  Currently the driver just passes error codes of scsi_execute_cmd() to hwmon core, which is incorrect because hwmon only checks for negative error codes. This leads to hwmon reporting uninitialized data to userspace in case of SCSI errors (for example if the disk drive was disconnected).  This patch checks scsi_execute_cmd() output and returns -EIO if it's error code is positive.  [groeck: Avoid inline variable declaration for portability]",
                                "cve_priority": "low",
                                "cve_public_date": "2025-01-21 13:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-74350",
                                "url": "https://ubuntu.com/security/CVE-2026-74350",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate fast symlink target during inode read  ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem.  Fast symlinks need the same treatment.  A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio().  That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio.  If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer.  Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated.  This keeps malformed fast symlinks from reaching the read path.  Validation reproduced this kernel report: KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace:   dump_stack_lvl+0x66/0xa0 (?:?)   print_report+0xce/0x630 (?:?)   ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?)   srso_alias_return_thunk+0x5/0xfbef5 (?:?)   __virt_addr_valid+0x19f/0x330 (?:?)   kasan_report+0xe0/0x110 (?:?)   kasan_check_range+0x105/0x1b0 (?:?)   __asan_memcpy+0x23/0x60 (?:?)   filemap_read_folio+0x27/0xe0 (?:?)   filemap_read_folio+0x35/0xe0 (?:?)   do_read_cache_folio+0x138/0x230 (?:?)   __page_get_link+0x26/0x110 (?:?)   page_get_link+0x2e/0x70 (?:?)   vfs_readlink+0x15e/0x250 (?:?)   touch_atime+0x4d/0x370 (?:?)   do_readlinkat+0x186/0x200 (?:?)   do_user_addr_fault+0x65a/0x890 (?:?)   __x64_sys_readlink+0x46/0x60 (?:?)   do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)   entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)",
                                "cve_priority": "high",
                                "cve_public_date": "2026-08-15 06:22:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * jammy/linux-kvm: 5.15.0-1112.117 -proposed tracker (LP: #2171787)",
                            "",
                            "  [ Ubuntu: 5.15.0-203.213 ]",
                            "",
                            "  * jammy/linux: 5.15.0-203.213 -proposed tracker (LP: #2171802)",
                            "  * CVE-2026-63940",
                            "    - KVM: SEV: Ignore Port I/O requests of length '0'",
                            "  * CVE-2025-21656",
                            "    - hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors",
                            "      occur",
                            "  * HMC error triggers cascading PF resets and tears down RDMA connections",
                            "    (LP: #2167995)",
                            "    - RDMA/irdma: Suppress PF reset on HMC error",
                            "  * CVE-2026-74350",
                            "    - ocfs2: validate fast symlink target during inode read",
                            "  * Jammy update: v5.15.223 upstream stable release (LP: #2171521)",
                            "    - netfilter: nfnetlink_queue: unbreak SCTP traffic",
                            "    - ipv4: validate checksum_start before completing checksum",
                            "    - ipv4: free inet_opt and ireq_opt after an RCU grace period",
                            "    - Linux 5.15.223",
                            ""
                        ],
                        "package": "linux-kvm",
                        "version": "5.15.0-1112.117",
                        "urgency": "medium",
                        "distributions": "jammy",
                        "launchpad_bugs_fixed": [
                            2171787,
                            2171802,
                            2167995,
                            2171521
                        ],
                        "author": "Jia Gapuz <jia.gapuz@canonical.com>",
                        "date": "Tue, 27 Oct 2026 11:57:19 -0500"
                    }
                ],
                "notes": "linux-headers-5.15.0-1112-kvm version '5.15.0-1112.117' (source package linux-kvm version '5.15.0-1112.117') was added. linux-headers-5.15.0-1112-kvm version '5.15.0-1112.117' has the same source package name, linux-kvm, as removed package linux-headers-5.15.0-1111-kvm. As such we can use the source package version of the removed package, '5.15.0-1111.116', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.",
                "is_version_downgrade": false
            },
            {
                "name": "linux-image-5.15.0-1112-kvm",
                "from_version": {
                    "source_package_name": "linux-signed-kvm",
                    "source_package_version": "5.15.0-1111.116",
                    "version": null
                },
                "to_version": {
                    "source_package_name": "linux-signed-kvm",
                    "source_package_version": "5.15.0-1112.117",
                    "version": "5.15.0-1112.117"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    1786013
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Main version: 5.15.0-1112.117",
                            "",
                            "  * Packaging resync (LP: #1786013)",
                            "    - [Packaging] debian/tracking-bug -- resync from main package",
                            ""
                        ],
                        "package": "linux-signed-kvm",
                        "version": "5.15.0-1112.117",
                        "urgency": "medium",
                        "distributions": "jammy",
                        "launchpad_bugs_fixed": [
                            1786013
                        ],
                        "author": "Jia Gapuz <jia.gapuz@canonical.com>",
                        "date": "Tue, 27 Oct 2026 13:43:07 -0500"
                    }
                ],
                "notes": "linux-image-5.15.0-1112-kvm version '5.15.0-1112.117' (source package linux-signed-kvm version '5.15.0-1112.117') was added. linux-image-5.15.0-1112-kvm version '5.15.0-1112.117' has the same source package name, linux-signed-kvm, as removed package linux-image-5.15.0-1111-kvm. As such we can use the source package version of the removed package, '5.15.0-1111.116', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.",
                "is_version_downgrade": false
            },
            {
                "name": "linux-kvm-headers-5.15.0-1112",
                "from_version": {
                    "source_package_name": "linux-kvm",
                    "source_package_version": "5.15.0-1111.116",
                    "version": null
                },
                "to_version": {
                    "source_package_name": "linux-kvm",
                    "source_package_version": "5.15.0-1112.117",
                    "version": "5.15.0-1112.117"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-63940",
                        "url": "https://ubuntu.com/security/CVE-2026-63940",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: SEV: Ignore Port I/O requests of length '0'  Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-07-19 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-21656",
                        "url": "https://ubuntu.com/security/CVE-2025-21656",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur  scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error codes.  Currently the driver just passes error codes of scsi_execute_cmd() to hwmon core, which is incorrect because hwmon only checks for negative error codes. This leads to hwmon reporting uninitialized data to userspace in case of SCSI errors (for example if the disk drive was disconnected).  This patch checks scsi_execute_cmd() output and returns -EIO if it's error code is positive.  [groeck: Avoid inline variable declaration for portability]",
                        "cve_priority": "low",
                        "cve_public_date": "2025-01-21 13:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-74350",
                        "url": "https://ubuntu.com/security/CVE-2026-74350",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate fast symlink target during inode read  ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem.  Fast symlinks need the same treatment.  A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio().  That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio.  If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer.  Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated.  This keeps malformed fast symlinks from reaching the read path.  Validation reproduced this kernel report: KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace:   dump_stack_lvl+0x66/0xa0 (?:?)   print_report+0xce/0x630 (?:?)   ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?)   srso_alias_return_thunk+0x5/0xfbef5 (?:?)   __virt_addr_valid+0x19f/0x330 (?:?)   kasan_report+0xe0/0x110 (?:?)   kasan_check_range+0x105/0x1b0 (?:?)   __asan_memcpy+0x23/0x60 (?:?)   filemap_read_folio+0x27/0xe0 (?:?)   filemap_read_folio+0x35/0xe0 (?:?)   do_read_cache_folio+0x138/0x230 (?:?)   __page_get_link+0x26/0x110 (?:?)   page_get_link+0x2e/0x70 (?:?)   vfs_readlink+0x15e/0x250 (?:?)   touch_atime+0x4d/0x370 (?:?)   do_readlinkat+0x186/0x200 (?:?)   do_user_addr_fault+0x65a/0x890 (?:?)   __x64_sys_readlink+0x46/0x60 (?:?)   do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)   entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)",
                        "cve_priority": "high",
                        "cve_public_date": "2026-08-15 06:22:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2171787,
                    2171802,
                    2167995,
                    2171521
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-63940",
                                "url": "https://ubuntu.com/security/CVE-2026-63940",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: SEV: Ignore Port I/O requests of length '0'  Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-07-19 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-21656",
                                "url": "https://ubuntu.com/security/CVE-2025-21656",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur  scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error codes.  Currently the driver just passes error codes of scsi_execute_cmd() to hwmon core, which is incorrect because hwmon only checks for negative error codes. This leads to hwmon reporting uninitialized data to userspace in case of SCSI errors (for example if the disk drive was disconnected).  This patch checks scsi_execute_cmd() output and returns -EIO if it's error code is positive.  [groeck: Avoid inline variable declaration for portability]",
                                "cve_priority": "low",
                                "cve_public_date": "2025-01-21 13:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-74350",
                                "url": "https://ubuntu.com/security/CVE-2026-74350",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate fast symlink target during inode read  ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem.  Fast symlinks need the same treatment.  A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio().  That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio.  If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer.  Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated.  This keeps malformed fast symlinks from reaching the read path.  Validation reproduced this kernel report: KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace:   dump_stack_lvl+0x66/0xa0 (?:?)   print_report+0xce/0x630 (?:?)   ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?)   srso_alias_return_thunk+0x5/0xfbef5 (?:?)   __virt_addr_valid+0x19f/0x330 (?:?)   kasan_report+0xe0/0x110 (?:?)   kasan_check_range+0x105/0x1b0 (?:?)   __asan_memcpy+0x23/0x60 (?:?)   filemap_read_folio+0x27/0xe0 (?:?)   filemap_read_folio+0x35/0xe0 (?:?)   do_read_cache_folio+0x138/0x230 (?:?)   __page_get_link+0x26/0x110 (?:?)   page_get_link+0x2e/0x70 (?:?)   vfs_readlink+0x15e/0x250 (?:?)   touch_atime+0x4d/0x370 (?:?)   do_readlinkat+0x186/0x200 (?:?)   do_user_addr_fault+0x65a/0x890 (?:?)   __x64_sys_readlink+0x46/0x60 (?:?)   do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)   entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)",
                                "cve_priority": "high",
                                "cve_public_date": "2026-08-15 06:22:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * jammy/linux-kvm: 5.15.0-1112.117 -proposed tracker (LP: #2171787)",
                            "",
                            "  [ Ubuntu: 5.15.0-203.213 ]",
                            "",
                            "  * jammy/linux: 5.15.0-203.213 -proposed tracker (LP: #2171802)",
                            "  * CVE-2026-63940",
                            "    - KVM: SEV: Ignore Port I/O requests of length '0'",
                            "  * CVE-2025-21656",
                            "    - hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors",
                            "      occur",
                            "  * HMC error triggers cascading PF resets and tears down RDMA connections",
                            "    (LP: #2167995)",
                            "    - RDMA/irdma: Suppress PF reset on HMC error",
                            "  * CVE-2026-74350",
                            "    - ocfs2: validate fast symlink target during inode read",
                            "  * Jammy update: v5.15.223 upstream stable release (LP: #2171521)",
                            "    - netfilter: nfnetlink_queue: unbreak SCTP traffic",
                            "    - ipv4: validate checksum_start before completing checksum",
                            "    - ipv4: free inet_opt and ireq_opt after an RCU grace period",
                            "    - Linux 5.15.223",
                            ""
                        ],
                        "package": "linux-kvm",
                        "version": "5.15.0-1112.117",
                        "urgency": "medium",
                        "distributions": "jammy",
                        "launchpad_bugs_fixed": [
                            2171787,
                            2171802,
                            2167995,
                            2171521
                        ],
                        "author": "Jia Gapuz <jia.gapuz@canonical.com>",
                        "date": "Tue, 27 Oct 2026 11:57:19 -0500"
                    }
                ],
                "notes": "linux-kvm-headers-5.15.0-1112 version '5.15.0-1112.117' (source package linux-kvm version '5.15.0-1112.117') was added. linux-kvm-headers-5.15.0-1112 version '5.15.0-1112.117' has the same source package name, linux-kvm, as removed package linux-headers-5.15.0-1111-kvm. As such we can use the source package version of the removed package, '5.15.0-1111.116', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.",
                "is_version_downgrade": false
            },
            {
                "name": "linux-modules-5.15.0-1112-kvm",
                "from_version": {
                    "source_package_name": "linux-kvm",
                    "source_package_version": "5.15.0-1111.116",
                    "version": null
                },
                "to_version": {
                    "source_package_name": "linux-kvm",
                    "source_package_version": "5.15.0-1112.117",
                    "version": "5.15.0-1112.117"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-63940",
                        "url": "https://ubuntu.com/security/CVE-2026-63940",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: SEV: Ignore Port I/O requests of length '0'  Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.",
                        "cve_priority": "critical",
                        "cve_public_date": "2026-07-19 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-21656",
                        "url": "https://ubuntu.com/security/CVE-2025-21656",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur  scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error codes.  Currently the driver just passes error codes of scsi_execute_cmd() to hwmon core, which is incorrect because hwmon only checks for negative error codes. This leads to hwmon reporting uninitialized data to userspace in case of SCSI errors (for example if the disk drive was disconnected).  This patch checks scsi_execute_cmd() output and returns -EIO if it's error code is positive.  [groeck: Avoid inline variable declaration for portability]",
                        "cve_priority": "low",
                        "cve_public_date": "2025-01-21 13:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-74350",
                        "url": "https://ubuntu.com/security/CVE-2026-74350",
                        "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate fast symlink target during inode read  ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem.  Fast symlinks need the same treatment.  A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio().  That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio.  If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer.  Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated.  This keeps malformed fast symlinks from reaching the read path.  Validation reproduced this kernel report: KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace:   dump_stack_lvl+0x66/0xa0 (?:?)   print_report+0xce/0x630 (?:?)   ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?)   srso_alias_return_thunk+0x5/0xfbef5 (?:?)   __virt_addr_valid+0x19f/0x330 (?:?)   kasan_report+0xe0/0x110 (?:?)   kasan_check_range+0x105/0x1b0 (?:?)   __asan_memcpy+0x23/0x60 (?:?)   filemap_read_folio+0x27/0xe0 (?:?)   filemap_read_folio+0x35/0xe0 (?:?)   do_read_cache_folio+0x138/0x230 (?:?)   __page_get_link+0x26/0x110 (?:?)   page_get_link+0x2e/0x70 (?:?)   vfs_readlink+0x15e/0x250 (?:?)   touch_atime+0x4d/0x370 (?:?)   do_readlinkat+0x186/0x200 (?:?)   do_user_addr_fault+0x65a/0x890 (?:?)   __x64_sys_readlink+0x46/0x60 (?:?)   do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)   entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)",
                        "cve_priority": "high",
                        "cve_public_date": "2026-08-15 06:22:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2171787,
                    2171802,
                    2167995,
                    2171521
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-63940",
                                "url": "https://ubuntu.com/security/CVE-2026-63940",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: SEV: Ignore Port I/O requests of length '0'  Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.",
                                "cve_priority": "critical",
                                "cve_public_date": "2026-07-19 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-21656",
                                "url": "https://ubuntu.com/security/CVE-2025-21656",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur  scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error codes.  Currently the driver just passes error codes of scsi_execute_cmd() to hwmon core, which is incorrect because hwmon only checks for negative error codes. This leads to hwmon reporting uninitialized data to userspace in case of SCSI errors (for example if the disk drive was disconnected).  This patch checks scsi_execute_cmd() output and returns -EIO if it's error code is positive.  [groeck: Avoid inline variable declaration for portability]",
                                "cve_priority": "low",
                                "cve_public_date": "2025-01-21 13:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-74350",
                                "url": "https://ubuntu.com/security/CVE-2026-74350",
                                "cve_description": "In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate fast symlink target during inode read  ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem.  Fast symlinks need the same treatment.  A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio().  That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio.  If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer.  Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated.  This keeps malformed fast symlinks from reaching the read path.  Validation reproduced this kernel report: KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace:   dump_stack_lvl+0x66/0xa0 (?:?)   print_report+0xce/0x630 (?:?)   ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?)   srso_alias_return_thunk+0x5/0xfbef5 (?:?)   __virt_addr_valid+0x19f/0x330 (?:?)   kasan_report+0xe0/0x110 (?:?)   kasan_check_range+0x105/0x1b0 (?:?)   __asan_memcpy+0x23/0x60 (?:?)   filemap_read_folio+0x27/0xe0 (?:?)   filemap_read_folio+0x35/0xe0 (?:?)   do_read_cache_folio+0x138/0x230 (?:?)   __page_get_link+0x26/0x110 (?:?)   page_get_link+0x2e/0x70 (?:?)   vfs_readlink+0x15e/0x250 (?:?)   touch_atime+0x4d/0x370 (?:?)   do_readlinkat+0x186/0x200 (?:?)   do_user_addr_fault+0x65a/0x890 (?:?)   __x64_sys_readlink+0x46/0x60 (?:?)   do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)   entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)",
                                "cve_priority": "high",
                                "cve_public_date": "2026-08-15 06:22:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * jammy/linux-kvm: 5.15.0-1112.117 -proposed tracker (LP: #2171787)",
                            "",
                            "  [ Ubuntu: 5.15.0-203.213 ]",
                            "",
                            "  * jammy/linux: 5.15.0-203.213 -proposed tracker (LP: #2171802)",
                            "  * CVE-2026-63940",
                            "    - KVM: SEV: Ignore Port I/O requests of length '0'",
                            "  * CVE-2025-21656",
                            "    - hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors",
                            "      occur",
                            "  * HMC error triggers cascading PF resets and tears down RDMA connections",
                            "    (LP: #2167995)",
                            "    - RDMA/irdma: Suppress PF reset on HMC error",
                            "  * CVE-2026-74350",
                            "    - ocfs2: validate fast symlink target during inode read",
                            "  * Jammy update: v5.15.223 upstream stable release (LP: #2171521)",
                            "    - netfilter: nfnetlink_queue: unbreak SCTP traffic",
                            "    - ipv4: validate checksum_start before completing checksum",
                            "    - ipv4: free inet_opt and ireq_opt after an RCU grace period",
                            "    - Linux 5.15.223",
                            ""
                        ],
                        "package": "linux-kvm",
                        "version": "5.15.0-1112.117",
                        "urgency": "medium",
                        "distributions": "jammy",
                        "launchpad_bugs_fixed": [
                            2171787,
                            2171802,
                            2167995,
                            2171521
                        ],
                        "author": "Jia Gapuz <jia.gapuz@canonical.com>",
                        "date": "Tue, 27 Oct 2026 11:57:19 -0500"
                    }
                ],
                "notes": "linux-modules-5.15.0-1112-kvm version '5.15.0-1112.117' (source package linux-kvm version '5.15.0-1112.117') was added. linux-modules-5.15.0-1112-kvm version '5.15.0-1112.117' has the same source package name, linux-kvm, as removed package linux-headers-5.15.0-1111-kvm. As such we can use the source package version of the removed package, '5.15.0-1111.116', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.",
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "removed": {
        "deb": [
            {
                "name": "linux-headers-5.15.0-1111-kvm",
                "from_version": {
                    "source_package_name": "linux-kvm",
                    "source_package_version": "5.15.0-1111.116",
                    "version": "5.15.0-1111.116"
                },
                "to_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": null
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-image-5.15.0-1111-kvm",
                "from_version": {
                    "source_package_name": "linux-signed-kvm",
                    "source_package_version": "5.15.0-1111.116",
                    "version": "5.15.0-1111.116"
                },
                "to_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": null
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-kvm-headers-5.15.0-1111",
                "from_version": {
                    "source_package_name": "linux-kvm",
                    "source_package_version": "5.15.0-1111.116",
                    "version": "5.15.0-1111.116"
                },
                "to_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": null
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "linux-modules-5.15.0-1111-kvm",
                "from_version": {
                    "source_package_name": "linux-kvm",
                    "source_package_version": "5.15.0-1111.116",
                    "version": "5.15.0-1111.116"
                },
                "to_version": {
                    "source_package_name": null,
                    "source_package_version": null,
                    "version": null
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20261104.2 to 20261107",
    "from_series": "jammy",
    "to_series": "jammy",
    "from_serial": "20261104.2",
    "to_serial": "20261107",
    "from_manifest_filename": "release_manifest.previous",
    "to_manifest_filename": "manifest.current"
}