* Update to upstream stable Linux 5.10.274 (from 5.10.273). * Bump kernel ABI to 55: ship the ELS kernel as 5.10.0-55-*, distinct from the prior 5.10.0-54. * CVE-2021-47094 - KVM: x86/mmu: Factor out tdp_iter_return_to_root {CVE-2021-47094} - KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094} * CVE-2023-22995 - usb: dwc3: dwc3-qcom: Add missing platform_device_put() in dwc3_qcom_acpi_register_core {CVE-2023-22995} * CVE-2023-52664 - net: atlantic: eliminate double free in error handling logic {CVE-2023-52664} * CVE-2023-52760 - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc {CVE-2023-52760} * CVE-2024-26996 - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error {CVE-2024-26996} * CVE-2024-36915 - net: add copy_safe_from_sockptr() helper {CVE-2024-36915} - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies {CVE-2024-36915} * CVE-2024-46859 - platform/x86: panasonic-laptop: Fix sticky key init bug {CVE-2024-46859} - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses {CVE-2024-46859} * CVE-2025-38198 - fbcon: Introduce wrapper for console->fb_info lookup {CVE-2025-38198} - fbcon: Use fbcon_info_from_console() in fbcon_modechange_possible() {CVE-2025-38198} - fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198} * CVE-2025-38702 - fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702} * CVE-2025-40135 - ipv6: use RCU in ip6_xmit() {CVE-2025-40135} * CVE-2025-40158 - ipv6: use RCU in ip6_output() {CVE-2025-40158} * CVE-2025-71082 - Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082} * CVE-2026-43250 - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() {CVE-2026-43250} * CVE-2026-45893 - apparmor: Fix & Optimize table creation from possibly unaligned memory {CVE-2026-45893} * CVE-2026-46254 - AppArmor: Allow apparmor to handle unaligned dfa tables {CVE-2026-46254} * CVE-2026-53224 - sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224} * CVE-2026-53246 - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246} * CVE-2026-63983 - net: Introduce skb tc depth field to track packet loops {CVE-2026-63983} - net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983} * CVE-2026-68108 - drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108} * CVE-2026-68329 - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329} * CVE-2026-74310 - vhost/net: complete zerocopy ubufs only once {CVE-2026-74310} * CVE-2026-74454 - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size {CVE-2026-74454} * CVE-2026-74689 - net: Make copy_safe_from_sockptr() match documentation {CVE-2026-74689} - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689} * CVE-2026-74752 - sctp: validate cookie AUTH state before use {CVE-2026-74752} * CVE-2026-80576 - drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576} * CVE-2026-90116 - ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116} * CVE-2026-92508 - RDMA/core: Fix potential use after free in ib_free_cq() {CVE-2026-92508} * CVE-2026-92509 - RDMA/core: Fix potential use after free in counter_release() {CVE-2026-92509} * CVE-2026-93104 - RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104} * CVE-2026-93117 - usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117} * CVE-2026-97493 - drm/amdgpu: Bound GPIO I2C table entry count from VBIOS {CVE-2026-97493} * CVE-2026-97541 - wifi: ath9k_htc: don't store usb_device_id {CVE-2026-97541} * CVE-2026-98176 - drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc {CVE-2026-98176} * CVE-2026-98213 - mmc: core: Cancel SDIO IRQ work before freeing host {CVE-2026-98213} * CVE-2026-98428 - ALSA: usb: 6fire: Avoid embedded URBs {CVE-2026-98428} * Miscellaneous upstream changes - xen-netback: Fix UAF when reading statistics data - xen-netback: defer xenvif_mcast_addr_list_free() - xen-blkback: Avoid UAF when reading I/O statistics - Linux 5.10.274